Privacy Policy

Last updated July 24, 2026

TL;DR: Unsay runs almost entirely inside your browser. Your messages never leave your machine and we never see their content. A minimal licensing backend handles quota enforcement and license verification, receiving only anonymous, one-way identifiers (no name, no IP, no message content). Payments are processed by Lemon Squeezy on their own infrastructure. This single policy covers both Unsay extensions, the one for Instagram and the one for Facebook Messenger.

1. Who we are

Unsay is a Chrome extension built by an independent developer. Contact: contact@unsay.me.

2. Which extensions this policy covers

We publish two Chrome extensions. They share the same codebase, the same principles and the same backend design, so one policy covers both. Everything in sections 3 to 11 is true of both extensions, unless a difference is stated here.

2.1 Unsay for Instagram

• Runs only on www.instagram.com.
• Reads the ds_user_id cookie on instagram.com, to know which account is signed in.
• Free allowance: 50 of your own messages deleted per rolling week.
• Includes an optional backup feature that saves a conversation to your own computer as a .zip. The file is written locally, and is never uploaded anywhere.
• Contacts Instagram media CDNs (*.cdninstagram.com, *.fbcdn.net, *.fbsbx.com) only during that optional backup, to download the media of the conversation you asked to save.

2.2 Unsay for Facebook Messenger

• Runs only on the Messenger interface, at www.facebook.com/messages and www.messenger.com.
• Reads the c_user cookie on facebook.com and messenger.com, to know which account is signed in.
• Free allowance: 50 of your own messages deleted per rolling week.
• Has no backup feature. It never downloads or stores any message, photo, video or voice note.
• Uses its own separate backend instance and its own separate database. Quota counters and licenses are never shared with the Instagram extension.

3. Data we touch

3.1 Platform data (read, never transmitted)

• Your Instagram or Facebook session cookie, read to act on your behalf in the conversation you opened, never sent to any third party
• Active conversation IDs, read from the tab URL
• Message IDs and timestamps, read for the deletion loop, in memory only

We never read the content of your messages. Only IDs and counters.

3.2 Data held locally on your machine

• A short-lived cache (30 seconds) of your quota status and Pass license state, refreshed from our backend
• Your Pass license key, retained so the extension can revalidate it periodically
• A random 256-bit installation identifier (UUID) generated locally on first launch, used to distinguish your installation from any other
• Current job state (scan, deletion, and backup on Instagram), ephemeral, lost when you close the browser

This local data does not contain any message content and is stored solely to support the extension's normal operation.

3.3 Data transmitted (and to whom)

• To Instagram or to Facebook: the removal requests themselves (that is the purpose of the extension). We go through the platform's own mechanism, using the session you are already signed into.
• To our licensing backend (Cloudflare Workers): two anonymous identifiers and your license key, transmitted strictly for quota enforcement and license verification. Both identifiers are one-way SHA-256 derivatives designed so that the underlying values (your platform session identifier and your local installation UUID) cannot be recovered. No message content, no IP-based identifier, and no platform authentication token is ever transmitted to our backend.
• To Lemon Squeezy: your license key is forwarded by our backend to Lemon Squeezy for activation, periodic revalidation, and deactivation. Payment information is collected directly by Lemon Squeezy on their checkout page and never reaches our infrastructure. Lemon Squeezy policy: lemonsqueezy.com/privacy.

3.4 Anonymous identifiers used by our backend

To enforce the weekly free quota and bind one Pass license to one installation, our backend relies on two anonymous identifiers:

• User hash: a one-way SHA-256 hash of your platform session identifier (ds_user_id on Instagram, c_user on Facebook). Cannot be reversed to recover your username or any personal information.
• Installation fingerprint: a one-way SHA-256 hash combining your local installation UUID, the extension ID, your browser user-agent and your operating system platform. Cannot be reversed and contains no direct personal identifier.

These identifiers exist solely to count your weekly deletions and to prevent license sharing across installations. They are not used for analytics, profiling, advertising, or any commercial purpose unrelated to the extension.

4. Tracking, analytics, audience measurement

The Unsay extensions themselves contain no tracking cookies, no analytics SDK, no behavioral telemetry. No Google Analytics, Plausible, Mixpanel, Sentry, Datadog or equivalent are embedded.

Our backend logs are limited to operational reporting (HTTP status codes, response timing) and contain no personal identifier beyond the anonymous hashes described in section 3.4. Commercial metrics (number of Passes sold, refund rate) are reported to us in aggregate by Lemon Squeezy.

This landing page (unsay.me) uses Google Tag Manager and Google Analytics 4 for aggregate, anonymous visit metrics (page views, traffic sources). No personal identifier is sent. You can opt out via your browser's Do Not Track setting or any GA opt-out extension.

