Privacy Policy

Last updated July 9, 2026

Webby Co. ("Webby," "we," "us") operates the Webby Feed website builder and Instagram embed widget at app.webbyco.com. This page explains what data we collect, why, and how you can control it.

Data we collect

• Account & email. When you sign in, we store your email address and use it only to send you a one-time sign-in link. We never store a password.
• Instagram data. If you connect an Instagram account, we store the OAuth access token for that account, encrypted at rest (AES-256-GCM), along with your Instagram username and profile picture URL. We use that token solely to fetch your recent posts (image/video, caption, like and comment counts, post date, and permalink) so your embed widget can display them. We never post, comment, or take any action on your behalf.
• Feed configuration. The layout, color, and style choices you make in the builder are saved to your account so your embed code and dashboard stay in sync.
• Billing. Payment is processed entirely by Stripe. We never see or store your card details — we only store your Stripe customer/subscription IDs and your plan tier, so we know what features to enable.
• Cookies. We use a single session cookie to keep you signed in. We do not use advertising or analytics trackers.

How your data is used

We use your data only to operate the product: authenticating you, fetching and displaying your Instagram posts through your embed widget, enforcing your plan's feature limits, and billing you through Stripe. We do not sell your data, and we do not share it with third parties except the service providers below, each of which only receives what they need to do their specific job.

Service providers we use

• Meta / Instagram — the account you choose to connect.
• Vercel — application hosting.
• Supabase — our Postgres database.
• Stripe — payment processing and billing.
• Resend — delivering sign-in link emails.

Deleting your data

You can disconnect your Instagram account at any time from your dashboard, which removes the stored access token and cached posts immediately. If you remove Webby's access directly from your Instagram settings, we're notified automatically and revoke our copy of your data the same way. To delete your entire Webby account and all associated data, email us at hello@webbyco.com and we'll process it within 30 days.

Children's privacy

Webby is not directed at children under 13, and we do not knowingly collect data from anyone under that age.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you by email.

Contact

Questions about this policy or your data? Reach us at hello@webbyco.com.