Privacy policy
Instash · Last updated 11 November 2026
Instash is an app for keeping the links, posts, screenshots and notes you want to come back to. A helper called Pebble files them into collections and helps you find and use them. This page explains what we collect, why, and the choices you have.
What we collect
- Your account: your username and a password, stored only as a secure hash. You can add a display name.
- What you save: links, text you share into the app, notes, photos, screenshots and other files you add, the collections you make, and your choices on saves such as Later, Done and why you saved something.
- Your chats with Pebble: the questions you ask and the answers.
- Basic technical records: the IP address and time of requests, kept briefly to stop abuse (for example, too many sign-in attempts).
We don't collect your contacts, your location, or what you do in other apps.
How we use it
- To store your saves and keep them in sync across your phones.
- To understand each save: we open a shared link's public page once to read its title, description, picture and text, and we read text in images you add. Software on our own servers then picks a collection, writes a short summary and finds any places mentioned.
- To search your saves and answer your questions in chat, using only your own saves.
All of this runs on our own servers with open models we host ourselves. We don't send your saves to outside AI companies, and we don't use your saves to train models.
Who else sees data
- Hosting: our servers and file storage are run by DigitalOcean, in Asia.
- Websites you save: when you save a link, our server visits that page once, the way a browser would. It follows the site's robots.txt rules.
- Places and maps: place names found in your saves are looked up with OpenStreetMap's Nominatim service. The map draws its tiles from OpenFreeMap, which sees your phone's IP address when the map loads.
- Collections you share: if you make a share link, anyone with that link can see that collection until you turn the link off.
We don't sell your data, show ads, or use advertising or tracking tools.
How long we keep it
- Your saves stay until you delete them. A deleted save is removed from our servers within 30 days.
- Deleting your account removes your account, saves, files, collections, chats and share links straight away. Copies in our backups are removed within 14 days.
Your choices
- Edit or delete any save, collection or chat in the app.
- Delete your account in the app (Profile, then Delete account) or on our account deletion page.
- Ask us for a copy of your data, or ask any question about it, using the contact below.
Security
All traffic uses HTTPS. Passwords are stored as hashes, files are kept in private storage and only shown to their owner, and access to our servers is limited.
Children
Instash isn't meant for children under 13, and we don't knowingly collect their data.
Changes
If this policy changes, we'll update the date at the top and, for important changes, tell you in the app.
Contact
Use Settings in the app to reach us.