Privacy policy

Effective 14 September 2026

toxoff ("toxoff", "we", "us") is an iPhone app that removes toxic and spam comments on your Instagram posts. This policy explains what information toxoff collects, why, who it is shared with, and how you can delete it.

Contact: support@toxoff.app

1. Information we collect

Your toxoff account

• Your name and email address, from sign-up or from Sign in with Google or Sign in with Apple. (Apple may give us a private relay email instead of your real one.)
• Your password, if you sign up with email. It is stored only in hashed form by our sign-in provider; we never see it.

Your connected Instagram account

• Your Instagram account ID and username.
• An access token from Instagram that lets toxoff read, hide and delete comments on your posts. It is kept on our servers and is never shown in the app.

Comments on your posts

• toxoff reads new comments on your recent Instagram posts so it can check them.
• For each comment it checks, we keep only the comment's ID, for up to 7 days, so the same comment is never checked twice.
• For comments toxoff hides or deletes, we keep the comment text, the commenter's username, why it was removed, and which post it was on, so you can review it in the app and restore hidden ones. You can erase the text and username of deleted comments from your log at any time, or have toxoff erase them automatically after 7 or 30 days.
• Comments that are not removed are not stored.

Your settings

• Your filter settings: sensitivity, categories, blocked keywords and blocked usernames.
• Your answers during setup (for example whether you are a creator or a business), what the app shows you of removed comments, and how you want to be notified.
• Whether you want push notifications, and your device's push notification token.

Your plan and usage

• Your plan (Free, Solo, Plus or Studio), trial dates, how many free comment checks you have used, and any extra checks earned from invites.
• Your invite codes and whether a friend used them.
• If you subscribe: your plan, billing period, renewal date and subscription status, as reported by Apple through RevenueCat. Payments are handled by Apple. We never receive your card or other payment details.

Technical data

• Short-lived counters used to limit how many comments are checked per minute (deleted within an hour), and technical error logs kept for a limited time to fix problems.

2. How we use it

We use this information only to run toxoff:

• to check comments on your posts and hide or delete the ones that match your filters;
• to show you removed comments and let you restore hidden ones;
• to send you a notification when a comment is removed, or a daily summary if you prefer (notifications do not include the comment's text);
• to manage your trial, plan, free checks, invites and subscription;
• to keep the service secure and prevent abuse of free checks and invites.

We do not sell your information, we do not show ads, and we do not use your information or your commenters' comments for any purpose other than moderating your own posts.

3. Who we share it with

We use these service providers, only for the purposes above:

• Supabase (database, sign-in and servers, hosted in Singapore).
• OpenAI, whose AI model scores comment text for harassment, hate, slurs, spam and self-harm in any language. Only the comment text is sent. Under OpenAI's API policies, this data is not used to train OpenAI's models.
• Meta (Instagram), to read, hide and delete comments on your posts through Instagram's official API.
• Apple and RevenueCat, to process and verify subscriptions.
• Expo, to deliver push notifications.
• Google and Apple, if you choose to sign in with them.

We may also disclose information if required by law.

4. How long we keep it

• Your account, settings and removed-comment history: until you delete your account.
• Comment IDs used to avoid double checks: up to 7 days.
• Your Instagram access token: until you disconnect the account in toxoff, remove toxoff in Instagram's settings, or delete your toxoff account.
• To prevent abuse of invites, we keep a one-way hash (a scrambled code that cannot be turned back into the ID) of each Instagram account ever connected, even after deletion. It is not linked to you once your account is deleted.

5. Your choices and rights

• Disconnect Instagram at any time in toxoff. toxoff stops reading your comments and deletes the access token.
• Remove toxoff from Instagram: Instagram > Settings > Apps and websites > toxoff > Remove.
• Ask us for a copy of your information, or to correct it.
• Delete your account and data: see how to delete your data, or email support@toxoff.app from your account's email address.

6. Children

toxoff is not intended for children under 13 (or the minimum age required in your country), and we do not knowingly collect their information.

7. Changes

If we change this policy, we will post the new version at this address with a new effective date, and tell you in the app if the changes are significant.

8. Contact

Questions or requests: support@toxoff.app