Privacy Policy

Who we are

InHooked is a platform where creators build a professional profile and brands hire them. It is operated by InHooked, a sole proprietorship registered in India.

If you have any question about your data, email us at privacy@inhooked.com. We answer every message about privacy. Our registration and postal details are available on request.

What we collect

When you create an account

Your email address, and whether you have verified it. We never store your password itself — our login provider keeps only a scrambled version of it that cannot be turned back into the original, and nobody at InHooked can read it. When you choose a password we check it against a public list of passwords known to have leaked elsewhere, in a way that never sends your actual password anywhere.

What you put on your profile

If you are a creator: your name, username, bio, profile photo, location, topics, languages, skills, rates, work samples, past campaigns and certificates. If you are a brand: your company name, logo, website, industry and location. All of it exactly as you type or upload it.

If you connect Instagram

See the Instagram section below. Connecting is optional and you can disconnect at any time.

Security records

When you sign in, sign out, or change something about your account — signing up, resetting your password, verifying your email, choosing your account type, or connecting or disconnecting Instagram — we record your IP address and which browser and device you used. We keep these records to detect abuse and to investigate anything that goes wrong with an account. They are not used for advertising and are never shown to anyone else.

Technical information

When something goes wrong we receive an error report that can include your browser, device type and the page you were on. We use a cookie to keep you signed in. We do not use advertising trackers.

What is public and what is not

This matters more than anything else on this page, so we want to be plain about it.

• Your published profile is public. Once you press Publish, your profile page can be viewed by anyone on the internet and can show up in Google search results.
• Text you have not published stays private. Changes you make are visible only to you until you publish them.
• Photos are the exception, and you should know this. An image is stored at a web address as soon as you upload it, even before you publish. That address is long and effectively impossible to guess, and we never share it — but anyone who had it could open the image. If a photo is sensitive, do not upload it.
• Your email address is never shown publicly.

Instagram

Connecting Instagram is entirely optional. If you connect it, we read the following from your professional Instagram account — and here is what each one is for:

• Your account identifier, and one for each post — to know which Instagram account is yours. It is also how Instagram tells us which account to remove when you disconnect.
• Your handle, display name, biography and profile picture — to show the verified Instagram account behind your profile, so a brand knows it is really you.
• Your follower count, following count and post count — to show brands your real audience size instead of a number you typed in yourself.
• Your reach — to show how many people actually see your posts.
• How many times your posts were saved and shared over the last 28 days — to show a brand that people keep and pass on what you make, not just scroll past it.
• Aggregated audience information — age bands, gender split, top cities and top countries, to help a brand judge whether your audience fits their campaign. Instagram only gives us this last item once an account passes 100 followers. You can still connect below that — you simply will not see the audience breakdown until then. We never see who your individual followers are.
• How many followers you gained and lost over the last 30 days, and how many new followers you got each day — to show you how your audience is growing. Only you ever see these.
• Your most recent 12 posts — caption, type, thumbnail image, link, date, like count and comment count, to show examples of your work and to work out your engagement figure.
• For each of those 12 posts — whether it is a Reel or a regular post, how many people it reached, how many saved it and shared it, and for Reels, how long people watched on average. Only you ever see these.

We also work out an engagement figure from your recent posts. When Instagram tells us how many people saw them, it is the likes, comments, saves and shares they got for every 100 people reached. When it doesn't, we estimate it from likes and comments against your follower count and label it as an estimate. Either way it is our own calculation, not a number Instagram gives us.

What appears on your public profile

Once you publish your profile, some of this becomes public: your handle, follower count, post count, our engagement figure — labelled as an estimate when it is one — your reach, your saves and shares from the last 28 days, a summary of your audience (top age band, gender split, top city and top country) and up to six recent posts. Your following count, your detailed audience figures, your follower growth, your best post and the numbers for each individual post stay private to you.

How we store it

We copy your post thumbnails into our own storage, because Instagram's image links expire after a short time. The secure key that lets us read your account is stored encrypted, is never shown to you or anyone else, appears in nothing our app sends back to a browser, and is only ever sent to Instagram itself.

Each time we refresh your stats we replace the previous snapshot — we do not keep a history of how your numbers changed over time. Follower growth is the one figure that covers a period: Instagram gives us its last 30 days, and every update replaces the copy we had, so we never hold anything older than what Instagram last sent us. If your connection expires, the last numbers we received stay until it is renewed or you disconnect.

We never post to your Instagram account, never read your direct messages, and never contact your followers.

