Privacy policy

Last updated: October 25, 2026.

InstaSnapTik processes the public post URL you submit to retrieve available media. Requests are sent to the source platform and our downloader backend hosted on Railway. Public Instagram content is retrieved through RocketAPI. This provider receives the public link, username or identifier needed for retrieval. Visitors do not sign in or provide Instagram account credentials. A fallback TikTok provider, TikWM, may be used when configured. Media previews may load directly from the source platform. These services receive technical connection information.

The application has no permanent media library. Private server history is enabled automatically when a public link is successfully opened. Our database stores up to 50 recent source links, creator usernames, post IDs, titles and timestamps per browser for up to 30 days. There is no Recent links panel or browser-local link list. These records are encrypted and associated with a random browser cookie; they are not a public list or connected to a social-platform login. The cookie is Secure, HttpOnly and SameSite=Strict. Clearing it can prevent access to the backup; this feature does not sync across devices. Expired records stop appearing after 30 days and are removed incrementally as history is used. It does not store media files or recover earlier activity. The existing source-link restoration uses this tab’s browser history when you return from a preview. Our TikTok backend temporarily caches downloaded files for up to ten minutes. To reduce repeated requests, we briefly cache public-post metadata and media URLs, keyed by a hash of the post link. Successful metadata expires within 90 seconds; expired database records are removed as requests arrive. Signed download links expire after ten minutes. Hosting providers may retain technical request logs under their own policies. Temporary rate-limit counters help protect the service. We keep daily aggregate operational counts by platform and response status, processing times and bytes delivered. These counters do not store submitted URLs, creator names, IP addresses or visitor identifiers. Preview transfers are counted separately when the browser identifies them.

First-party traffic analytics count pageviews, approximate daily visitors, referring-site categories and device types. No analytics cookies or third-party analytics scripts are used. A first-party local-storage marker stores only the first observed UTC day, with no unique visitor ID, to estimate browsers returning on later days. The server receives only a returning yes/no flag. Clearing storage or changing browsers resets recognition; private browsing and unavailable storage can prevent recognition. To estimate daily visitors, the server briefly processes the connection IP address and browser user agent into a keyed hash that changes each UTC day. Raw addresses and user agents are not stored in these analytics tables. Daily hashes are kept for up to three calendar days; aggregate counts are kept for up to 13 months, with cleanup as requests arrive. Shared connections and browser changes can affect visitor estimates. A visitor is attributed to their first counted page and source of the UTC day. Submitted social links, titles, usernames, media and query strings are not included in traffic analytics. Do Not Track and Global Privacy Control signals are respected. Known bots and explicitly marked internal testing are excluded, but some automation may still be counted. By default, public downloader pages load an Adsterra 300 × 250 banner below the downloader (unit 31747382) and one header banner: 728 × 90 on desktop (unit 31749766) or 320 × 50 on mobile (unit 31749765). Only the fitting header size is loaded. Adsterra and its partners may process connection information, device/browser information, the site origin and cookies or similar identifiers to deliver and measure ads. Each banner runs in a separate frame. Third-party advertising code executes in the browser; the integration supplies the ad unit key, not submitted social links or private server history. The previous Monetag tag is not loaded. The downloader does not show an initial advertising-choice panel. You can decline advertising data use through Privacy settings in the footer and still download normally. This stops Adsterra from loading because a tracking-free delivery mode has not been verified for this banner. Previously saved choices to turn ads off are respected. Your advertising preference is stored in this browser for up to 180 days; change it through Privacy settings in the footer. Turning ads off reloads the page to stop the loaded advertising code; this does not automatically remove cookies previously set by the ad provider. Global Privacy Control and Do Not Track signals keep Adsterra ads off. See https://adsterra.com/privacy-policy/ for the provider’s privacy policy. Do not submit private links, passwords, account cookies or sensitive personal information.

For privacy questions or deletion requests, contact contact@instasnaptik.com. Include enough information to identify your request; do not send passwords.

The separate media inspector at /tools/media-inspector reads a file selected from your device using local browser APIs. Its contents, name and measurements are not uploaded, stored on the server or sent to analytics. No advertising or analytics scripts run on that page. It reads a bounded header and available browser metadata; clearing the tool releases its temporary local file reference.