Legal
Privacy Policy
Effective 3 September 2026 · Last updated 23 October 2026
InstaFact needs very little about you: a phone number to sign you in, and the links you choose to check. This policy explains everything we hold, why we hold it, who else touches it, and how to make us delete it.
1. Who we are
InstaFact is operated by LucidLabs, a company registered in India.
In this policy, “we”, “us” and “our” mean LucidLabs. “You” means anyone who uses the InstaFact mobile application or this website. For the purposes of India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary; under the EU and UK GDPR we are the data controller.
You can reach us at connect@instafact.co.
2. What we collect
Information you give us
| Data | When | Required? |
|---|---|---|
| Phone number and country code | When you sign in with a one-time password | Yes — it is how your account is identified |
| Name | If you complete your profile | No |
| Gender | If you complete your profile | No |
| Age group | If you complete your profile | No |
| Profile photo | If you upload one | No |
| Feedback and ratings | When you rate a verdict or send a comment | No |
We do not ask for your email address, your date of birth, your precise location, or your contacts. We never receive your card, bank or UPI details: a subscription is paid for inside Google Play or the Apple App Store, and the store tells us only that a subscription exists and when it runs out. We do not sell personal data to anyone.
Information created by using InstaFact
- Links you submit. The Instagram or YouTube URL you send for checking, plus the video's public identifier, title and channel name where available.
- Fact-check results. The verdict, confidence score, explanation and sources produced for each link, kept in your history.
- Follow-up questions. Messages you send in the chat about a result, and the replies.
- Referral code. A code tied to your account so referrals can be attributed.
- Diagnostics. Your app version and platform (Android or iOS), attached to feedback so we can reproduce problems.
Information collected automatically
- Push notification token. An identifier issued by Firebase Cloud Messaging so we can tell your device a check is ready. Turning off notifications makes it unusable.
- Session tokens. A refresh-token identifier and its expiry, so you stay signed in without re-entering an OTP.
- Server logs. Standard request logs including IP address, timestamp and user agent, generated by our web server and load balancer.
- App version and platform. Sent with each request so we can keep older versions of the app working and tell you when an update is needed.
- Approximate location — optional, and only if you allow it. If you grant the app location permission, your device's last known position is turned into the name of a state or province on your phone. Only that name — “Maharashtra”, for example — is sent to us, and the coordinates are discarded without ever leaving the device. We use it to arrange the Explore feed around what is being shared where you are. The app never asks the system for a fresh position fix, nothing stops working if you refuse, and you can withdraw the permission at any time in your device settings.
- Subscription status. If you subscribe, the store gives us a purchase token, which we send to Google or Apple to confirm what was bought. We keep the plan, its status and its expiry date so we know what your account is entitled to.
- App analytics and crash reports. Which screens are opened and which actions are taken — a check submitted, a result read, a plan viewed — together with your account identifier, your country, and the profile details you chose to give. Crash reports include the error and the state of the app at the time. These tell us what is broken and what people actually use.
- Advertising identifier — only if you watch a rewarded video. Where the app offers an advert as a way to open a result, the advertising network needs your device's resettable advertising ID to show and measure one. No advert is requested unless you choose to watch it.
3. How we use it
- To sign you in — sending the one-time password to your phone and keeping your session alive.
- To run a fact check — retrieving the video you linked, transcribing it, and comparing the claim against published sources.
- To show you your history and let you return to earlier verdicts.
- To notify you when a check finishes.
- To answer follow-up questions about a verdict.
- To fix and improve the service — diagnosing failures, measuring how long checks take, and understanding which parts of the app people use.
- To arrange the Explore feed — if you have allowed it, showing what is being shared in your part of the country rather than only what is shared nationally.
- To run subscriptions — confirming a purchase with the app store, giving your account what the plan includes, and ending it when it expires or you cancel.
- To show a rewarded advert where you choose to watch one instead of subscribing, and to confirm with the advertising network that it was genuinely watched.
- To keep the service safe — detecting abuse, automated scraping and attempts to break the service.
- To meet legal obligations where the law requires us to retain or produce information.
We do not use your personal data to train our own machine-learning models.
4. Our legal basis
If you are in India, we process your personal data on the basis of the consent you give when you create an account, and for the “legitimate uses” permitted by section 7 of the Digital Personal Data Protection Act, 2023.
If the EU or UK GDPR applies to you, we rely on:
- Performance of a contract — to give you the service you asked for.
- Legitimate interests — to keep the service secure, working and improving, balanced against your rights.
- Consent — for push notifications, which you can withdraw at any time in your device settings.
- Legal obligation — where we must retain or disclose data by law.
5. Who we share it with
We do not sell your personal data. We share it only with the categories of service provider that make InstaFact work, each of which receives the minimum needed to do its job and is bound by contract to use it only on our instructions:
| Category of provider | Purpose | What it receives |
|---|---|---|
| Cloud hosting and storage | Running the service, the database and file storage | Application data, held on servers in India |
| SMS delivery | Sending your one-time password | Your phone number and the code |
| Media retrieval | Fetching the public video you linked to | The URL you submitted |
| Speech-to-text | Turning the video's audio into text | The video's audio or its public URL |
| AI language processing | Extracting the claim, weighing sources, answering follow-ups | The transcript, the claim, and your follow-up questions |
| Push notifications | Telling your device a check is ready | Your notification token and the message |
| App analytics and crash reporting | Seeing what is used and what breaks | Usage events, your account identifier, country, and the profile details you gave |
| App store billing | Confirming what a subscription bought and whether it is still active | The purchase token the store issued. No payment details — the store never gives us any |
| Advertising networks | Showing a rewarded video, where you choose to watch one, and confirming it was watched | Your device's advertising identifier and standard device and network information |
We do not publish the names of individual providers, which we treat as commercially confidential and may change from time to time. If you need to know the specific providers handling your data — for example to exercise a data-protection right or to complete a vendor assessment — write to connect@instafact.co and we will tell you.
