Sanctum — Privacy policy

Last updated: 2026-05-30

What we collect

When you connect your Instagram Professional account, Sanctum receives, via Meta's official Instagram Graph API:

• Your Instagram user ID and username.
• A long-lived access token (stored encrypted at rest).
• For each new comment posted on your media, delivered via Meta webhooks: the comment identifier, the comment text, the commenter's Instagram username, the post identifier, and the timestamp.

If you opt in to the weekly digest, we also collect:

• The email address you provide for digests.
• Your protection-mode choice (Zen, Guard, or Shield).

What we do with it

• Each new comment is sent to OpenAI for classification and content-moderation scoring so we can decide whether it crosses our hide-thresholds.
• If the classifier returns a high-confidence harmful result, Sanctum calls Meta's API to hide (never delete) that comment.
• For every hidden comment we persist: identifier, category, confidence score, the comment text, the commenter's username, the timestamp it was hidden, and (if you restore it) the timestamp it was restored.
• You can audit Sanctum's decisions at any time via a friction-gated audit flow that requires per-comment opt-in to reveal the text.

Subprocessors

• OpenAI — comment text is transmitted for AI classification and content-moderation scoring. OpenAI states it does not retain API inputs to train its models by default.
• Postmark — sends the weekly digest email if you have opted in. Receives your email address and abstracted summary counts (never the comment text).
• Cloudflare — serves the public site and routes inbound contact email.
• Meta (Instagram Graph API) — the platform we moderate; comment data flows to and from Meta by the nature of the service.

Retention

• Comment text and commenter username: retained for 60 days from the moment Sanctum hides the comment, then purged. This is the window in which you can audit and restore.
• Hide metadata (comment identifier, category, confidence, timestamps, restored-or-not): retained while your account is connected. This is what powers the dashboard counts and is durable beyond the 60-day text window.
• Classification index (the identifier and timestamp of every comment Sanctum has classified, with no text and no username): retained while your account is connected, so the same comment is never classified — or charged for — twice.
• Restore signals and threshold adjustments (used for per-account adaptive moderation, suggested only after your explicit consent): retained while your account is connected.
• Backups: any deletion takes effect across backups within 30 days.

Adaptive moderation

If you frequently restore comments in a given category, Sanctum may suggest easing the threshold for that category on your account. Suggestions are never silent — you must explicitly accept them before any change takes effect, and the adjustment can only ever raise a threshold (Sanctum hides less for you, never more).

Your rights

• Open the audit log at any time, reveal individual hidden comments, restore any you disagree with.
• Change your protection mode whenever you want.
• Opt out of the weekly digest from Settings.
• Request full data deletion from Settings or by emailing us — see the Data deletion page.

Children

This service is not directed at people under 18.

Contact

Bartosz Kobylinski · [email protected]