Privacy Policy
Bitmap Coders LLC · 4730 S. Fort Apache Rd, Las Vegas, NV 89147-7947, USA
1. Who operates Pullgrab
Pullgrab is operated by the company named above. This policy explains what we process when you visit pullgrab.com or use the download tool, and why.
2. No account, no Instagram credentials
Pullgrab does not require you to create an account to download public content, and it never asks for, receives or stores your Instagram username or password. What you can download is exactly what Instagram already shows to the public, nothing more.
3. What we process to run an extraction
When you submit a link, Pullgrab reads the Instagram URL you pasted and, if it matches a public post, sends only that URL to Apify, our extraction provider, to fetch the public content. Apify processes it under its own privacy policy; we do not send Apify your IP address, browser information or any other visitor data. The retrieved video or photo is streamed straight to your browser through a temporary, signed link and is never written to a Pullgrab disk. Section 4 describes the one deliberate exception to this, for Pro subscribers only.
4. Profile export files (Pro)
Pullgrab Pro subscribers can request a ZIP export of a public profile's recent posts. Building that ZIP is the one exception to section 3: while an export job runs, Pullgrab temporarily writes the requested media to its own server so it can be packaged into a single file. The finished ZIP is stored only long enough for you to download it, shown as a countdown on the Account page, after which it is automatically and permanently deleted whether or not you downloaded it. We email a signed, time-limited download link to the address you signed in with; anyone who has that exact link before it expires or the file is deleted can use it, so treat it like any other download link. We keep a record of which signed-in email requested which username and when, to enforce your monthly export quota and to show your export history on the Account page; that record is deleted along with the file.
5. Caching
To avoid asking Instagram for the same public post twice in a short time, the result of a successful extraction is kept in a local cache for 30 minutes, and a failed or unavailable link is remembered for 5 minutes so we do not retry it uselessly. Both expire automatically. The cache holds only the extraction result (author, caption, media links), never your IP address or any identifier of who requested it.
6. Security and abuse prevention
Your IP address is used in memory, for up to 24 hours, to apply per-visitor rate limits and stop abuse; it is never written to our database. Our web server keeps a standard connection log (IP address, timestamp, requested page, user agent) for 14 days for security and troubleshooting, then deletes it automatically. Cloudflare, our network and security provider, processes connection metadata under its own privacy policy to protect the Service from attacks and to run the Turnstile verification challenge you may occasionally see.
7. Analytics
Pullgrab records anonymous, aggregate usage events on its own server: which page was viewed, its language, the visiting country derived from Cloudflare's network-level geolocation, the type of content requested, whether an extraction succeeded, and how long it took. These events never include the submitted link, your IP address, or any other identifier that could tie an event back to you; there is no cross-site tracking and no advertising identifier involved. We use this only to keep the Service reliable and to understand which languages and content types matter.
8. Cookies and similar technologies
Pullgrab does not set cookies of its own and does not use cookie-based or fingerprint-based tracking for advertising. If you sign in as a Pro subscriber, we set one strictly necessary session cookie so the Service remembers you are signed in; it is not used for tracking or advertising. Cloudflare and Cloudflare Turnstile may set small technical cookies required to deliver the page securely and verify that you are not a bot; see our Cookie Policy for details. If you dismiss the ad-blocker notice, your browser remembers that choice for 7 days using local storage on your own device; this is never sent to us.
9. Advertising
Pullgrab does not currently run advertising. If we enable advertising in the future, this policy, the Cookie Policy and the Privacy Choices page will be updated first, and a consent request will be shown where the law requires it before any advertising technology loads.
10. Sub-processors
We share data only with the service providers needed to run Pullgrab: Cloudflare (network, security and Turnstile), our extraction provider Apify, our payment processor Stripe for Pro subscriptions, InterServer (our hosting provider), and Cloudflare Email Routing together with our mailbox provider for messages sent to our contact addresses and for export-ready and login-link emails. The full list, with purpose and the date we last checked it, is on the Sub-processors page.
11. International transfers
Pullgrab is operated from the United States, and its infrastructure providers may process data in the United States and other countries where they operate. Where required, transfers rely on the safeguards those providers publish in their own privacy policies.
12. Your rights
Wherever you are, you can ask us what data we hold about you, ask us to correct or delete it, or object to how we use it, by writing to [email protected]. If you are in the European Economic Area, the United Kingdom or Switzerland, these are your GDPR rights of access, rectification, erasure, restriction, portability and objection, and you may also lodge a complaint with your local data protection authority. If you are a Nevada or California resident, you have rights under Nevada NRS 603A and, where applicable, the California Consumer Privacy Act as amended by the CPRA, including the right to know, delete and opt out of the sale or sharing of personal information. Pullgrab does not sell or share personal information, so there is nothing to opt out of today; our Privacy Choices page will be updated if that ever changes.
13. Children
Pullgrab is not directed at children. You must be at least 13 to use it, or 16 if you are in the European Economic Area, the United Kingdom or Switzerland. We do not knowingly collect data from anyone younger, and we do not build advertising profiles about anyone.
14. Changes to this policy
We will update the version number and effective date at the top of this page whenever we make a material change, and, where required, we will ask again for your consent.
15. Contact
Questions or requests about this policy can be sent to [email protected].