Privacy Policy

Who we are

InHooked is a platform where creators build a professional profile and brands hire them. It is operated by InHooked, a sole proprietorship registered in India.

If you have any question about your data, email us at privacy@inhooked.com. We answer every message about privacy. Our registration and postal details are available on request.

What we collect

When you create an account

Your email address, and whether you have verified it. If you sign in with Google, also the name and profile picture on your Google account. We never store your password itself — our login provider keeps only a scrambled version of it that cannot be turned back into the original, and nobody at InHooked can read it. When you choose a password we check it against a public list of passwords known to have leaked elsewhere, in a way that never sends your actual password anywhere.

What you put on your profile

If you are a creator: your name, username, bio, profile photo, location, topics, languages, skills, rates, the work you pick or link, past campaigns and certificates. If you are a brand: your company name, logo, website, industry and location. All of it exactly as you type, upload or pick it.

Your work

When you pick one of your own Instagram posts, we save a copy of its picture on our servers, together with its caption, its Instagram ID and its link on Instagram. When you pick one of your own YouTube videos, we save its title, its video ID, its link and the address of its thumbnail — the picture itself stays on YouTube and is loaded from there. When you paste a YouTube link, we save the video's ID, its title, its channel name and the address of its thumbnail, which also stays on YouTube.

To check a link you paste, and to tell you when a video in your work is no longer available, our server asks YouTube about that one video — YouTube sees the request coming from us, not from you. When you tap Show older posts or Show older videos, we fetch that page from Instagram or YouTube to show you, and we do not keep it.

Captions and video titles are shown only to you. Your public page shows the pictures, and the channel name under a link you pasted.

If you connect Instagram

See the Instagram section below. Connecting is optional and you can disconnect at any time.

If you connect YouTube

See the YouTube section below. Connecting is optional, separate from Instagram, and you can disconnect at any time.

Security records

When you sign in, sign out, or change something about your account — signing up, resetting your password, verifying your email, choosing your account type, connecting or disconnecting Instagram or YouTube, or switching your Instagram or YouTube numbers on or off on your public page — we record what happened, when, and your IP address. We also keep a record when your YouTube data is deleted because your connection ran out, and when we remove a duplicate unverified account made with your email. We keep these records to detect abuse and to investigate anything that goes wrong with an account. They are not used for advertising and are never shown to anyone else.

Technical information

When something goes wrong we receive an error report, and for some page visits a report on how quickly the page loaded. These can include your browser, device type, the page you were on and your IP address. Our hosting providers also keep short-lived logs of the requests your browser makes, which include your IP address. We do not use advertising trackers.

When you check your work email (brands)

If you are a brand, you can prove you really work at your company by asking us to send a one-time code to an email address at your own website's domain. It is entirely optional, and nothing happens unless you ask for it.

• The address you choose — we send a 6-digit code to it. The code works for 10 minutes and can be used once.
• Once the code is right — we store that address, its domain and the date. Only you can see the address. Your public page shows nothing but the words “Work email checked” and the domain, which is already on your page.
• You can remove it at any time, and it is deleted with your brand page.
• A scrambled note of where codes were sent, so nobody can be sent code after code. We clear notes older than 2 days the next time anyone asks for a code. It cannot be turned back into an email address.

Cookies and storage in your browser

We only use these to make the app work — never for advertising, and never to follow you around other websites:

• Sign-in cookies — to keep you signed in, for up to 400 days unless you sign out.
• Two short-lived cookies while you connect Instagram or YouTube — one checks that the connection you come back with is the one you started, and the other holds the one-time code Instagram or Google sends back until we finish connecting. They last at most 10 minutes and are deleted once connecting is done.
• A few small notes saved in your browser — that you just left to connect Instagram (so we can ask whether you made it back), that a connection is already being finished and how it ended (so refreshing the page never sends the same code twice), that a sign-in with Google is being retried, that we have already shown you a celebration, if you tapped Apply on a collab before you had an account — which collab you were reading, so we can take you back to it after you sign up — when you have InHooked open in more than one tab, which tab is checking for new messages, so we only check once, and a message you have started writing to someone but not sent, so it is still in the box when we take you to the chat. These notes stay on your device. Nothing here is sent to us on its own — a message you have not sent reaches us only when you tap Send.

