Sanctum — Privacy policy

Last updated: 2026-07-25

What we collect

When you connect your Instagram Professional account, Sanctum receives, via Meta's official Instagram Graph API:

• Your Instagram user ID and username.
• A long-lived access token (stored encrypted at rest).
• For each new comment posted on your media, delivered via Meta webhooks: the comment identifier, the comment text, the commenter's Instagram username, the post identifier, and the timestamp.

If you opt in to the weekly digest, we also collect:

• The email address you provide for digests.
• Your protection-mode choice (Zen, Guard, or Shield).

What we do with it

• Each new comment is sent to OpenAI for classification and content-moderation scoring so we can decide whether it crosses our hide-thresholds.
• If the classifier returns a high-confidence harmful result, Sanctum calls Meta's API to hide (never delete) that comment.
• For every hidden comment we persist: identifier, category, confidence score, the comment text, the commenter's username, the timestamp it was hidden, and (if you restore it) the timestamp it was restored.
• You can audit Sanctum's decisions at any time via a friction-gated audit flow that requires per-comment opt-in to reveal the text.

Subprocessors

• OpenAI — comment text is transmitted for AI classification and content-moderation scoring. OpenAI states it does not retain API inputs to train its models by default.
• Postmark — sends the weekly digest email if you have opted in. Receives your email address and abstracted summary counts (never the comment text).
• Cloudflare — serves the public site and routes inbound contact email.
• Meta (Instagram Graph API) — the platform we moderate; comment data flows to and from Meta by the nature of the service.

Retention

• Comment text and commenter username: retained for 60 days from the moment Sanctum hides the comment, then purged. This is the window in which you can audit and restore.
• Hide metadata (comment identifier, category, confidence, timestamps, restored-or-not): retained while your account is connected. This is what powers the dashboard counts and is durable beyond the 60-day text window.
• Classification index (the identifier and timestamp of every comment Sanctum has classified, with no text and no username): retained while your account is connected, so the same comment is never classified — or charged for — twice.
• Restore signals and threshold adjustments (used for per-account adaptive moderation, suggested only after your explicit consent): retained while your account is connected.
• Backups: any deletion takes effect across backups within 30 days.

Adaptive moderation

If you frequently restore comments in a given category, Sanctum may suggest easing the threshold for that category on your account. Suggestions are never silent — you must explicitly accept them before any change takes effect, and the adjustment can only ever raise a threshold (Sanctum hides less for you, never more).

Your rights

• Open the audit log at any time, reveal individual hidden comments, restore any you disagree with.
• Change your protection mode whenever you want.
• Opt out of the weekly digest from Settings.
• Request full data deletion from Settings or by emailing us — see the Data deletion page.

Waitlist

If you left your email address on the waitlist at getsanctum.app, that address is all we store — no name, no IP address, no tracking, and it is not linked to any Instagram account. It is used for exactly one message, telling you when Sanctum opens to new accounts, and is deleted once you have an account or on request. Email us to be removed at any time.

Children

This service is not directed at people under 18.

Contact

Bartosz Kobylinski · [email protected]