Last updated: March 26, 2026
Punchy is a Chrome extension that downloads saved Instagram collections to your local computer. This policy explains what data Punchy accesses and how it is handled.
Instagram saved page content: Punchy reads the DOM of your Instagram saved collections pages to discover posts (thumbnails, shortcodes, usernames). It also makes requests to Instagram’s GraphQL API to fetch full-resolution media URLs. This data is used solely to enable downloading and is never stored beyond the current browser session.
Tab URL: Punchy checks the URL of your active tab to determine whether you are on an Instagram saved page. No browsing history is recorded or stored.
License key (optional): If you activate a premium license, Punchy sends only your license key string to Gumroad’s API (api.gumroad.com) for verification. No other data is included in this request.
Extension state: Scan results (post shortcodes, thumbnails, collection names) and UI preferences are stored in your browser’s local storage (chrome.storage.local). This data never leaves your browser and is cleared when you reset the extension.
License activation status: If you activate a premium license, the license key and activation state are stored in chrome.storage.sync so your license carries across devices signed into the same Chrome profile.
| Service | Purpose | Data sent |
|---|---|---|
Instagram (instagram.com, cdninstagram.com, fbcdn.net) |
Fetch and download saved media | Standard browser requests (cookies managed by Instagram, not by Punchy) |
Gumroad (api.gumroad.com) |
License key verification (optional) | License key string only |
Punchy does not sell, transfer, or share user data with any third party for any purpose.
If this policy is updated, the changes will be posted here with a revised date.
If you have questions about this policy, open an issue on the GitHub repository.