Metricatik

Privacy Policy

Effective date: September 27, 2026 · Last updated: October 13, 2026

Metricatik is an analytics application for Instagram professional accounts (Business and Creator accounts). This policy explains what information Metricatik collects, how it is used and protected, who it is shared with, how long it is kept, and how you can remove it. It applies to the Metricatik website at www.metricatik.com and the application at app.metricatik.com, including when the application is installed on a phone.

1. Information we collect

Your Metricatik account

  • Account details: your mobile number and, if you set one, a securely hashed password. If you choose to sign in with Google, we receive your email address and Google account identifier from Google instead.
  • Verification codes: short-lived six-digit codes we send to your mobile number by text message, to verify the number, sign you in or reset your password.
  • Security records: a log of security-relevant events such as sign-ins, failed sign-in attempts, password changes and Instagram connections, including the time, the account involved and the IP address the request came from.
  • Account sharing: if you share an Instagram account with another Metricatik user, or are invited to one, the email address the invitation was sent to, the permissions granted, and which user prepared each publication.

Instagram data

When you connect an Instagram professional account using Instagram's own login and permission screen, Metricatik receives, through the official Instagram API, only what the permissions you approve allow:

  • Profile information: your Instagram user ID, username, display name, profile picture, and follower, following and post counts.
  • Media: your posts, Reels, carousels and stories — their IDs, captions, media type, publish time, permalink, thumbnail and media URLs, and like and comment counts.
  • Insights: account- and post-level metrics such as reach, views, likes, comments, saves, shares, interactions, profile activity and follower growth, and the audience breakdowns Instagram provides for them.
  • Access tokens: the access token Instagram issues when you connect, along with the permissions it was granted and its expiry date.
  • Content you publish: if you use Metricatik to publish to Instagram, the captions, settings, schedule, and images or videos you upload for that purpose.
  • Facebook Page link: if you also continue through Facebook Login so that Metricatik can like comments for you, the Facebook Page linked to your Instagram account (its ID and name), the permissions Facebook granted, and an access token for that Page.

Metricatik does not receive or store your Instagram password. It does not collect data about Instagram accounts you have not connected, other than public follower-count history for your own connected account as described in section 4.

Technical information

Our servers record standard technical information needed to operate and secure the service, such as IP addresses, request times and error details. Metricatik uses cookies only to keep you signed in, to remember the language you chose and to protect against cross-site request forgery; it does not use advertising or third-party tracking cookies. If you install Metricatik on your phone, the application keeps a copy of its own program files on the device so that it opens quickly; none of your data is stored there.

2. How we use information

  • Account connection: to link your Instagram professional account to your Metricatik account, keep the connection working by refreshing its access token before it expires, and tell you when it needs to be reconnected.
  • Analytics and insights: to collect your media and insights on a schedule, record how each post's metrics grow over time, and show you dashboards, trends, comparisons between posts and exports of your own data. Instagram only keeps some insights for a limited period, so keeping this history is the core of what Metricatik does.
  • Comments and replies: to show you the comments on your posts and to send replies you write in Metricatik to Instagram on your behalf.
  • Liking comments: to like or unlike a comment on your posts when you ask, through the Facebook Page linked to your Instagram account.
  • Account sharing: to let the people you share an Instagram account with do what you allowed, acting as that account.
  • Publishing: to publish or schedule the content you prepare in Metricatik to your Instagram account, only when you ask it to.
  • Account and security: to sign you in, verify your mobile number, reset your password, detect and prevent abuse, and investigate problems.

We do not sell your information, use it for advertising, or use it to build profiles of you or of the people who interact with your content.

3. Comments and replies

Comments and replies are retrieved live from Instagram each time you open them in Metricatik and are not stored in our database. A reply you write is sent directly to Instagram and is not kept by Metricatik afterwards. The comment-related information stored is the comment count Instagram reports for each post, as part of its metrics, and two things you create yourself: the saved replies you write, and the commenters you star as special contacts — kept as their Instagram user id and last known username, per connected account, until you remove the star or disconnect the account. Metricatik also keeps, per post, the IDs of comments you like from Metricatik, so they still show as liked when you return; the comments themselves are not stored.

Direct messages are handled the same way: the conversations of an account you connected are retrieved live from Instagram when you open them — by you, or by someone you shared the account with and allowed to read its messages — and neither the messages nor who sent them are stored in our database or written to our logs. A reply you write is sent directly to Instagram as the account and is not kept by Metricatik afterwards.

