Legal
Privacy Policy
Effective 3 September 2026 · Last updated 3 September 2026
InstaFact needs very little about you: a phone number to sign you in, and the links you choose to check. This policy explains everything we hold, why we hold it, who else touches it, and how to make us delete it.
1. Who we are
InstaFact is operated by LucidLabs, a company registered in India.
In this policy, “we”, “us” and “our” mean LucidLabs. “You” means anyone who uses the InstaFact mobile application or this website. For the purposes of India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary; under the EU and UK GDPR we are the data controller.
You can reach us at connect@instafact.co.
2. What we collect
Information you give us
| Data | When | Required? |
|---|---|---|
| Phone number and country code | When you sign in with a one-time password | Yes — it is how your account is identified |
| Name | If you complete your profile | No |
| Gender | If you complete your profile | No |
| Age group | If you complete your profile | No |
| Profile photo | If you upload one | No |
| Feedback and ratings | When you rate a verdict or send a comment | No |
We do not ask for your email address, your date of birth, your precise location, your contacts, or any payment details. We do not have an advertising business, so we do not build advertising profiles and we do not sell personal data to anyone.
Information created by using InstaFact
- Links you submit. The Instagram or YouTube URL you send for checking, plus the video's public identifier, title and channel name where available.
- Fact-check results. The verdict, confidence score, explanation and sources produced for each link, kept in your history.
- Follow-up questions. Messages you send in the chat about a result, and the replies.
- Referral code. A code tied to your account so referrals can be attributed.
- Diagnostics. Your app version and platform (Android or iOS), attached to feedback so we can reproduce problems.
Information collected automatically
- Push notification token. An identifier issued by Firebase Cloud Messaging so we can tell your device a check is ready. Turning off notifications makes it unusable.
- Session tokens. A refresh-token identifier and its expiry, so you stay signed in without re-entering an OTP.
- Server logs. Standard request logs including IP address, timestamp and user agent, generated by our web server and load balancer.
3. How we use it
- To sign you in — sending the one-time password to your phone and keeping your session alive.
- To run a fact check — retrieving the video you linked, transcribing it, and comparing the claim against published sources.
- To show you your history and let you return to earlier verdicts.
- To notify you when a check finishes.
- To answer follow-up questions about a verdict.
- To fix and improve the service — diagnosing failures, measuring how long checks take, and understanding which parts of the app people use.
- To keep the service safe — detecting abuse, automated scraping and attempts to break the service.
- To meet legal obligations where the law requires us to retain or produce information.
We do not use your personal data to train our own machine-learning models.
4. Our legal basis
If you are in India, we process your personal data on the basis of the consent you give when you create an account, and for the “legitimate uses” permitted by section 7 of the Digital Personal Data Protection Act, 2023.
If the EU or UK GDPR applies to you, we rely on:
- Performance of a contract — to give you the service you asked for.
- Legitimate interests — to keep the service secure, working and improving, balanced against your rights.
- Consent — for push notifications, which you can withdraw at any time in your device settings.
- Legal obligation — where we must retain or disclose data by law.
5. Who we share it with
We do not sell your personal data. We share it only with the categories of service provider that make InstaFact work, each of which receives the minimum needed to do its job and is bound by contract to use it only on our instructions:
| Category of provider | Purpose | What it receives |
|---|---|---|
| Cloud hosting and storage | Running the service, the database and file storage | Application data, held on servers in India |
| SMS delivery | Sending your one-time password | Your phone number and the code |
| Media retrieval | Fetching the public video you linked to | The URL you submitted |
| Speech-to-text | Turning the video's audio into text | The video's audio or its public URL |
| AI language processing | Extracting the claim, weighing sources, answering follow-ups | The transcript, the claim, and your follow-up questions |
| Push notifications | Telling your device a check is ready | Your notification token and the message |
We do not publish the names of individual providers, which we treat as commercially confidential and may change from time to time. If you need to know the specific providers handling your data — for example to exercise a data-protection right or to complete a vendor assessment — write to connect@instafact.co and we will tell you.