What is public and what is not

This matters more than anything else on this page, so we want to be plain about it.

• Your published profile is public. Once you press Publish, your profile page can be viewed by anyone on the internet and can show up in Google search results.
• Text you have not published stays private. Changes you make are visible only to you until you publish them.
• Photos are the exception, and you should know this. An image is stored at a web address as soon as you upload it — or, for an Instagram post you pick for your work, as soon as you pick it — even before you publish. That address is long and effectively impossible to guess, and we never share it — but anyone who had it could open the image. If a photo is sensitive, do not upload it.
• Photos can carry hidden location data. Many phones store where a photo was taken inside the photo itself. We remove it from most photos when you upload them, but not yet in every case — if a photo could show where you live or study, turn off location for your camera before you take it.
• Your email address is never shown publicly.

When you apply to a collab

Applying is how a brand finds out about you, so it sends them real things about you. We want you to know exactly which, before you tap it — the same words are on the Apply screen itself.

• Your page goes to that brand — your name, your photo, your topics and your city, as they were on the day you applied.
• Your real numbers go with it — your follower count and your engagement, even if you have hidden them on your public page. Hiding them keeps them off the page strangers can read; applying is you choosing to show them to one brand.
• Your rates, unless you have turned pricing off. If your page says “Contact for pricing”, no price is sent.
• Your work goes with it — the posts you picked and the links you pasted, exactly the ones your page was showing that day.
• The one line you wrote, if you wrote one. It is optional, and nothing is sent in its place if you leave it empty.
• We freeze all of it on the day you apply. The brand reads that copy, not your page as it is today — so editing your page later does not change what they are looking at, and the numbers cannot move while they decide. The brand keeps that copy.

We keep an application, and the copy it froze, for as long as your account exists. If you close your account or your creator page is deleted, your applications go with it and the brand's list of applicants no longer includes you.

When a brand hires you

If a brand marks a collab as hired, that goes on your public page as a verified collab, with a tick. Anyone can see it.

• It shows the brand's name and what the collab was for — the deliverables from their posting, and the month.
• You cannot remove it on your own. The tick means the brand said it happened, so it would be worth nothing if the person it vouches for could delete it. If something is wrong, message the brand — that conversation is already open.
• It stays if the brand later closes its account. The verification was true when it was made, and their name stays on the row.

A collab you add yourself is different. It says “Added by the creator” with no tick, and you can edit or remove it whenever you like — we can't check it, and we say so on the page.

When you and a brand disagree

If a brand marks a collab as didn't work out and you say it did happen, we count that publicly, on the brand's page — as a number of creators who said so, next to what the brand said.

We do not decide who is right. There is no evidence step, no appeal and nobody here reviewing it. Your name is not shown with the count. Saying it happened also adds the collab to your own page as “Added by the creator” — never with a tick, because only the brand's own confirmation does that.

Brand labels: Bronze, Silver and Gold

We work out a score for a brand that has posted a collab, from what it does on InHooked: whether it answers creators who apply, whether it gives shortlisted creators a final answer, whether it replies to messages, how clear its collab posts are, and how complete its page is. Anyone who opens the brand's page or one of its collab posts sees only a label — Bronze, Silver or Gold. Only the brand sees its number.

If you are a creator, applying to a brand and messaging it are part of what that brand's label is worked out from. Your name is never shown with it, and we never tell a brand which creator changed its score. The label is InHooked's own. It is not a review, and it says nothing about how a brand pays: we never see payments between brands and creators.

Who's looking at you: page visits

We count how many people open a creator's page or a brand's page, and we show that number to the page's owner. Each person is counted once a day. If you are not signed in, we turn your IP address into a scrambled code that changes every day. We store the code, not the IP address, and we do not use it to follow you from one day to the next. If you are signed in, we use your account instead of your IP address, and visits to your own page are not counted.

If you are signed in when you open a page, its owner can see that you looked. A creator sees the name of a brand that opened her page, and the day. A brand sees the name of a creator that opened its page, and the day. A creator who opens another creator's page, or a brand that opens another brand's page, is counted but never named. If you are not signed in, you are counted but never named.

Only the page's owner sees these numbers and names. They are not part of anyone's score. We delete visit records after 30 days.

