What we keep, and why.

What we hold

For each shop we work with: the shop's name, address, hours and contact details; the product catalogue the shop gives us (names, brands, sizes, potency figures, photographs); the slides we render from it; and the email address that receives the weekly review.

When a shop connects its Instagram account, Instagram gives us an access token and the account's numeric id, username and account type. The token is encrypted at rest and is used for one thing: publishing the carousel the shop approved.

If you sign in with Google, Google tells us your email address and an account number for your Google account, and nothing else.

What we never do

We do not read your direct messages, comments, followers or insights. We do not post anything you have not approved. We do not sell or share any of this with anyone. We do not run ads or boost posts.

When you connect an AI

You can connect an AI assistant — Claude, ChatGPT, Cursor, Gemini — to prepare posts for your shop. Only an owner can allow it, the connection reaches the shops you own and nobody else’s, and it is your own sign-in that authorises it: we never ask you to paste a password into anything.

A connected assistant can see and change the same things you can see and change in the app: your photos and clips, your captions, and your queue. It cannot connect or disconnect Instagram, change how your shop posts, or delete the shop. It cannot post to Instagram — posts go out at their time, by us, after you approve them.

What it sends us is what you type to it. We do not send your shop data to the assistant; the assistant asks us for it, over your connection, when you ask it to. Anthropic, OpenAI, Google and Anysphere each have their own privacy policy covering what they do with your conversation, and we have no part in that.

The permission lasts until you take it back, and it renews itself quietly in the background while you use it. It covers the shops you own when you allow it and any shop you add to your login later, until you take it back. Take it back in the app under Your AI: the connection stops working on its very next request. We keep a record of which assistant connected and when, so you can see what is attached to your login.

Taking it back

Remove Storefront Feed from Instagram → Settings → Apps and websites at any time; the token stops working immediately. Email us to have the shop's data deleted; we do it within seven days and confirm by reply.

Where it lives

The service runs on Railway (United States) with email delivered by Resend. Storefront Feed is operated by Horiryu II Tattoo Inc., Vancouver, BC.