How to delete your Instagram data

There are three ways, and all of them delete the same thing:

• Tap Disconnect Instagram in the app. This removes your stats, your audience information and the stored thumbnails.
• Remove InHooked from your Instagram settings. Instagram tells us, and we delete the same data automatically.
• Send a data deletion request. You will get a confirmation code you can check at inhooked.com/instagram/data-deletion.

Your InHooked profile itself is unaffected — only the Instagram information is removed.

YouTube

Connecting YouTube is entirely optional, and it is separate from Instagram — connecting one does nothing to the other. InHooked uses the YouTube API Services. If you connect your channel, we read the following and nothing else:

• Your channel name, handle and picture — to show which channel is yours.
• Your subscriber count, video count and total views. YouTube rounds subscriber counts for everyone, including us, so the number we show is your real count or a little lower. If you have hidden your subscriber count on YouTube, YouTube does not tell us either, and we show everything except that.
• Views, likes, comments, shares and playlist adds from the last 28 days — the numbers a brand looks at.
• Subscribers gained and lost, per day, for the last 30 days — this is what draws the small growth line. We keep a rolling 30 days and nothing older.
• Who watches you — age ranges, the split between women and men, and countries. This is grouped information about your audience as a whole. YouTube never tells us who an individual viewer is, and we never ask.
• Your last 12 videos — title, publish date, views, likes, comments, how much of each video people watch on average, how many times each was shared, and how many subscribers each one brought you.

The engagement percentage we show is our own calculation from your likes, comments and shares. It is not a number YouTube gives out, and we always label it as an estimate.

We never post to your channel, never change anything on it, never read your comments or messages, and never see your earnings. Video thumbnails on your page are loaded straight from YouTube — we do not copy them onto our servers. Your sign-in with Google is stored encrypted, is never shown to anyone, and is only ever sent back to Google.

How to delete your YouTube data

• Tap Disconnect on your YouTube card in the app. This deletes your channel information, your numbers, your stored video list and your saved sign-in straight away — not later, and not in a queue.
• Remove InHooked from your Google account at your Google security settings. Your numbers stop updating straight away, and they stay on your public page until the connection runs out. If it is not renewed within 30 days, we take them off your public page and delete them — we warn you in the app a week before that happens, and reconnecting at any point brings everything back.
• Do nothing. YouTube requires us to re-check your permission at least every 30 days. If your connection is not renewed within 30 days, we take your YouTube numbers off your public page and delete them. We warn you in the app a week before that happens, and reconnecting brings everything back.

Your InHooked profile itself is unaffected — only the YouTube information is removed.

By connecting YouTube you are also agreeing to the YouTube Terms of Service, and Google's own handling of your information is described in the Google Privacy Policy.

Who else touches your data

We do not sell your data, ever. We do not share it with advertisers. We use a small number of service providers to run the product:

• Supabase — our database, file storage and login, hosted in Mumbai, India
• Vercel and Google Cloud — the servers that run the website and API
• Resend — sends your verification and password reset emails
• Have I Been Pwned — checks whether a password you choose has appeared in a known leak, without ever receiving the password itself
• Sentry — tells us when the app breaks
• Meta (Instagram) — only if you choose to connect your account
• Cloudflare — provides DNS for our domain

Your database and files are stored in India. Some of these providers operate outside India, so your information may be processed abroad. We may also disclose information where the law requires it.

How long we keep it

We keep your profile and account information for as long as your account exists. Security records are kept while they remain useful for investigating abuse. Instagram information is removed as soon as you disconnect. Copies of data can survive in our backups for a period after deletion before those backups are replaced.

Your rights

You can see and edit almost everything we hold about you from inside the app, and you can delete your photos, work samples, campaigns and certificates yourself at any time.

To get a copy of all your data, correct it, or close your account and have it erased, email privacy@inhooked.com. We handle these by hand today, and we will respond within 30 days.

InHooked is built for India and we follow Indian data protection law. If you are in the UK or the European Union you also have rights under the GDPR — including access, correction, erasure and objecting to how we use your information. We rely on your consent, and on the agreement between us to provide the service, as our basis for using it. Write to the same address and we will honour those rights.

Age

You must be at least 18 years old to create an InHooked account. If we learn that an account belongs to someone younger, we will remove it.

Security

Your information is encrypted while it travels between your device and us, and the keys that let us read a connected account are encrypted where they are stored. Access to our live systems is limited to the people who operate InHooked. No system is perfectly secure, but we take this seriously and fix problems quickly.

Changes to this policy

If we change this policy we will update the date at the top of this page. If the change is significant we will tell you in the app.