When a brand messages you first

A brand can start a conversation with you even if you have not applied to anything. They find you the way anyone does — your public page. We only put that button on your page, never on a list of search results, and it writes to one creator at a time.

• They get one message until you reply. They cannot send a second one, and there is nothing for you to accept. If you answer, the conversation becomes an ordinary one.
• Ignoring it costs you nothing, and the brand is never told. There is no read receipt, no “seen”, no “declined”. It does not affect your rank, your page or how you appear to any other brand.
• You can block them. Neither of you can write in that conversation again, the brand is not told, and you can undo it from the same menu.
• You can report them. That sends us what you wrote, who you are and which conversation it was. A person reads it — there is no automatic action, nothing happens to their account on its own, and they are never told you reported them. We keep reports for as long as InHooked runs — there is no date when we delete them, including after either account closes, because the point of a report is to still be there when someone asks what happened. That means you cannot take one back once you have sent it, so write it as something you are willing to stand behind.

The message itself is a normal conversation: we do not read it to decide anything, and the same rules on this page apply to it as to any other chat.

Emails we send about collabs

Applying and hiring happen over days, not minutes, so we email you when something actually changes. There are exactly six of these emails, they are the whole list, and we do not add another without changing this page first.

• Your application is in — to you, the moment you apply, naming the collab.
• A brand wants to talk to you — to you, when a brand shortlists you, with the message they wrote.
• A brand confirmed your collab — to you, when you are hired.
• About your application — to you, when a brand decides it is not this time. It carries whatever the brand wrote to you, and it never tells you a reason, because brands are not asked for one.
• A brand sent you a message — to you, when a brand messages you without you having applied to anything. It quotes what they wrote, and it says you do not have to reply.
• A summary of who applied — to a brand, about their own collabs. It is a summary and never one email per applicant. It names the strongest few who applied and their numbers — the same numbers applying already sent that brand, and nothing more — and the brand opens the app to see everyone.

None of these emails contain the other person's email address or phone number. They carry what you can already see inside the app, and a button that takes you there.

Turning them off

Every one of these emails has an Unsubscribe link in its footer, and your email app's own one-tap unsubscribe works too. Both land on inhooked.com/unsubscribe, which turns off every one of them at once and tells you it has.

Emails about your account are not affected and cannot be turned off — signing up, confirming your email address, resetting your password, and the one-time code when a brand checks a work email. You need those to get into your account, so they are not marketing and there is nothing to unsubscribe from. Nothing inside the app changes either: you still see every applicant, every decision and every message where you always did.

We keep a record that an email was sent, which one it was, and what it was about, so we can answer “was she told?” without guessing. That record holds no email address and none of the words in the email.

Instagram

Connecting Instagram is entirely optional. If you connect it, we read the following from your professional Instagram account — and here is what each one is for:

• Your account identifier, and one for each post — to know which Instagram account is yours. It is also how Instagram tells us which account to remove when you disconnect.
• Your handle, display name, biography and profile picture — to show the verified Instagram account behind your profile, so a brand knows it is really you.
• Your follower count, following count and post count — to show brands your real audience size instead of a number you typed in yourself.
• Your reach — to show how many people actually see your posts.
• How many times your posts were saved and shared over the last 28 days — to show a brand that people keep and pass on what you make, not just scroll past it.
• Aggregated audience information — age bands, gender split, top cities and top countries, to help a brand judge whether your audience fits their campaign. Instagram only gives us this last item once an account passes 100 followers. You can still connect below that — you simply will not see the audience breakdown until then. We never see who your individual followers are.
• How many followers you gained and lost over the last 30 days, and how many new followers you got each day — to show you how your audience is growing. Only you ever see these.
• Your most recent 12 posts — caption, type, thumbnail image, link, date, like count and comment count, to show examples of your work and to work out your engagement figure.
• For each of those 12 posts — whether it is a Reel or a regular post, how many people it reached, how many saved it and shared it, and for Reels, how long people watched on average. Only you ever see these.

We also work out an engagement figure from your recent posts. When Instagram tells us how many people saw them, it is the likes, comments, saves and shares they got for every 100 people reached. When it doesn't, we estimate it from likes and comments against your follower count and label it as an estimate. Either way it is our own calculation, not a number Instagram gives us.

