Privacy Policy
Last updated: August 8, 2026
This policy explains how Rudud (rudud.app) collects, uses, and protects your data. Rudud is owned and operated by Alhramayn LLC, a company registered in Pennsylvania, United States.
Rudud is an independent service. It is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. or Instagram.
What Rudud does
Rudud lets owners of Instagram professional accounts (Business or Creator) send automated private replies to comments on their posts, using Meta's official APIs.
Data we collect
1. Your account data
Email address, name, a one-way hashed password, and your account and language preferences.
2. Connected Instagram account data
When you connect your account, Meta provides us with: your account ID, username, profile picture, and an access token. Tokens are stored encrypted, never displayed in any interface, and never written to logs.
3. Interaction data
- Comments on your posts that match automation rules you created.
- Direct messages exchanged through the platform.
- Instagram-scoped IDs and usernames of people who interact.
- Optional data a person voluntarily provides (email or phone) via forms you create.
4. Technical data
IP address, browser type, access times, and error logs.
5. Waitlist
Email address only, for people who signed up before launch.
We do not collect: payment card data (handled entirely by our payment provider), private conversations unrelated to automations you created, or data from accounts you have not connected.
How we use data
- Running the automations you created: keyword matching and reply delivery.
- Showing you performance analytics.
- Enforcing Meta's rate limits and preventing violations.
- Sending you operational messages about your account.
- Improving the service and diagnosing failures.
- Meeting legal obligations.
We do not sell your data or your audience's data. We do not use your message content for advertising or to train AI models.
Who we share with
| Party | Purpose |
|---|---|
| Meta Platforms, Inc. | Operating the service through Instagram's official APIs |
| Cloudflare, Inc. | Hosting, data storage, and abuse prevention |
| Payment provider | Subscription processing (card data never touches our systems) |
| Email provider | Sending operational messages |
| Legal authorities | Where legally required |
When a message reaches you, and how it stops
Rudud never sends you an automated message unless you comment first, using the keyword the account owner chose. Your comment starts the conversation every time; we never start one, and we send nothing to anyone who has not commented.
To receive nothing further, do not comment with that keyword, or use Instagram's own controls: mute, block or report the account. Those work at the platform level rather than inside our tool, so neither the account owner nor we can override them.
Until 31 August 2026 there was also a stop word (STOP or إيقاف) printed in every message, and it was removed on that date. We say so here rather than leave it to be discovered, because anyone who read this page before that date read a different promise.
Your rights over your data are unchanged: you may ask us to delete what we hold about you by emailing privacy@rudud.app, and we act within the retention periods below.
Message deletion
When a user deletes a message on Instagram, Meta sends us a notification. We delete our copy of that message within 24 hours.
How this works in practice: we do not store message text in our database at all. The only copy that passes through our systems is the raw event archive we receive from Meta, kept for one purpose, reprocessing after a technical failure. That archive is deleted automatically within 24 hours of receipt, by a job that runs every hour.
Retention
| Data type | Period |
|---|---|
| Account data | Duration of subscription + 30 days after deletion |
| Instagram access tokens | Until disconnection, then deleted immediately |
| Contacts and leads | Duration of subscription + 30 days |
| Event logs and analytics | 90 days |
| Audit logs | 12 months (security requirement) |
| Waitlist | Until launch or deletion request |
| Raw event archive | 24 hours, deleted automatically every hour |
| Message text in our database | Never stored |
| Deleted Instagram messages | Deleted within 24 hours |
| Opt-out records | Permanent, survives disconnection |
| Account governor state (counters and comment ids) | Deleted when a deletion request completes |
Opt-out records outlive disconnection. If you asked not to receive automated messages, that request is kept even if the account that messaged you is disconnected or its data deleted. It is the right of the person who asked, not data belonging to the account holder, and it is not theirs to erase. We keep the minimum needed to stop messaging you and nothing more.
Your rights
You have the right to access, correct, delete, and export your data in a machine-readable format, to object to processing, and to withdraw consent by disconnecting your account at any time.
To exercise any of these, email privacy@rudud.app. We respond within 30 days.
Disconnecting: from your Rudud account settings, or via Instagram → Settings → Apps and websites → Remove Rudud. On disconnection the access token is deleted immediately and related data within 30 days.
Security
- All traffic encrypted with TLS.
- Access tokens encrypted at rest with AES-GCM.
- Every inbound Meta request signature-verified before processing.
- Access permissions scoped and reviewed regularly.
- Audit logs for all administrative actions.
No system is perfectly secure, but we follow industry standards. If a breach affects your data, we will notify you within 72 hours of becoming aware of it.
International transfers
Your data is stored on Cloudflare's globally distributed infrastructure and may be processed outside your country of residence. By using the service you consent to this.
Children
The service is not directed to anyone under 18, and we do not knowingly collect their data. If we learn we have, we delete it immediately.
Cookies
We use only cookies necessary for session handling and remembering your language preference. We do not use advertising trackers.
Changes
We may update this policy. For material changes we will notify you by email 30 days before they take effect.
Contact
Alhramayn LLC 34 E Main St, Carnegie, PA 15106, United States privacy@rudud.app | +1 412 770 0035
Change log
| Date | What changed | Why |
|---|---|---|
| 9 August 2026 | Made explicit that opt-out records are permanent and survive disconnection, and added the opt-out and account governor rows to the retention table | A clarification of an existing commitment, not a reduction of one. Section 4.5 has made opt-out permanent from the start, and a deletion request comes from the account holder, who cannot erase a protection a third party asked for. The text left this implicit; it is now stated. |