ChamTracker Privacy Policy

Last updated: 3 August 2026

ChamTracker is a sales-analytics tool for teams who manage Instagram direct messages on behalf of a business. This policy explains what we collect, why, and how it is deleted. It covers two groups of people: the businesses who connect their Instagram account, and the people who message those businesses.

Who we are

ChamTracker is operated by Aidan Cham (United Kingdom). For any privacy question or request, contact aidanryancham@gmail.com. We aim to respond within 30 days.

What we collect

When a business connects its Instagram professional account, Instagram asks that business to grant ChamTracker permission to read its direct messages. Only after that permission is given do we receive:

• The content and timestamps of direct messages sent to and from the connected business account, including message text and indicators for attachments such as photos or voice notes.
• The Instagram user ID and username of each person in those conversations, and read receipts and reactions on those messages.
• Basic details of the connected account (its Instagram ID, username and account type) and an access token, which is stored encrypted.
• Account details of the ChamTracker user (email address, time zone) and basic usage statistics for their own dashboard.

We only receive messages sent after an account is connected. We do not collect anything from accounts that have not been connected, and we do not collect payment details.

Why we use it

Message data is used for one purpose: to produce sales statistics and a follow-up worklist for the business whose inbox it is. That includes counting outbound messages, replies, follow-ups and bookings, and categorising conversations so the business can see which leads need attention.

We do not sell or license data, we do not use it for advertising, we do not build profiles of the people being messaged for any purpose beyond serving the business whose conversations they are, and we do not combine data across unrelated businesses.

Automated analysis

To categorise conversations, message text is sent to Anthropic's Claude API, which acts as a service provider processing the data on our instruction only. Before text is sent, we mask email addresses, phone numbers and long digit strings. This analysis produces summary categories; it does not make decisions about individuals.

Who processes data on our behalf

• Supabase — database hosting (servers in Frankfurt, Germany).
• Vercel — application hosting.
• Anthropic — conversation categorisation, as above.
• Meta Platforms — the source of the message data, under the permission granted by the connected business.

How long we keep it

Raw message text is deleted after 90 days. The resulting statistics (counts and dates, with no message content) are kept while the account is active so historical trends remain available. Raw webhook records are deleted after 90 days. If a connection is removed or an account is closed, its data is deleted.

Your rights

If you are in the UK or EU you have the right to access, correct, export, restrict or delete your personal data, and to complain to a supervisory authority (in the UK, the Information Commissioner's Office).

If you messaged a business and want your data removed, email aidanryancham@gmail.com with the Instagram username you messaged from. We will delete your messages from our systems and suppress future collection for that username. You do not need a ChamTracker account to make this request.

A business can disconnect its Instagram account at any time, from ChamTracker or from Instagram's own settings under Apps and Websites. Disconnecting stops all further collection immediately.

Security

Access tokens are encrypted before storage. Data is separated per account by database-level access rules, and all traffic is encrypted in transit. No system is perfectly secure, but we limit what we collect and how long we keep it.

Changes

If this policy changes materially we will update the date above and notify account holders by email.