CommentCratePrivacy Policy
Summary
CommentCrate runs in your browser. It never sends comments, page content, or anything from Instagram to any server run by us or anyone else. The only network requests are the license check (Pro) and the offer banner (free plan), both described below.
What the extension does with data
- While you browse instagram.com, a small listener in the page keeps copies of the comment-related data that Instagram's own page loads, in the memory of that tab only (a few megabytes at most). It never stores or sends them, and they are gone when you close or reload the tab.
- On post and reel pages the extension shows a small handle that opens the comments panel. The panel shows the comments you captured, including the commenters' profile pictures, which your browser loads straight from Instagram's servers, exactly as Instagram's own page does. CommentCrate does not receive, copy or store those pictures; they are not part of any export.
- When you press Scan comments on an Instagram post you have open, the extension reads the comments shown on that page and the data the page itself loads, and keeps them in the memory of that tab.
- When you press an export button, it builds a CSV, XLSX or JSON file in your browser and saves it to your computer. Closing or reloading the tab, or pressing Clear, discards the captured comments.
What is stored
In the extension's local browser storage only: your language choice (English, Turkish, Spanish or French); the offer last shown (kept for one hour) and whether you closed it; and, with a Pro license, your license key, a random device ID and the signed token. Nothing else is stored, and nothing is synced.
Permissions
- Access to instagram.com — to read the comments on posts you open and to scroll and expand the comment panel.
- Access to api.commentcrate.com — to check your Pro license (Pro) and to fetch the current offer (free plan).
- storage — to remember your language choice, your license and whether you closed the offer.
- scripting — to start the extension on an Instagram tab that was already open when it was installed.
Offers (free plan)
While you are on the free plan, opening the extension asks api.commentcrate.com whether there is a current offer, at most once an hour, so it can show a banner that you can close. This is a plain GET request: it contains no license key, device ID, account, cookie, or any data from your browser or from Instagram, and the answer is the same for everyone. Closing the banner is remembered only on your device. Pro users are not asked.
Pro license check
With a Pro license, the extension contacts our license service at api.commentcrate.com to activate your key and renew it regularly (at least once a week). The request carries your license key and a random device ID created on your computer (not a hardware fingerprint). Our service stores your email address (received from our payment provider), a one-way hash of your license key, and the device IDs registered to it (at most three per license). Our payment provider, Lemon Squeezy, acts as merchant of record and holds your payment details. Comments, page content and Instagram data are never sent. The service replies with a signed token that the extension checks on your device, so Pro keeps working for up to 14 days without a connection.
Analytics, advertising, cookies
The extension has no analytics, advertising, or tracking. This website sets no cookies and stores nothing in your browser. It only reads pricing.json to show current prices.
Comments you export
The exported comments are other people's content and can include personal data (usernames, text). They are saved on your device and you are responsible for how you store, use and share them, including compliance with applicable data-protection law (for example GDPR or KVKK) and Instagram's terms.
Children
CommentCrate is not directed at children.
Who is responsible
The data controller (in Turkish law, veri sorumlusu) is CommentCrate. Contact: support@commentcrate.com.
Why we process data (legal basis)
- Providing the license you bought and enforcing its device limit: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- Keeping the service secure and preventing abuse, for example limiting guesses of license keys: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- Accounting, tax and refund records: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
The extension processes comments only on your device. We do not receive them.
Who else handles data
Lemon Squeezy (payments, acting as merchant of record) and Cloudflare (hosting of this website and of the license service, including its database) handle data for their part of the service. They may process data in other countries; see their own privacy policies. We do not sell your data and do not share it for advertising.
How long we keep data
License records (email address, a one-way hash of the license key, device IDs) are kept while your license exists, and afterwards only as long as needed for refunds, accounting and tax duties or legal claims. Then they are deleted. You can ask us to delete them earlier, unless we must keep them by law.
Your rights
You can ask us for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on our legitimate interests. Residents of Türkiye also have the rights listed in KVKK Art. 11. To use a right, write to support@commentcrate.com from the email address you used at purchase and include your license key or order number so we can find your records. We answer within one month (30 days under KVKK). You may also complain to your data-protection authority (in Türkiye, the Personal Data Protection Board; in the EU, the supervisory authority of your country).
Contact
CommentCrate — support@commentcrate.com