Reelak Privacy Policy

Last updated: 30 October 2026.

Reelak (ریلک) is an app for making Instagram videos with Persian subtitles and for automating Instagram replies. It is run by Taha Valikhani. Contact: tahavalikhani2010@gmail.com or Telegram @tav_1089.

This policy explains what we collect, why, where it goes, how long we keep it, and how you can delete it. We do not sell your data and we do not show ads.

What we collect, and why

Your phone number. You log in with your mobile number and a code we send by SMS. We use the number to keep your account, and to tell you important things about it (for example, that your plan is ending).

Your videos stay on your phone. Your videos and projects are never uploaded to us. They are saved only on your phone.

The sound of a video, only when you ask for subtitles. To write the subtitles, the app sends only the sound (not the picture) to our server. It is turned into words by ElevenLabs and the words are tidied up by OpenAI. We do not keep the sound: it is deleted as soon as the words are made. The words wait on our server until your phone downloads them, and are deleted after at most 3 days.

Words you send to the AI helpers. When you ask for suggestions (important words, sound effects, emojis, a call-to-action, a post caption), the app sends the words of your video. They are processed by OpenAI to make the suggestions, and we do not keep them.

Usage. We count how many videos you make, how long they are and what the AI cost us, so that we can apply the plan limits and keep the service affordable.

Payments. You pay through Zarinpal on our website. We keep the plan, the amount, the date, Zarinpal's receipt number and the masked card number Zarinpal shows us (like 6037-99-**-1234). We never see your full card number or your bank password.

Instagram, only if you connect it. If you connect your Instagram professional account:

• We keep your account's Instagram ID, username, name and picture, and an access key that lets Reelak reply and send messages for you. Only our server uses this key.
• We receive the comments, messages and button taps on your account that your automations need, and keep them for up to 7 days. Messages we send for you are kept for up to 30 days.
• People who interact with your automations are saved in your customers list: their Instagram ID, username, name, and the phone number if they choose to send it. Only you can see your customers list. You are responsible for using it lawfully and fairly.
• If you turn on comment → DM for a reel made in Reelak, the reel's words and caption style are saved with that automation.

Technical data. Our servers and hosting providers record technical information such as IP addresses and the time of requests, for security and to fix problems. These records are kept for a short time.

Who processes your data, and where

• Supabase (database and server functions): Frankfurt, Germany.
• Liara (our servers in Iran: sending login codes, payment pages, encrypted backups).
• MeliPayamak (sending SMS): Iran.
• Zarinpal (payments): Iran.
• ElevenLabs (sound → words) and OpenAI (tidying words, suggestions): United States.
• Meta / Instagram, if you connect Instagram.
• GitHub runs our nightly backup job. The backups are encrypted and kept for 14 days.

These providers process data only to run Reelak.

How long we keep it

• Login codes: deleted within 10 minutes.
• The sound of a video: deleted right after the words are made.
• Words waiting for your phone: at most 3 days.
• Instagram events: up to 7 days. Messages we sent: up to 30 days.
• Your account, usage, automations and customers list: until you delete them or your account.
• Payment records: kept for accounting, also after you delete your account, but no longer linked to you.
• Encrypted backups: 14 days.

Your choices

• Delete your account in the app (Profile → Delete account). This deletes your account and everything linked to it: usage, Instagram connection, automations and customers list. Payment records stay for accounting, without your name or number. We keep only a scrambled fingerprint of your phone number (not the number itself), so the free week can't be used twice.
• Disconnect Instagram at any time in the app, or remove Reelak in Instagram's settings (Apps and websites).
• Ask Meta to delete your data: Meta forwards the request to us and we delete the data that came from Instagram.
• Ask us anything about your data: tahavalikhani2010@gmail.com.

Children

Reelak is not for children under 13, the minimum age for Instagram.

Security

All connections are encrypted (HTTPS). Secret keys stay on our servers, never in the app. Each person can only see their own data, and this is enforced by the database itself.

Changes

If we change this policy, we will tell you in the app before the change takes effect.