Last updated: August 19, 2026
InstaSave is a Chrome extension that downloads saved Instagram collections to your local computer. This policy explains what data InstaSave accesses and how it is handled.
Your saved posts: InstaSave requests your own saved collections from Instagram using the same private API endpoints the Instagram website itself calls, authenticated by the session cookie already in your browser. The response contains the posts you saved — media URLs, captions, usernames, like counts and dates. This is used to list and download them. On older or unavailable API paths it falls back to reading the saved page’s DOM directly.
Tab URL: InstaSave checks the URL of your active tab to determine whether you are on an Instagram saved page. No browsing history is recorded or stored.
License key (optional): If you activate a premium license, InstaSave sends only your license key string to Gumroad’s API (api.gumroad.com) for verification. No other data is included in this request.
Extension state: the current scan (posts, collection names, what you have selected) and your preferences — theme, folder options, whether the floating button is shown — live in chrome.storage.local. Your Instagram username is kept there too, purely so the panel can link straight to your saved page instead of dropping you on instagram.com. None of this leaves your browser, and Clear removes it.
License activation status: If you activate a license key, the key and activation state are stored in chrome.storage.sync so it carries across devices signed into the same Chrome profile.
Cached scans (IndexedDB, database instasave-cache): when a scan finishes, its results are kept on your machine so reopening the same collection is instant instead of re-fetching. Each entry holds the posts of one collection — shortcodes, media and thumbnail URLs, captions, usernames, like counts and dates — plus the time it was stored. Entries older than 24 hours are ignored and re-fetched. This never leaves your computer, is not transmitted anywhere, and is deleted when you press Clear in the panel. IndexedDB is used rather than chrome.storage.local because a large library can run to several megabytes, which would exhaust the quota shared with the rest of the extension.
Usage counters (for uninstall feedback, see below): InstaSave keeps four counters in chrome.storage.local — the date you installed it, how many files downloaded successfully, how many failed, and the type of the most recent error. These are never transmitted while InstaSave is installed. They exist only so that, if you remove the extension, the feedback form can tell a user who never got a single file out from one who downloaded thousands.
When you remove InstaSave, Chrome opens a short feedback form. This is the only time InstaSave sends anything without you asking it to, and by then the extension is already gone from your browser.
(The Feedback button in the panel opens the same form, but only when you click it, and carries nothing but the extension version.)
Five values are attached to that page’s address, all of them deliberately coarse:
| Value | What it is | Example |
|---|---|---|
| Version | The version you had installed | 1.3.0 |
| Age | Roughly how long you had it, as a range | 2-7 days |
| Tier | Whether a license was active | free or pro |
| Downloads | Roughly how much you downloaded, as a range | 11-100 |
| Last error | The category of the most recent failure | ratelimit |
What is deliberately not included: no account or device identifier of any kind, no exact counts, no Instagram username, no license key, no collection or file names, no browsing history. Nothing here can be tied back to you or to an Instagram account, and because there is no identifier, two submissions from the same person are indistinguishable from two different people.
Answering the form itself is optional — closing the tab sends nothing further.
Turning it off: open InstaSave → the gear icon → switch off “Feedback if I uninstall”. With it off, no address is registered with Chrome at all, so removing InstaSave opens no page and sends nothing.
| Service | Purpose | Data sent |
|---|---|---|
Instagram (instagram.com, cdninstagram.com, fbcdn.net) |
Fetch and download saved media | Standard browser requests (cookies managed by Instagram, not by InstaSave) |
Gumroad (api.gumroad.com) |
License key verification (optional) | License key string only |
Tally (tally.so) |
Hosts the feedback form | Opened in a browser tab in two cases: when you click Feedback in the panel (carrying only the extension version), or once on uninstall (carrying the five coarse values listed above, unless you turned the setting off). InstaSave makes no background requests to Tally. |
InstaSave does not sell, transfer, or share user data with any third party for any purpose.
If this policy is updated, the changes will be posted here with a revised date.
If you have questions about this policy, use the Feedback button inside the extension (bottom bar of the side panel), which opens a short form.