Harboreon

Privacy Policy

What this Instagram downloader stores, what it never asks for, which providers process a request, and how long records are kept.

Last updated: 2026-10-23

Summary

You do not need an account to use this tool, and we never ask for your Instagram login or password. Paste a public link, preview the video, save it — that is the whole product. This page explains exactly what is recorded along the way, because some of it is stored in a database.

What is stored, and why

  • The link you paste (its post identifier). When you resolve a link, the server stores a short-lived task record containing the post's shortcode, the resolved file locations, and the preview caption text. This record is what makes your download link work, keeps daily limits honest, and lets upstream costs be reconciled. Task records expire after a few hours and are deleted after roughly 30 days.
  • A salted hash of your IP address. To enforce the free daily limits (3 downloads and a small number of link checks per network per day, UTC), the server stores a cryptographic hash of your IP address — salted with a server-side secret, so the raw IP address is never stored. Daily counter rows are deleted after roughly 40 days. We do not use these hashes for profiling or advertising.
  • Upstream usage accounting. Aggregated, site-wide records of upstream resolver runs (run counts and costs) — these contain no personal data.
  • Standard request logs at the infrastructure level (as with any website hosted on Cloudflare).

What we do not do

  • No Instagram credentials: the tool works with public links only.
  • No account registration is required to download.
  • We do not sell the task records or IP hashes described above.
  • No advertising profiles built from your use of the tool.

Third parties involved in a download

Resolving a link and preparing the file involves third-party providers — this is not done "directly with Instagram only":

  • Cloudflare hosts this website and processes every HTTP request.
  • Apify (an automation platform) runs the resolver for each link. The pasted link is sent to Apify's official Instagram scraper, and the video file may be temporarily stored in Apify's storage (their retention for such files is limited — on the order of days — after which the links stop working). We do not maintain any Instagram login or cookies.
  • Files you save are streamed through our server to you and are not archived by us beyond the temporary upstream copy described above.

Optional site features

If you optionally create an account (not needed for downloading), standard account data such as your email address is stored by the platform's authentication system, and you may request deletion at any time via the contact page. Analytics, if enabled, measures aggregate usage only.

Optional advertising

We use Adsterra native banner advertising only after you choose Allow ads in the advertisement section. Adsterra and its advertising partners may receive your IP address, browser/device information, referring site and advertising identifiers, and may use cookies or similar technologies to deliver and measure ads. See Adsterra’s privacy policy.

Our downloader does not send your pasted Instagram URL, download task details or quota hashes to the advertising provider. Ads run in a separate sandboxed frame. Rejecting ads does not restrict downloads. You can withdraw consent through Ad privacy settings in the advertisement section; this removes the ad frame and stops further loading there. This does not erase data already received by the provider. Your choice is saved in our first-party cookie_consent cookie for up to one year. Browser settings can also clear cookies.

Changes

If this policy changes materially, the updated date above will change and the revision will be published on this page.

Contact

For privacy questions, write to the address on the Contact page.