Privacy Policy — Spam Stopper

Last updated: November 6, 2026

Spam Stopper is a personal application operated by Jason Gulledge to review comments on his own Instagram account, @mr_jasoninparis. It is not offered as a service for other account owners.

Information accessed and purpose

With authorization through Instagram, the application accesses account identifiers, username and available account profile information; owned media identifiers, types, dates, thumbnails and Instagram links; and comment and reply identifiers, text, usernames and timestamps. This information is used to display owned media and identify potentially unwanted comments and possible criticism using explainable local rules. Negative-comment suggestions run in the browser without transmitting comment text to a sentiment-analysis service.

Authentication and storage

The Instagram password is entered only on Instagram. Access tokens and account profile information are held in server memory and saved in an encrypted local session file on the operator’s computer or private server. The encryption key is stored in private server configuration on Linux or macOS Keychain on a local Mac. If secure storage is unavailable, login remains in memory only. Tokens are not sent to the dashboard. An HTTP-only session cookie associates the browser with its server session. Disconnecting removes the server session and its saved login. Unexpired saved sessions can be restored after a server restart; access still requires the original browser’s session cookie. Comment content is not part of the saved login.

Media and comments are displayed in the browser; spam rules also run locally on the server when automatic deletion is enabled. Minimal media information, comment and reply text, usernames, identifiers, timestamps, parent relationships and retrieval checkpoints are stored in a local MySQL database on the operator’s computer or private server so unfinished reviews can resume without repeatedly requesting Instagram data. Existing imported comments are preserved; new comments are collected through signed webhooks. The application does not scan Instagram for comments or enumerate posts through the API. For a known post missing its saved URL, a background task may retrieve and cache that post’s metadata, including its permalink and available preview, through the official API. Missed notifications and changes made directly on Instagram may not be reflected in saved data. Confirmed comment deletion through the application removes local cached comment content and associated replies. A separate private spam-deletion review history can retain copies as described below.

Completed review date ranges, completion timestamps and the connected account identifier are stored in a local file. These records survive a restart and can be cleared using Reset completed ranges. The browser saves the last selected date range, but does not persist access tokens or comment content in local storage.

Operational records include local request timestamps, coarse API usage/error metadata, sync cursors and minimal deleted-comment identifiers. These support rate-limit safeguards, resumption and preventing deleted comments from being reinserted. If local database cleanup fails after Instagram confirms deletion, a local journal retains the comment identifier for retrying database cleanup. It does not retry Instagram deletion.

Local cached content persists until removed or the operator clears the database. Reloading or closing the dashboard does not erase saved database content. Instagram App and database credentials are stored in a private local configuration file. Access tokens are not stored in the database.

Learning from review feedback

The account owner can label saved comments as spam, negative, both, or neither using visible one-click buttons. Marking Spam or Both also remembers the username for future automatic deletion while protection is enabled; it does not delete the current comment. Reset removes the comment label; an existing username deletion rule must be removed separately using Stop remembering. Labels override automatic suggestions on those comments. Each label immediately updates a local similarity system that re-evaluates saved suggestions and eligible new comments against those examples. Matching normalizes accented letters and common invisible characters while preserving original displayed text; it does not send comments to an external AI service. Spam and learned spam suggestions can trigger deletion only when the account owner enables automatic spam deletion. A private server file stores account/comment identifiers, labels and salted hashes of text features, not raw training text. These learning records can remain after a comment is deleted so prior feedback continues to inform suggestions. Selecting Reset removes that comment’s saved feedback. Suggestions may misread context or sarcasm.

A separate experimental character-and-word classifier trains locally in a background worker from explicit human labels only. Salted hashes of character features and author identity are retained with those labels; raw training text is not added to the learning file. Older features are recovered only when matching text is already in the local cache or deletion history. Automatic deletion outcomes and predictions do not become training labels. A private evaluation report records aggregate results using held-out campaign/author groups. Experimental suggestions are review-only and never independently trigger deletion or account enrollment. Recent prediction text may be cached temporarily in server memory to avoid repeated processing. No external model service is used.

Services and sharing

The application uses Meta's official Instagram API. The browser may load media thumbnails from Meta's image servers. Local development uses Tailscale Funnel for its public HTTPS connection. A hosted installation uses the operator’s private server and HTTPS infrastructure. Meta and Tailscale process requests according to their own privacy policies. The operator does not sell commenter information or send comments to an AI classification service.

New comment notifications

When configured in Meta, signed Instagram comment notifications are received over HTTPS. Minimal events are saved to a private inbox and then to the local database. Pending events are retried if database storage is unavailable. Signature checking and account restrictions protect the receiver. Notifications trigger automatic spam deletion only when the account owner has explicitly enabled that setting. Newly notified comments may use notification time because webhooks may not include their creation time.

Comment actions

The application can permanently delete comments selected and explicitly confirmed by the account owner through Meta’s official API. The owner may also explicitly enable automatic deletion of new webhook comments flagged as spam, including learned spam suggestions. This setting is off by default and does not process existing saved comments. Negative-only labels do not trigger deletion unless the commenter is on the owner’s remembered spam-account list. False positives are possible. Turning it off stops unstarted deletions; an active request may finish. Private server state stores the setting, account/comment identifiers and attempt/cleanup status. Confirmed spam deletions awaiting cleanup may temporarily stage comment snapshots for recovery; completed attempt records contain no raw comment text or tokens. Failed or uncertain remote deletions are not automatically retried; confirmed deletions can receive local cleanup retries. Deleting a parent comment also removes its replies. It does not submit reports, block accounts, or send messages. Profile links help the account owner perform manual actions in Instagram. Suspicious-comment labels are heuristic suggestions and may misread context.

Remembered spam accounts

Usernames marked Spam/Both, or whose spam comments are deleted manually or automatically, are retained in a private, account-scoped spam-account list. The owner can explicitly add or remove usernames. When automatic deletion is enabled, all future webhook comments from listed usernames qualify for deletion, regardless of wording or labels. The file stores usernames, timestamps, deletion identifiers and counts, plus an owner-supplied manual-blocking checklist status. For new spam-deletion records, it also stores a review copy of the comment text, saved parent/post context, decision reasons, and automatic/manual source and outcome. These copies let the owner review what was deleted before blocking someone. No access tokens are stored. Older deletion records may lack text or source information. Deleting a parent does not necessarily archive every reply removed with it. Marking an account blocked does not verify Instagram status or call a blocking API. Matching is based on usernames, which may change or be reassigned. Existing historical deletion IDs cannot reconstruct removed usernames. These records and review copies persist after deleting comments and can be removed using Stop remembering. Deleted comments cannot be restored on Instagram from this history. The history is restricted to the connected account and is not fetched from an external service.

Disconnecting and contact

The account owner can disconnect in the dashboard and revoke the application's access through Instagram's Apps and websites settings. For questions about data handling or deletion requests, contact Jason Gulledge through the Instagram profile @mr_jasoninparis. Do not send passwords or access tokens.