Privacy policy

Last updated September 30, 2026

wopwop (wopwop.app) is a small, invite-only service that helps you run your Instagram Business or Creator account: an assistant called Wop answers direct messages, replies to comments on your posts, and publishes posts you schedule. This policy explains what we collect, why, and the choices you have.

What we collect

Your wopwop account: your email address and name from Google sign-in or the email and password sign-up.
Instagram accounts you connect: the account's ID and username, and the access token Instagram gives us. Tokens are encrypted before they are stored.
Messages and comments: direct messages and comments sent to your connected accounts, and the replies Wop sends, so Wop can answer them and show you its activity.
Your content and settings: posts, captions and media you schedule, and the business details, rules and keywords you give Wop.

How we use it

Only to provide wopwop to you: answering messages and comments, publishing your scheduled posts, and showing you what Wop did. We do not sell your data, and we do not use it for advertising.

Who processes it for us

Google Firebase for sign-in.
Cloudflare for hosting, our database and file storage.
Meta (Instagram), to read and send messages, comments and posts on the accounts you connect.
An AI provider (Anthropic or Google), which receives the text of an incoming message together with your business details to draft Wop's reply.

Keeping and deleting your data

Disconnecting an Instagram account in wopwop deletes its stored token along with the conversations and posts wopwop kept for it. You can also remove wopwop's access at any time in Instagram, under Settings → Apps and websites.

How to delete your account

In the app: go to Security, then Danger Zone, and choose Delete account. wopwop disconnects from your Instagram accounts right away and deletes your posts, conversations, settings and uploads. Nothing already published on Instagram is removed.
By email: if you can't sign in, email privacy@wopwop.app from the address on your account with the subject "Delete my account". We may ask you to confirm the request, and we complete it within 30 days.

Security

Everything travels over HTTPS. Instagram tokens are encrypted at rest and never sent to your browser, and only people on wopwop's invite list can sign in.

Changes and contact

If this policy changes, we will update the date above. Questions or requests: privacy@wopwop.app.