What Keryx is. Keryx is a private tool operated by a single person to reply to comments on their own Instagram posts and continue those conversations in Instagram Direct. It is not a public service, it has no user accounts, and nobody can sign up for it.
The operator of Keryx is the data controller for the information described here. For any question about this policy, or to exercise any of the rights set out below, contact:
Keryx does not ask you for information directly. It receives information from Instagram when you choose to interact with the operator's Instagram account — by commenting on a post, or by sending or replying to a direct message.
| Information | Where it comes from | Why |
|---|---|---|
| An Instagram-scoped user ID | Instagram, when you comment or message | To reply to the right person. This ID is specific to this app and cannot be used to identify you on any other service. |
| Your Instagram username | So the operator can recognise the conversation. | |
| The text of the comment you wrote | To decide which automated reply applies. | |
| The messages exchanged in the conversation | Instagram Direct | To continue the conversation and keep a record of what was sent. |
| Whether you follow the account | Instagram delivers messages differently to non-followers; this is used only to understand delivery. | |
| That a link was clicked, with the time, browser user-agent and referring page | Your browser, if you tap a link sent to you | To measure whether the link was useful. |
| A one-way hash of your IP address | Your browser, if you tap a link | To distinguish repeat clicks. The IP address itself is never stored. |
Under the UK and EU General Data Protection Regulation, the processing above rests on the operator's legitimate interest in answering people who contact their Instagram account, and on your own decision to start the conversation. Every conversation Keryx takes part in is one you began — by commenting, or by messaging first. Keryx never sends an unsolicited message.
Replies may be sent automatically. Where an AI assistant is enabled, the text of your messages in that conversation is sent to Anthropic in order to generate a reply, and the reply is stored alongside the conversation. When an automated assistant is active you are told so in the first message.
You can always ask to speak to a human, and the operator can take over the conversation at any point. No automated decision is made about you that has any legal or similarly significant effect.
Keryx uses a small number of service providers, acting on the operator's instructions:
| Provider | Role | Where |
|---|---|---|
| Meta Platforms | Instagram itself — the source of comments and messages, and the channel replies are sent through | Per Meta's own policy |
| Neon | Hosts the database holding conversations | Frankfurt, EU |
| Inngest | Queues and retries the background jobs that send replies; event payloads pass through it | EU / US |
| Anthropic | Generates AI replies, only when the AI assistant is enabled | US |
| Cloudflare / Vercel | Serve this page and the link-redirect endpoint | Global edge network |
Information is never sold, never shared for advertising, and never given to anyone else except where the law requires it.
Conversation records are kept while they remain useful for answering you and for understanding whether the automated replies work — and no longer than 24 months from the last message in the conversation, after which they are deleted. Click records are kept for 12 months. Anything you ask to have deleted is deleted sooner, as described below.
You can ask the operator to:
Email panospaglos6772@gmail.com and you will get a reply within 30 days. There is no charge. See Data Deletion for the quickest route to erasure.
If you are in the EU or UK and you are unhappy with the response, you may complain to your national data protection authority. In Greece this is the Hellenic Data Protection Authority (dpa.gr).
Access tokens are encrypted at rest. All traffic is over HTTPS. Requests from Instagram are cryptographically verified before being processed, so forged requests are rejected. The operator's dashboard is password-protected and is not publicly reachable. IP addresses are hashed, never stored in the clear.
Keryx is not directed at children. Instagram requires its users to be at least 13 years old, and Keryx only ever receives information about people who chose to interact with an Instagram account.
If this policy changes, the date at the top of this page changes with it.