Privacy policy
Last updated: · Version: 2026-10-03 · Previous versions
This policy explains how Rudud (rudud.app) collects, uses, and protects your data. Rudud is owned and operated by Alhramayn LLC, a company registered in Pennsylvania, United States.
Rudud is an independent service. It is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. or Instagram.
What Rudud does
Rudud lets owners of Instagram professional accounts (Business or Creator) send automated private replies to comments on their posts, using Meta's official APIs.
Data we collect
1. Your account data
Email address, name, an internal user ID we assign, a one-way hashed password, and your account and language preferences.
Signing in with Google: Google gives us your name, email address and profile picture. We never receive your password.
Signing in with Apple (Sign in with Apple): Apple gives us a stable identifier for your account and an email address, which may be a private relay address Apple creates and forwards to your real inbox. If you choose to hide your email we never learn your real address, and we send operational messages to the relay address through Apple. Apple gives us your name only once, at your first sign-in, in the form you choose. When you delete your account, we revoke the Apple token linked to it with Apple itself, which ends Rudud's connection to your Apple account.
2. Connected Instagram account data
When you connect your account, Meta provides us with: your account ID, username, profile picture, and an access token. Tokens are stored encrypted, never displayed in any interface, and never written to logs.
3. Automation and interaction data
- The automation text you write: keywords, public replies to comments, and private messages with their buttons.
- Comments on your posts that match automation rules you created.
- Direct messages exchanged through the platform.
- Instagram-scoped IDs and Instagram usernames of people who interact with your account, and no one else. This is your own account's data: we show it to you alone, and we never share or sell it.
4. Technical data
IP address, browser type, access times, and error logs.
5. Waitlist
Email address only, for people who signed up before launch.
6. iPhone app
A device push token, only if you allow notifications. We use it for one purpose, delivering your account's notifications to your device through Apple's push notification service, and it is deleted when you sign out, when you delete your account, or when Apple tells us it is no longer valid. With it we store your device's language, time zone, and app version: the time zone lets us count notification limits by your local day, and the version helps us diagnose delivery.
We do not collect: payment card data (handled entirely by our payment provider), private conversations unrelated to automations you created, or data from accounts you have not connected.
How we use data
- Running the automations you created: keyword matching and reply delivery.
- Showing you performance analytics.
- Enforcing Meta's rate limits and preventing violations.
- Sending you operational messages about your account.
- Improving the service and diagnosing failures.
- Meeting legal obligations.
We do not sell your data or your audience's data. We do not use your message content for advertising or to train AI models.
No tracking, no ads: we do not track you across other companies' apps or websites, we show no ads on the website or in the app, and we share no data with data brokers or ad networks.
Who we share with
| Party | Purpose |
|---|---|
| Meta Platforms, Inc. | Operating the service through Instagram's official APIs |
| Cloudflare, Inc. | Hosting, data storage, and abuse prevention |
| Apple Inc. | Sign in with Apple, and delivering notifications to your device |
| Google LLC | Sign in with Google |
| Payment provider | Subscription processing (card data never touches our systems) |
| Email provider | Sending operational messages |
| Legal authorities | Where legally required |
When a message reaches you, and how it stops
Rudud never sends you an automated message unless you comment first, using the keyword the account owner chose. Your comment starts the conversation every time; we never start one, and we send nothing to anyone who has not commented.
To receive nothing further, do not comment with that keyword, or use Instagram's own controls: mute, block or report the account. Those work at the platform level rather than inside our tool, so neither the account owner nor we can override them.
Until 31 August 2026 there was also a stop word (STOP or إيقاف) printed in every message, and it was removed on that date. We say so here rather than leave it to be discovered, because anyone who read this page before that date read a different promise.
Your rights over your data are unchanged: you may ask us to delete what we hold about you by emailing privacy@rudud.app, and we act within the retention periods below.
Message deletion
When a user deletes a message on Instagram, Meta sends us a notification. We delete our copy of that message within 24 hours.
How this works in practice: we do not store message text in our database at all. The only copy that passes through our systems is the raw event archive we receive from Meta, kept for one purpose, reprocessing after a technical failure. That archive is deleted automatically within 24 hours of receipt, by a job that runs every hour.