What appears on your public profile

Once you publish your profile, some of this becomes public: your handle, follower count, post count, our engagement figure — labelled as an estimate when it is one — your reach, your saves and shares from the last 28 days, and a summary of your audience (top age band, gender split, top city and top country). Your recent posts are not among them: the only posts on your public page are the ones you picked yourself for your work. Your following count, your detailed audience figures, your follower growth, your best post and the numbers for each individual post stay private to you.

How we store it

We copy your post thumbnails into our own storage, because Instagram's image links expire after a short time. The secure key that lets us read your account is stored encrypted, is never shown to you or anyone else, appears in nothing our app sends back to a browser, and is only ever sent to Instagram itself.

Each time we refresh your stats we replace the previous snapshot — we do not keep a history of how your numbers changed over time. Follower growth is the one figure that covers a period: Instagram gives us its last 30 days, and every update replaces the copy we had, so we never hold anything older than what Instagram last sent us. If your connection expires, the last numbers we received stay until it is renewed or you disconnect.

We never post to your Instagram account, never read your direct messages, and never contact your followers.

How to delete your Instagram data

There are three ways, and all of them delete the same thing:

• Tap Disconnect Instagram in the app. This removes your stats, your audience information, the stored thumbnails, and the Instagram posts you picked for your work.
• Remove InHooked from your Instagram settings. Instagram tells us, and we delete the same data automatically.
• Send a data deletion request. You will get a confirmation code you can check at inhooked.com/instagram/data-deletion.

The rest of your InHooked profile stays as it is, with one exception: any Instagram posts you picked for your work are removed from your profile and from your public page, including our copy of each picture. YouTube links you pasted into your work stay.

YouTube

Connecting YouTube is entirely optional, and it is separate from Instagram — connecting one does nothing to the other. InHooked uses the YouTube API Services. If you connect your channel, we read the following and nothing else:

• Your channel name, handle and picture — to show which channel is yours.
• Your subscriber count, video count and total views. YouTube rounds subscriber counts for everyone, including us, so the number we show is your real count or a little lower. If you have hidden your subscriber count on YouTube, YouTube does not tell us either, and we show everything except that.
• Views, likes, comments, shares and playlist adds from the last 28 days — the numbers a brand looks at.
• Subscribers gained and lost, per day, for the last 30 days — this is what draws the small growth line. We keep a rolling 30 days and nothing older.
• Who watches you — age ranges, the split between women and men, and countries. This is grouped information about your audience as a whole. YouTube never tells us who an individual viewer is, and we never ask.
• Your last 12 videos — title, publish date, views, likes, comments, how much of each video people watch on average, how many times each was shared, and how many subscribers each one brought you.

The engagement percentage we show is our own calculation from your likes, comments and shares. It is not a number YouTube gives out, and we always label it as an estimate.

We never post to your channel, never change anything on it, never read your comments or messages, and never see your earnings. Video thumbnails on your page are loaded straight from YouTube — we do not copy them onto our servers. The permission Google gives us to read your channel is stored encrypted, is never shown to anyone, and is only ever sent back to Google.

How to delete your YouTube data

• Tap Disconnect on your YouTube card in the app. This deletes your channel information, your numbers, your stored video list, the YouTube videos you picked for your work and your saved sign-in straight away — not later, and not in a queue.
• Remove InHooked from your Google account at your Google security settings. Your numbers stop updating straight away, and they stay on your public page until the connection runs out. If it is not renewed within 30 days, we take them off your public page and delete them — we warn you in the app a week before that happens, and reconnecting at any point brings everything back.
• Do nothing. YouTube requires us to re-check your permission at least every 30 days. If your connection is not renewed within 30 days, we take your YouTube numbers off your public page and delete them. We warn you in the app a week before that happens, and reconnecting brings everything back.

The rest of your InHooked profile stays as it is, with one exception: any YouTube videos you picked for your work are removed from your profile and from your public page at the same moment as your other YouTube information. YouTube links you pasted into your work stay.

By connecting YouTube you are also agreeing to the YouTube Terms of Service, and Google's own handling of your information is described in the Google Privacy Policy.

