Privacy Policy

Last updated 27 October 2026

This notice explains how personal information is handled by Fitonomy Replies (also called OpenReply), the tool Fitonomy uses to answer comments and direct messages on its own Instagram accounts, such as @fitonomyapp, @fitonomy.coach and @gym.advice.

Fitonomy LLC, a company registered in Kosovo, is the controller responsible for this processing. Contact support@fitonomyapp.com about privacy or your information.

The Fitonomy app and fitonomyapp.com have their own Privacy Policy. Instagram is operated by Meta, which handles your information under Meta's Privacy Policy.

What Fitonomy Replies does

When you comment on a post or reel from one of our Instagram accounts, or send one of them a direct message, Instagram notifies us through Meta's official APIs. If your comment or message contains a keyword we have set up, for example "PLAN", Fitonomy Replies can send you a direct message in reply. Sometimes it also posts a short public reply under your comment.

• Following Instagram's rules, we send at most one private message in response to a comment. We only send more if you reply to us, and only within 24 hours of your reply.
• We only message people who have commented on our posts or messaged our accounts first.
• We use only Meta's official APIs. We never ask for Instagram passwords, never scrape Instagram and never automate a browser.

Information we process

If you comment on or message our Instagram accounts

• Instagram identifiers: the Instagram-scoped ID that Instagram assigns you for our accounts, and your Instagram username.
• Your comments and messages to us: the text, the IDs Instagram gives them, when you sent them, which post or reel a comment was on, and any buttons or quick replies you tap.
• Our replies: what we sent and when, and whether Instagram accepted it. This includes any error code Instagram returns, for example when a message can't be delivered.
• Link clicks: our messages can contain short links that start with openreply.fitonomyapp.com/r/. When you open one, we record which message and campaign it came from, the time, your browser's user-agent string and the approximate country of your connection. Your IP address is used to send you on to the destination and to work out that country, and is not stored.

We don't request your Instagram profile information, such as your name, profile photo or followers, and we don't collect your email address or phone number through Fitonomy Replies.

If you are a Fitonomy team member using the tool

We process your work email address, sign-in records and a log of the changes you make in the tool.

Connected Instagram accounts

Only Fitonomy's own Instagram professional accounts are connected. For each one we store the access token Meta issues to our app, encrypted.

Why we process it

• To respond to you. Commenting a keyword or messaging us is a request, for example for a link. Sending you what you asked for relies on our legitimate interest, and yours, in answering it.
• To run the service reliably and within Instagram's rules. This covers preventing duplicate or unwanted messages, staying within Instagram's limits, and finding out why a message failed. It relies on our legitimate interests.
• To see how our posts and campaigns perform, in aggregate. For example, how many people asked for a link and how many opened it. This relies on our legitimate interests. We don't build advertising profiles of individuals.
• To meet legal obligations and handle your requests, including deletion requests.

We don't sell personal information, use it for third-party advertising, or make decisions about you that have legal or similarly significant effects.

Who we share it with

• Meta Platforms (Instagram) delivers our replies. Instagram receives everything we send to you.
• DigitalOcean hosts our servers, database and message queue, in New York, United States.
• Sentry receives technical error reports so we can fix problems. We configure it so that it doesn't receive the content of comments or messages.
• An email delivery provider sends sign-in links and internal alerts to our team. These emails don't contain your comments or messages.
• Authorities or professional advisers, where the law requires it or where needed to establish or defend legal claims.
• A buyer or successor, if Fitonomy is involved in a merger, acquisition or sale of assets.

International transfers

Your information is stored in the United States. Some of our providers, including Meta and Sentry, may also process it in other countries. These countries can have different data protection laws from yours. Where applicable law requires it, we rely on recognised safeguards, such as Standard Contractual Clauses or an adequacy decision.

How long we keep it

We delete information sooner when you ask us to (see Data deletion). Deleted information can remain in encrypted backups for up to 30 days until those backups expire. We may keep aggregated statistics that can't identify you for longer.

Your rights and choices

Depending on where you live, you can ask us for access to your information, and to correct, delete or export it. You can also ask us to restrict how we use it, or object to our use of it. California residents can ask what we have collected and ask us to delete it, and won't be treated differently for doing so. We don't sell or share personal information for cross-context behavioural advertising.

To make a request, email support@fitonomyapp.com and include your Instagram username. We'll reply within 30 days. Before acting on a request we may ask you to confirm that you control the Instagram account, for example by sending us a short code in an Instagram direct message.

Deleting a comment or message on Instagram doesn't delete our records of it. To have those deleted, follow the steps on our Data deletion page. If you don't want automated replies from us, contact us and we'll stop processing your messages.

You can also complain to a data protection authority. In Kosovo this is the Information and Privacy Agency. If you live elsewhere, for example in the EEA or Switzerland, you can contact the authority where you live.

Security

Information is encrypted in transit. Access tokens are also encrypted at rest. We check that every notification we receive genuinely comes from Meta. Only authorised Fitonomy team members can use the tool, after signing in, and their changes are logged. No system is perfectly secure, but we work to protect your information and to limit what we keep.

Children

Instagram requires users to be at least 13, and our accounts are not directed at children. We can't see the age of people who comment, but Instagram limits who can message teenagers, and we don't try to get around those limits. If you believe we hold information about a child, contact us and we'll delete it.

Changes to this notice

If we change this notice, we'll post the new version here and update the date at the top.

Contact