5. Your rights (GDPR)

You have the following rights over your personal data:

• Access, rectification, deletion
• Portability
• Objection to processing
• Restriction

In practice, exercising these rights involves the following steps:

1. For your Instagram or Facebook data: it's your account, manage it directly from the platform.
2. For your Pass license and the associated backend records: contact us at contact@unsay.me. We can deactivate your license, purge the associated anonymous identifiers from our backend, and confirm in writing. A Pass is a one-time purchase, there is no subscription and nothing to cancel.
3. For the extension's local data: uninstall the extension from chrome://extensions and the local cache is erased.

6. Security

Our backend runs on Cloudflare's serverless infrastructure (Workers and D1) with TLS in transit and standard access controls. The records we hold are limited to the anonymous identifiers, license metadata and quota counters described above. We do not store message content, platform authentication tokens, or IP-based identifiers.

Communication between the extension and our backend is authenticated and transmitted over HTTPS only.

7. Data retention

Anonymous identifiers and quota counters in our backend are retained while your Pass is active, and for a reasonable period after it expires or is deactivated (up to 90 days) to support re-activation and customer support. Beyond that period, inactive records are purged. Payment history is retained by Lemon Squeezy, our payment processor, in accordance with their own retention policy and applicable accounting law (typically 10 years).

8. Changes to this policy

We keep this page up to date. Any material change will be announced by email to Pass holders and notified via the extension's Chrome changelog.

9. Contact

For any question about this policy or your data: contact@unsay.me

10. Chrome Web Store Limited Use compliance

Unsay's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically, we affirm that:

• We do not sell or transfer any user data to third parties, outside the explicitly authorized cases (the platform itself, our own licensing backend, Lemon Squeezy, described in section 3.3).
• We do not use or transfer any user data for purposes unrelated to the single function of each extension (deleting the messages you sent yourself).
• We do not use or transfer any user data for creditworthiness or lending purposes.
• We use no user data for ad targeting or training AI models, and we transfer no data to ad platforms, data brokers, or information resellers.

11. Chrome permissions used

For transparency, here is what each permission requested in manifest.json is used for. These lists are updated with every release.

11.1 Unsay for Instagram

• storage, hold locally the short-lived cache of your quota status, your Pass license state and the random installation UUID described in section 3.2.
• webRequest, read-only observation of outgoing Instagram XHR headers, so Unsay can talk to Instagram with the same security headers as your browser. No modification, no blocking.
• tabs, read only the active tab's URL when you are on instagram.com, to detect which conversation is open.
• cookies, read sessionid on instagram.com only to check that you are signed in, and ds_user_id to derive the anonymous user hash described in section 3.4. Neither raw value ever leaves your browser. Your own messages are identified by Instagram's own marker on each message, not by these cookies.
• alarms, trigger the periodic license revalidation every 6 hours.
• sidePanel, display the Chrome side panel, Unsay's single interactive surface.
• offscreen, generate the backup .zip file in a hidden document (technical limitation of Manifest V3 service workers).
• downloads, save the backup .zip to your Downloads folder when you click Save. It is used at that moment only, never runs on its own, and cannot read any file on your computer.
• scripting, carry out the deletion inside the Instagram tab you already have open, at the moment you click Delete. Unsending is a same-origin action: it runs in the page's own context, under the session you are already signed into. The function ships inside the extension, contains no remote code, reads nothing from the page and changes nothing on it.

Authorized hosts: strictly www.instagram.com, its media CDNs (*.cdninstagram.com, *.fbcdn.net, *.fbsbx.com) for the optional backup, and our licensing backend on Cloudflare Workers. No other domain.

11.2 Unsay for Facebook Messenger

• storage, same use as above: quota cache, Pass license state, installation UUID, and the state of a run in progress.
• tabs, read only the active tab's URL on the Messenger interface, to detect which conversation is open.
• cookies, read the c_user cookie on facebook.com and messenger.com to identify your own messages (never anyone else's) and to derive the anonymous user hash described in section 3.4.
• alarms, trigger the periodic license revalidation every 6 hours.
• sidePanel, display the Chrome side panel, Unsay's single interactive surface.
• scripting, run Unsay's own script inside the open conversation, so it can read the messages the page has already loaded and trigger Messenger's own removal action. This is what avoids scraping and auto-scrolling the page.

Authorized hosts: strictly www.facebook.com, www.messenger.com, and our licensing backend on Cloudflare Workers. No media CDN, since this extension has no backup feature. No other domain.

In both cases, license validation happens server-side on our backend, so the extension itself never connects to a payment provider.