Separately, if you accept analytics cookies on this website, Google (Analytics) and Microsoft (Clarity) receive website usage data as described in section 11. Those two are named because their cookies are visible in your own browser.
In the mobile app, the analytics, crash reporting and advertising providers above are Google (Firebase Analytics, Crashlytics and AdMob) and Unity Technologies (Unity Ads). We name these four because they are software running on your own device rather than services we call on our servers, so you are entitled to know whose code is on your phone.
We may also disclose personal data:
- to comply with a law, court order or binding request from a public authority;
- to enforce our terms, or to investigate fraud, abuse or a security incident;
- to a professional adviser under a duty of confidence; or
- to a buyer or successor if the business is sold or reorganised, in which case we will tell you before your data becomes subject to a different policy.
6. Where it is stored
Your data is stored on cloud infrastructure located in India. Some of the providers described in section 5 — in particular those handling AI language processing and push notifications — process data outside India. Where that happens we rely on the providers' contractual safeguards, including the European Commission's Standard Contractual Clauses where applicable.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account |
| Check history and chats | Until you delete your account |
| One-time passwords | Minutes — they expire on use or shortly after |
| Approximate location (state or province) | Replaced each time it is worked out again; deleted with your account |
| Subscription records | Until you delete your account, or longer where tax and accounting law requires it |
| Session tokens | Until they expire or you sign out |
| Server logs | 180 days |
| Published verdicts | Indefinitely, with no link to who requested them |
When you delete your account we remove your profile, phone number, photo, history and chats. A verdict that was already published in the public Explore feed stays, but it is no longer connected to you. We may keep a minimal record where law requires it.
8. Your rights
Whatever country you are in, you can ask us to:
- Show you the personal data we hold about you.
- Correct anything inaccurate or incomplete.
- Delete your account and the data attached to it — use the account deletion page.
- Withdraw consent you previously gave, including for notifications.
- Export your data in a portable form.
- Object to or restrict processing that relies on our legitimate interests.
- Nominate someone to exercise these rights if you die or become incapacitated, as India's DPDP Act allows.
Email connect@instafact.co and we will respond within 30 days. There is no charge. We may need to verify that the request comes from the account holder before we act on it.
If you are unhappy with our response you may complain to the Data Protection Board of India, or — if you are in the EU or UK — to your local supervisory authority.
9. Security
Traffic to InstaFact is encrypted in transit with TLS. Access to production systems is restricted to the people who need it. One-time passwords are short-lived, and sessions can be revoked. We review our dependencies for known vulnerabilities.
No service can promise perfect security. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
10. Age requirement
You must be 16 or older to use InstaFact. The service is not intended for anyone younger, and we do not knowingly collect the personal data of anyone under 16. If you believe someone under 16 has created an account, email connect@instafact.co and we will delete it.
11. Cookies and analytics
On this website
This website uses two analytics tools, and neither one runs until you agree to it. On your first visit you are asked; if you decline, no analytics script is loaded at all and no analytics cookie is set. Nothing here is used for advertising, and we do not sell or share this data.
| Tool | What it tells us | Cookies |
|---|---|---|
| Google Analytics 4 | How many people visit, which pages they read, where they arrived from, and which app-download buttons get used | _ga, _ga_* |
| Microsoft Clarity | Aggregated heatmaps of where visitors click and scroll, and session replays of how pages are used | _clck, _clsk |
Google Analytics is configured to anonymise your IP address. Microsoft Clarity records how pages are interacted with; it masks text content by default, and this website has no logged-in area or forms carrying personal data other than the account deletion page. We never use these tools to identify an individual.
You can change your mind at any time. Reopen the cookie choice, or clear this site's data in your browser. Declining is as easy as accepting, and the site works identically either way.
In the mobile app
The app uses no cookies. It does use Firebase Analytics and Crashlytics, which are not cookie-based and so are not covered by the choice above: they record the events and crashes described in section 2 and are tied to your account identifier rather than to a browser. We use them to find what is broken and to see which parts of the app are worth building on. They are not used for advertising, and no advertising profile is built from them.
Where the app offers a rewarded video as a way to open a result, the advertising network receives your device's advertising identifier and may use it to choose and measure the advert, including personalising it. You control that identifier on the device itself: on Android under Settings → Privacy → Ads, where it can be reset or deleted, and on iOS under Settings → Privacy & Security → Tracking. No advert is ever requested unless you choose to watch one, so refusing simply means the option is not offered to you.
Two things happen regardless of your choice, because they are how the page is delivered rather than analytics. Fonts load from Google Fonts, so Google receives your IP address when a page loads. And our own web server keeps standard request logs, described in section 2.
The mobile app does not use cookies, and it does not run either of these tools. It keeps your session in the app's own storage on your device.
12. Changes
We will update this policy when the service changes. The “last updated” date at the top always reflects the current version. If a change materially affects your rights we will tell you in the app or by notification before it takes effect.
13. Contact and grievances
For any question about this policy, or to exercise the rights in section 8, write to connect@instafact.co.
Grievance Officer
As required by India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023:
Name: Shivam Agarwal
Designation: Chief Executive Officer
Email: connect@instafact.co
We acknowledge complaints within 48 hours and resolve them within 30 working days of receipt.
Related: Terms of Use · Content & Corrections Policy