Privacy Policy
This page explains what OpenLoop collects, where it is stored, who can see it, and how to get it deleted. It is written in plain English on purpose. If anything is unclear, email support@openloopdm.com.
1. Who we are
OpenLoop is made by CloseLoopDM LLC, a company registered in New Mexico, USA. We also make CloseLoop. When this policy says "we" or "us", it means CloseLoopDM LLC.
2. What OpenLoop is
OpenLoop has two parts:
- A Chrome extension that runs inside your own browser, in your own logged-in Instagram session. It only acts on instagram.com pages.
- A private dashboard (your own server instance) where you choose who to reach out to, what to say, and how fast. The extension asks that server what to do next and reports back what happened.
Each coach gets their own server and their own database. Your data is not mixed with anyone else's.
3. Data about you, the coach
- Email address, used to log in, reset your password and send you service emails.
- Dashboard password, stored as a hash. We never see the password itself.
- Extension key, a secret that lets your extension talk to your server and nobody else's.
- Instagram login state: whether the browser running the extension is logged in to Instagram or not. Never your Instagram password.
- Billing status from our payment processor: which plan you are on and whether it is paid. Card numbers never reach us.
- AI provider key, if you paste one in so OpenLoop can draft messages for you. It is stored on your server and used only to call that provider on your behalf.
- Screenshots of the bot's Instagram window, only when you request one from the dashboard, so you can see what the extension is looking at.
4. Data about the people you reach out to
To do its job, OpenLoop reads Instagram pages your browser can already see and stores what it needs to keep track of who has been contacted:
- Instagram usernames and public profile details (display name, bio, follower and following counts, whether they follow you).
- How they engaged with your account: followed you, liked or commented on a post, viewed a story.
- The messages OpenLoop sent them, and replies it reads from your inbox so it knows a conversation has started.
This is collected only for the audiences you choose to target, from your own account's point of view. OpenLoop does not read private accounts you cannot already see, and it does not collect anything from people outside your chosen audiences.
5. Where the data lives
Everything above is stored on your own server instance, hosted on Railway, in a database that belongs to that instance alone. CloseLoopDM LLC administers the hosting account and can access your instance to provide support, fix problems, and keep the service running. We do not browse your data for any other reason.
The extension itself keeps only two things in your browser's local storage: the address of your dashboard and your extension key.
6. Who else sees it
We never sell your data or the data of the people you message, and we never use it for advertising. It is shared only with the services needed to run OpenLoop:
- Railway, which hosts your server and database.
- Dodo Payments, which handles subscriptions and card payments under its own privacy policy.
- OpenAI or Anthropic, only if you turn on AI drafting. The lead's public profile text and the conversation so far are sent to the provider you chose, using your own API key, under that provider's terms.
- CloseLoop, only if you link the two products. Lead and message data then moves between your OpenLoop and your CloseLoop account, both operated by us, so the reply side knows what the outreach side has sent.
- Instagram, which of course receives the messages, follows and likes you asked OpenLoop to send.
We may also disclose data if the law requires it.
7. The Chrome extension in detail
The extension requests these permissions, and this is what each one is for:
- Access to instagram.com: to open Instagram pages, read them and act on them (send a message, follow, like, view a story). It has no access to any other website.
- Tabs: to open and manage the Instagram window the bot works in, and to take a screenshot of it when you ask for one from the dashboard.
- Scripting: to run its own code on Instagram pages.
- Alarms: to wake up once a minute and ask your server whether there is anything to do.
- Storage: to remember your dashboard address and extension key.
The extension does not track your browsing, does not read other tabs, and does not load code from anywhere except its own package.
8. How long we keep it, and how to delete it
Your data stays on your server for as long as your account is active. When you cancel, we delete your server instance and its database within 30 days. You can ask for deletion sooner, or ask for a copy of your data, by emailing support@openloopdm.com from the address on your account.
Removing the extension from Chrome deletes what it stored in your browser. It does not delete anything on your server; ask us for that.
9. Security
All traffic between the extension, your browser and your server uses HTTPS. Each coach has a separate server, a separate database and a separate extension key. Passwords are hashed. No system is perfectly secure, so keep your password and extension key private and tell us straight away if you think either has leaked.
10. Age
OpenLoop is for business use by adults. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18.
11. Changes to this policy
If we change this policy we will update the date at the top of this page. If the change matters to you, we will also email you before it takes effect.
12. Contact
CloseLoopDM LLC, New Mexico, USA.
Email: support@openloopdm.com