Separately, if you accept analytics cookies on this website, Google (Analytics) and Microsoft (Clarity) receive website usage data as described in section 11. Those two are named because their cookies are visible in your own browser. They receive nothing from the mobile app.
We may also disclose personal data:
- to comply with a law, court order or binding request from a public authority;
- to enforce our terms, or to investigate fraud, abuse or a security incident;
- to a professional adviser under a duty of confidence; or
- to a buyer or successor if the business is sold or reorganised, in which case we will tell you before your data becomes subject to a different policy.
6. Where it is stored
Your data is stored on cloud infrastructure located in India. Some of the providers described in section 5 — in particular those handling AI language processing and push notifications — process data outside India. Where that happens we rely on the providers' contractual safeguards, including the European Commission's Standard Contractual Clauses where applicable.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account |
| Check history and chats | Until you delete your account |
| One-time passwords | Minutes — they expire on use or shortly after |
| Session tokens | Until they expire or you sign out |
| Server logs | 180 days |
| Published verdicts | Indefinitely, with no link to who requested them |
When you delete your account we remove your profile, phone number, photo, history and chats. A verdict that was already published in the public Explore feed stays, but it is no longer connected to you. We may keep a minimal record where law requires it.
8. Your rights
Whatever country you are in, you can ask us to:
- Show you the personal data we hold about you.
- Correct anything inaccurate or incomplete.
- Delete your account and the data attached to it — use the account deletion page.
- Withdraw consent you previously gave, including for notifications.
- Export your data in a portable form.
- Object to or restrict processing that relies on our legitimate interests.
- Nominate someone to exercise these rights if you die or become incapacitated, as India's DPDP Act allows.
Email connect@instafact.co and we will respond within 30 days. There is no charge. We may need to verify that the request comes from the account holder before we act on it.
If you are unhappy with our response you may complain to the Data Protection Board of India, or — if you are in the EU or UK — to your local supervisory authority.
9. Security
Traffic to InstaFact is encrypted in transit with TLS. Access to production systems is restricted to the people who need it. One-time passwords are short-lived, and sessions can be revoked. We review our dependencies for known vulnerabilities.
No service can promise perfect security. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
10. Age requirement
You must be 16 or older to use InstaFact. The service is not intended for anyone younger, and we do not knowingly collect the personal data of anyone under 16. If you believe someone under 16 has created an account, email connect@instafact.co and we will delete it.
11. Cookies and website analytics
This website uses two analytics tools, and neither one runs until you agree to it. On your first visit you are asked; if you decline, no analytics script is loaded at all and no analytics cookie is set. Nothing here is used for advertising, and we do not sell or share this data.
| Tool | What it tells us | Cookies |
|---|---|---|
| Google Analytics 4 | How many people visit, which pages they read, where they arrived from, and which app-download buttons get used | _ga, _ga_* |
| Microsoft Clarity | Aggregated heatmaps of where visitors click and scroll, and session replays of how pages are used | _clck, _clsk |
Google Analytics is configured to anonymise your IP address. Microsoft Clarity records how pages are interacted with; it masks text content by default, and this website has no logged-in area or forms carrying personal data other than the account deletion page. We never use these tools to identify an individual.
You can change your mind at any time. Reopen the cookie choice, or clear this site's data in your browser. Declining is as easy as accepting, and the site works identically either way.
Two things happen regardless of your choice, because they are how the page is delivered rather than analytics. Fonts load from Google Fonts, so Google receives your IP address when a page loads. And our own web server keeps standard request logs, described in section 2.
The mobile app does not use cookies, and it does not run either of these tools. It keeps your session in the app's own storage on your device.
12. Changes
We will update this policy when the service changes. The “last updated” date at the top always reflects the current version. If a change materially affects your rights we will tell you in the app or by notification before it takes effect.
13. Contact and grievances
For any question about this policy, or to exercise the rights in section 8, write to connect@instafact.co.
Grievance Officer
As required by India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023:
Name: Shivam Agarwal
Designation: Chief Executive Officer
Email: connect@instafact.co
We acknowledge complaints within 48 hours and resolve them within 30 working days of receipt.
Related: Terms of Use · Content & Corrections Policy