Retention
| Data type | Period |
|---|---|
| Account data | Duration of subscription + 30 days after deletion |
| Instagram access tokens | Until disconnection, then deleted immediately |
| Device push token | Until you sign out or delete your account, or Apple tells us it is no longer valid |
| People and leads | Duration of subscription + 30 days |
| Event logs and analytics | 90 days |
| Aggregated hourly statistics (counts only, no personal data) | 13 months |
| Audit logs | 12 months (security requirement) |
| Waitlist | Until launch or deletion request |
| Raw event archive | 24 hours, deleted automatically every hour |
| Message text in our database | Never stored |
| Deleted Instagram messages | Deleted within 24 hours |
| Opt-out records | Permanent, survives disconnection |
| Account governor state (counters and comment ids) | Deleted when a deletion request completes |
Opt-out records outlive disconnection. If you asked not to receive automated messages, that request is kept even if the account that messaged you is disconnected or its data deleted. It is the right of the person who asked, not data belonging to the account holder, and it is not theirs to erase. We keep the minimum needed to stop messaging you and nothing more.
Your rights
You have the right to access, correct, delete, and export your data in a machine-readable format, to object to processing, and to withdraw consent by disconnecting your account at any time.
To exercise any of these, email privacy@rudud.app. We respond within 30 days.
Disconnecting: from your Rudud account settings, or via Instagram → Settings → Apps and websites → Remove Rudud. On disconnection the access token is deleted immediately and related data within 30 days.
Deleting your account: from Account → Delete my account in the Rudud iPhone app, or by emailing privacy@rudud.app. Every linked Instagram account is then disconnected as described above, your sessions and registered devices are deleted, we revoke your Apple token if you signed in with Apple, and the remaining data is deleted within the periods in the retention table.
Security
- All traffic encrypted with TLS.
- Access tokens encrypted at rest with AES-GCM.
- Every inbound Meta request signature-verified before processing.
- Access permissions scoped and reviewed regularly.
- Audit logs for all administrative actions.
No system is perfectly secure, but we follow industry standards. If a breach affects your data, we will notify you within 72 hours of becoming aware of it.
International transfers
Your data is stored on Cloudflare's globally distributed infrastructure and may be processed outside your country of residence. By using the service you consent to this.
Children
The service is not directed to anyone under 18, and we do not knowingly collect their data. If we learn we have, we delete it immediately.
Cookies
We use only cookies necessary for session handling and remembering your language preference, plus two short-lived functional cookies when you link an Instagram account: one that protects the linking step from forgery, and one that shows you the screen for a pending deletion request. Both expire within 10 minutes. We do not use advertising trackers.
Changes
We may update this policy. For material changes we will notify you by email 30 days before they take effect.
Contact
Alhramayn LLC 34 E Main St, Carnegie, PA 15106, United States privacy@rudud.app | +1 412 770 0035
Change log
| Date | What changed | Why |
|---|---|---|
| 3 October 2026 | Removed the line on optional email or phone from forms, since we collect neither from people who interact with you. Added that the device's language, time zone, and app version are stored with the push token, a row for aggregated hourly statistics (13 months), and the two functional cookies used when linking an account | To match what the code does exactly. The hourly statistics are counts with no personal data. No existing commitment is reduced |
| 30 September 2026 | Language review of the whole text: plainer wording and consistent terms ("disconnect", "private messages", "account picture") | No commitment and no period changes |
| 26 September 2026 | Added what the iPhone app and sign-in collect: the device push token (only with your permission), what Apple and Google give us at sign-in, revoking the Apple token on account deletion, automation text, the user ID, how to delete your account, and that there is no tracking and no ads. The Arabic text now writes Instagram in Latin letters | To match the App Store privacy label, and Meta's guidelines on writing the Instagram name. No existing commitment is reduced and no period changes |
| 9 August 2026 | Made explicit that opt-out records are permanent and survive disconnection, and added the opt-out and account governor rows to the retention table | A clarification of an existing commitment, not a reduction of one. Section 4.5 has made opt-out permanent from the start, and a deletion request comes from the account holder, who cannot erase a protection a third party asked for. The text left this implicit; it is now stated. |