Privacy Policy

Kollage keeps as little as it can. Your projects, photos and videos stay on your device. We never see them unless you publish, and then only for as long as Instagram needs to fetch them. We do not sell data, we do not run advertising, and there are no third-party analytics or tracking SDKs in the app.

Kollage is made by AR Web & Development LLC (“we”, “us”), a New Jersey limited liability company. For anything in this policy, including a deletion request, write to [email protected].

• Your projects. Layouts, text, and the photos and videos you add are stored on the device and are not uploaded to us.
• Your own AI key, if you add one. It is held in the device keychain and sent only to the provider it belongs to (OpenAI, Anthropic or Google). It never reaches our servers, and we could not read it if we wanted to.
• Captions written on-device. When your phone supports it, captions are generated locally and the request never leaves it.

• An anonymous device account. Kollage creates an identifier for your device so your Instagram connection can be tied to something. It is not linked to your name, email or phone number, and we do not ask you to create an account.
• Your Instagram connection. If you connect Instagram, we store the access token Instagram issues us, your Instagram user ID and your handle. The token is encrypted at restand is never sent to your device or to anyone else. It is used only to publish what you ask us to publish, and to read that post’s performance.
• Posts you publish or schedule. The rendered image, the caption, the first comment and the scheduled time. Instagram must fetch the image from a public address while it builds the post, so during publishing that image is reachable by anyone holding its unguessable link. As soon as publishing completes, it becomes readable only by you.
• A push token, if you allow notifications, so we can tell you a scheduled post went out or failed. Notifications go from our servers directly to Apple; no third-party push service is involved.

No advertising identifiers. No location. No contacts. No third-party analytics, attribution or tracking SDKs. No behavioural profiling. We do not sell or share personal information, and we have no interest in doing so.

• Meta (Instagram).When you connect an account and publish, we send Instagram what is needed to create the post. Their handling is governed by Meta’s own privacy policy.
• Apple.Push notifications are delivered through Apple’s Push Notification service.
• Your AI provider, only if you add your own key. Captions you request are sent directly from your device to that provider, billed to your account, under their terms. If you do not add a key, no AI provider is involved at all.

Your data is stored on servers we operate in the United States, and is not passed to any other company for storage or processing.

• Published post records — the image, caption and performance — are kept as your history until you delete them. Stored images are released after six months; the record of the post remains.
• Scheduled posts are deleted once published or cancelled.
• Your Instagram connection is kept until you disconnect it or delete your data.

You can delete everything from inside the app: Settings → Delete my data. Disconnecting Instagram alone removes the connection and its token.

When you delete, your data is removed from our live systems immediately, including the Instagram access token, so we can no longer act on your account. To remove Kollage from Instagram’s side as well, use Settings → Apps and websites in Instagram.

Backups are the honest exception. Our servers are backed up in encrypted form so we can recover from hardware failure. A deleted account can persist in those backups for up to 30 days, after which every backup containing it has been destroyed. We do not use backups to bring deleted accounts back: if we ever restore from one, deleted accounts are removed again as part of that restore. Nobody reads a backup in the ordinary course of business — they exist only for disaster recovery.

Depending on where you live, you may have rights to access, correct, export or delete your personal information, and to object to how it is used. Kollage is built so that deletion is available to everyone without asking us. For anything else, write to [email protected] and we will respond within 30 days.

Kollage is not directed at children under 13, and we do not knowingly collect their information. Instagram itself requires users to be 13 or older.

Instagram tokens are encrypted at rest. All traffic between the app and our servers uses HTTPS. Your own AI keys never leave your device except to the provider they belong to. No system is perfectly secure, but we have deliberately designed Kollage to hold as little of your data as the features allow.

If we change this policy we will update the date above, and for anything that materially affects what we collect or how long we keep it, we will say so in the app.