Who else touches your data

We do not sell your data, ever. We do not share it with advertisers. We use a small number of service providers to run the product:

• Supabase — our database, file storage and login, hosted in Mumbai, India
• Vercel and Google Cloud — the servers that run the website and API
• Resend — sends your verification and password reset emails, the one-time code if you check a work email, and the five collab emails above
• Have I Been Pwned — checks whether a password you choose has appeared in a known leak, without ever receiving the password itself
• Sentry — tells us when the app breaks
• Meta (Instagram) — only if you choose to connect your account
• Google — if you sign in with Google, and YouTube only if you choose to connect your channel
• Google Vertex AI — runs the AI writing help and the ranking explanations. See Where AI is used below for what is sent
• Cloudflare — provides DNS for our domain

Your database and files are stored in India. Some of these providers operate outside India, so your information may be processed abroad. We may also disclose information where the law requires it.

Where AI is used

Three places in the product use AI. The first two write a first draft for you: both are optional, both let you edit or delete every word afterwards, and neither one sends anything on its own — you tap to ask for it. The third one is not like that, and it is described last.

• Writing a collab post. We send the few lines you typed, plus your brand page’s own details — your company name, industry, city and the topics you hire for. If your budget is hidden on your page, it is not sent.
• Helping a creator write their line on an application. We send the things already public on their page — their name, bio, topics, skills and city — together with the collab they are applying to. For this one we never send follower counts, engagement or rates, and we never send anything they have hidden.
• Explaining to a brand why a creator is where they are in the list. This one happens on its own — there is no button. When a creator applies to a collab, we ask the model to write two to four sentences for that brand about what fits. We send the note the creator wrote on the application, their city and topics, their follower count, their engagement, which platforms they are on, the rate they asked for this work and whether it fits the budget — along with the collab itself. We also send the match number and the list of things that matched, both of which we work out ourselves: the model explains that number and never decides it. The sentences are shown only to the brand that posted the collab, on that one application, and we store them on it.

This goes to Google Vertex AI, which runs the model for us. It is not used to train anything, by us or by them. We keep a record of each request — which feature, how long it took and how large it was — so we can spot problems and abuse. We do not store what you wrote or what the AI wrote back in that record. The one thing we do keep is the explanation in the third bullet above, saved on the application it is about. Vertex AI processes this outside India.

Nothing the first two write is saved to your page or sent to anyone else until you save or send it yourself. Anything the AI writes goes through the same checks as anything you type — including the rule about phone numbers and links.

How long we keep it

We keep your profile and account information for as long as your account exists. Security records are kept while they remain useful for investigating abuse. Instagram information is removed as soon as you disconnect, and so are the Instagram posts you picked for your work. An application you sent a brand — and the copy of your page and your numbers it froze on that day — is kept for as long as your account exists, and is deleted with your creator page. YouTube information is removed as soon as you disconnect, or after 30 days if your connection is not renewed, and the YouTube videos you picked for your work go at the same moment. YouTube links you paste into your work are not tied to a connection, so they stay until you remove them or close your account. The cookies used while you connect last at most 10 minutes, and sign-in cookies up to 400 days unless you sign out. Records of who opened a page are deleted after 30 days. Copies of data can survive in our backups for a period after deletion before those backups are replaced.

Your rights

You can see and edit almost everything we hold about you from inside the app, and you can delete your photos, work samples, campaigns and certificates yourself at any time.

To get a copy of all your data, correct it, or close your account and have it erased, email privacy@inhooked.com. We handle these by hand today, and we will respond within 30 days.

InHooked is built for India and we follow Indian data protection law. If you are not satisfied with how we handle a request, you can complain to the Data Protection Board of India.

If you are in the UK or the European Union you also have rights under the GDPR — including access, correction, erasure and objecting to how we use your information. We rely on your consent and on the agreement between us to provide the service, and on our legitimate interest in keeping accounts safe for the security records described above. Write to the same address and we will honour those rights. You can also complain to your local data protection authority.

Age

You must be at least 18 years old to create an InHooked account. When you choose how you will use InHooked, you confirm you are 18 or older, and we keep a record of when you did. If we learn that an account belongs to someone younger, we will remove it.

Security

Your information is encrypted while it travels between your device and us, and the keys that let us read a connected account are encrypted where they are stored. Access to our live systems is limited to the people who operate InHooked. No system is perfectly secure, but we take this seriously and fix problems quickly.

Changes to this policy

If we change this policy we will update the date at the top of this page. If the change is significant we will tell you in the app.