Notifications are the one exception to the two paragraphs above. When they are switched on, Instagram tells Metricatik as it happens when someone comments on a connected account's posts, writes to it, mentions it in their story, replies to its story or reacts to a message, so that the Notifications page can list it. For a comment, Metricatik stores its ID, the commenter's Instagram user ID and username, the post's ID and the comment's text. For anything that arrives as a direct message, it stores only the message's ID and the sender's Instagram-scoped ID — never the message itself; the sender's username is looked up when the page is shown and is not stored. Notifications are shown only to the account's owner and to people it is shared with who may view its comments or messages, and are kept with the account's other data until you ask for it to be deleted.

4. How information is shared

We share information only as needed to provide the service:

  • Meta and Instagram: Metricatik communicates with the Instagram API to read your data and to carry out actions you request, such as replying to a comment or publishing a post. Media you publish is made available to Instagram so it can be posted. Meta's handling of that information is governed by Meta's own policies.
  • Facebook: if you continue through Facebook Login, Metricatik uses Facebook's API to find the Page linked to your Instagram account and to like comments you ask it to.
  • People you share an account with: if you share an Instagram account with other Metricatik users, they can see and do what you allowed — for example view its posts, comments or direct messages, reply or publish — and what they publish or reply with is posted as that account.
  • Infrastructure providers: the hosting and database services on which Metricatik runs store and process data on our behalf; a text-message provider (IranPayamak) delivers our verification codes to your mobile number; and an email delivery service sends notices such as a password change or an invitation to a shared account.
  • Google: if you choose to sign in with Google, Google authenticates you. Metricatik's pages load no fonts, scripts or other content from Google or any other third party; everything they show is served from Metricatik's own servers.
  • Follower history: when an account is first connected, Metricatik may look up its public follower-count history from NotJustAnalytics (notjustanalytics.com) to fill in growth from before you joined. Only your public Instagram username and numeric ID are sent; no tokens, insights or personal details are.
  • Legal requirements: we may disclose information if required by law or to protect the security of Metricatik and its users.

5. How we protect access tokens and sensitive information

  • Instagram access tokens are encrypted before they are stored, are used only on our servers, are never sent to your browser and are never written to logs.
  • Facebook Page access tokens are protected the same way and are used only to like comments.
  • Passwords are stored only as salted hashes. Application secrets are kept in encrypted configuration, not in the website.
  • Every page and API request is checked against your account, so you can see and act on only the Instagram accounts connected to your own Metricatik account.
  • The site is served over HTTPS, sign-in attempts are rate-limited and repeated failures lock the account temporarily, and security-relevant events are logged.
  • Profile pictures and post thumbnails are copied to our servers so your browser loads them from Metricatik rather than directly from Instagram.

No system is perfectly secure, but we work to protect your information and will act promptly if we become aware of a problem affecting it.

6. How long we keep information

  • Access tokens are deleted as soon as you disconnect an Instagram account.
  • The Facebook Page link and its token are deleted when you disconnect the Instagram account.
  • Shares and invitations are deleted when they are declined, withdrawn, removed or left; the security log keeps a record that they existed.
  • Instagram data (profile, media, metrics and history) is kept for as long as your Metricatik account exists, so that your history remains available if you reconnect. It is deleted when you ask us to delete it or to delete your account.
  • Files uploaded for publishing are deleted automatically a few days after the publication has finished.
  • Account details are kept until your Metricatik account is deleted.
  • Security records and server logs may be kept for a limited period after deletion where needed for security, fraud prevention or legal obligations, as described on the data deletion page.

7. Disconnecting Instagram and deleting your data

You can disconnect an Instagram account at any time from the Accounts page in Metricatik. Disconnecting stops all data collection for that account and deletes its access token immediately. You can also remove Metricatik's access from within Instagram, in your account's settings for apps and websites.

To delete your Metricatik account and the Instagram data stored for it, follow the User Data Deletion Instructions.

8. Your choices and rights

You may ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by writing to the address in section 11 with the mobile number of your Metricatik account (or, for an account made with Google, its email address); we confirm the request through that number or address before acting on it. Depending on where you live, you may have additional rights under local law, and we will honour them as required.

9. Children

Metricatik is not directed at children and is not intended for anyone under the age required to hold an Instagram account. We do not knowingly collect information from children.

10. Changes to this policy

If we change this policy, we will update it on this page and change the "Last updated" date above. Continuing to use Metricatik after a change means you accept the updated policy.

11. Contact

Questions about this policy or your data can be sent to masoudkianimusic@gmail.com.

12. Language

This policy is published in English and Persian. If the two versions differ, the English version prevails.

See also the Terms of Service and the User Data Deletion Instructions.