LITTLE TOP CREATIONS

Instagram community
privacy policy.

Effective and last updated: October 19, 2026

This policy explains how Little Top Creations, the publisher of Hardpack Rally, handles information through our Instagram community tools. These include Reel Replies, the Meta application Review Poster and its Instagram application Review Poster-IG when used for this integration, and the Hardpack Rally spectator roster.

It covers people who comment on our connected Instagram content, people who choose to join the spectator roster, and authorized operators of these tools. It does not describe unrelated uses of Review Poster or every feature of the game, Steam, Instagram, or this website.

1. Information we collect

• Connected account information: the authorized Instagram account's identifier and username, authorization tokens and their expiry, and temporary sign-in state. Account operators sign in through Instagram; Reel Replies does not receive their Instagram password.
• Reels and comments: Reel identifiers, captions, links and thumbnail links; comment identifiers, usernames, comment text, timestamps and available replies returned by Instagram's API.
• Workspace activity: reply drafts, saved answers, notes, saved-comment selections, and reply submission records and delivery status. The workspace is associated with its operator's signed-in account identifier.
• Spectator campaigns: the campaign's account and Reel identifiers, keyword, participation notice, import progress, and submitted handles with their approval or suppression status and creation date.
• Requests and technical information: information you send when contacting us, and technical data such as IP addresses, browser information and request logs that hosting or authentication providers may process to deliver and protect the services.

2. How we use information

We import comments on our connected account's content, organize questions, prepare replies and submit replies that an operator reviews and chooses to send. Saved answers are editable templates. Comments may also be saved or exported as image cards for use in our Reels and other community content; those cards can include the commenter's username and comment text.

For a spectator campaign, its invitation explains that commenting the specified keyword submits your handle for public display on the roster and in the game. We review submissions, avoid duplicates and retain suppression records to prevent a removed handle from being imported again. An ordinary comment is not automatically an instruction to join the roster.

We also use information to authenticate operators, prevent unauthorized access and duplicate replies, resolve technical problems, and handle privacy requests. This integration requests basic Instagram account access and comment-management access; it does not import private Instagram messages. A message you send us separately to request help or removal is handled for that request.

Where data-protection law requires a legal basis, we rely on our legitimate interests in managing and securing our community communications, subject to your rights; consent for optional participation where required; and legal obligations where applicable. You can object to our use of your information or withdraw optional participation by contacting us.

3. Who can see information

The reply workspace is restricted to its authorized operator. We use Meta/Instagram for account authorization, comment access and replies; OpenAI's Sites and sign-in services for the private workspace; and Cloudflare for hosting, storage and the public roster. These providers process information needed to supply their services. Processing may take place outside your country, including in the United States, under the providers' applicable terms and safeguards.

Replies posted to Instagram are visible according to Instagram's settings. Exported comment cards become visible if we publish them. The public spectator directory and in-game roster display approved handles only, not the source comment, profile photo or account token. Other people can view or copy public content.

We do not sell information collected by this integration or use it for targeted advertising. We may disclose information when necessary to meet legal requirements, address abuse or protect the security and rights of people using the service.

4. Storage and retention

Instagram access tokens are encrypted in server storage. Access controls protect the private workspace. No system can guarantee absolute security.

Imported information, drafts and saved material remain in the workspace until cleared or removed in response to a request; there is currently no automatic time-based cleanup of that material. We retain it only while needed for community management, planned content, troubleshooting or applicable legal requirements. Temporary authorization states expire, and Instagram tokens have an expiry.

Disconnecting Instagram removes its stored connection token and clears the workspace's imported Reels, comments and drafts. It does not automatically delete saved reply templates, reply-delivery records, separately exported files, already-published content or spectator-roster records. Contact us to request removal of those items as well.

Approved roster handles remain until removed or the roster is retired. A hidden handle is retained privately as a suppression record to stop it from reappearing. You may request deletion of that record too; without it, a later campaign import may identify the same handle again. Hosting providers may retain backups or security logs under their own retention practices.

5. Request removal or deletion

1. Email [email protected] with the subject Instagram data request. Include your Instagram handle, a relevant Reel or comment link if available, and what you want removed: imported comments, saved cards, published community content, your roster entry, or all information associated with this integration.
2. For a spectator-roster removal or correction, you can instead message the Instagram account that posted the campaign Reel from the account being listed. Include your handle and “remove my spectator name” or the correction.
3. We may ask for reasonable confirmation that you control the relevant account. Do not send your password, login code or access token. We will explain any information we must retain and respond in accordance with applicable data-protection requirements.

Account operators can also revoke the app's access through Instagram's Apps and Websites settings and use Connection setup → Disconnect account in Reel Replies. Revoking access stops future authorized API access; it does not itself erase existing copies.

Removing our stored copy does not delete the original comment or reply on Instagram, which is controlled through Instagram. Public roster caches may briefly show an earlier result, and an already-open game roster updates on its next request. We cannot remove copies made independently by other people.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your information, restrict or object to its use, withdraw consent, or complain to your local data-protection authority. Contact us using the address below. The policy page itself does not set advertising cookies or load advertising analytics; authentication and hosting services may use technical cookies or similar information for their operation and security.

7. Updates and contact

We will update this page when the tools or their data practices change and show the revised date above. For privacy questions or requests, contact Little Top Creations, Hardpack Rally at [email protected].