Security
How Unreeled keeps your account private
Unreeled is open source, so nobody has to take its privacy on trust. This page says what happens to your Instagram login, what the app downloads, and how notifications pass through a relay that can't read them. The video says the same in under two minutes.
The short version
- Your login stays on your phone. You log in on Instagram's own page, and Unreeled never reads or stores your password.
- No server of ours is in between. What you see and send goes straight between your phone and Instagram.
- Nothing is collected. No analytics, no tracking, no ads, no third-party code.
- The one download is signed. The app uses a list of Instagram's request IDs only if the project signed it.
- Notifications are optional, and only your phone can read them. They pass through a relay that never has the key.
- It's all in the open. The app and the relay are on GitHub for anyone to check.
The app
You log in on Instagram's own page
Logging in happens on Instagram's own login page, shown inside the app. Unreeled never reads or stores your password.
Your login stays on your phone
Instagram's cookies stay on your phone, in the app's own web data store, which is left out of the phone's backups. The session values the website provides are kept in the phone's Keychain, on this device only. If the app's data reaches another phone anyway, restored from a backup or copied, the app there starts logged out, with nothing of your account.
Your phone talks straight to Instagram
Feeds, stories, messages, profiles and activity come straight from Instagram's servers to your phone. Messages, photos, videos, likes and replies you send go straight from your phone to Instagram. None of it passes through any server of ours.
Pictures and videos load only from Instagram's own servers for them, never from an address someone put in a message.
It collects nothing
Unreeled has no accounts of its own, no analytics, no crash reporting, no advertising and no tracking, and the app contains no third-party code.
The one download is signed
Instagram changes the IDs of the requests its website makes from time to time. To keep working, the app downloads the project's current list of those IDs from unreeled.app, or from GitHub if that fails.
The list comes with a signature, and the app uses a list only if one of the keys built into the app signed it. So neither this website nor GitHub can change which requests the app sends, and an older list can't be served again. How the app checks it.
The download carries nothing about you or your account. Like any web request, it reaches the server with your IP address and the app's version; we don't log these requests or use them to identify anyone.
Logging out deletes it
Logging out asks Instagram to end the session, as the website's Log Out does, then deletes from your phone Instagram's cookies, the session values, everything the app saved (screens, conversations, pictures, stories) and the voice messages you recorded. The same happens when the login ends any other way.
Notifications
Notifications are off unless you turn them on, and only some builds of Unreeled offer them. They're the one thing that passes through a server of the project's: a relay. Here is why it can't read them.
The private key never leaves your phone
When you turn notifications on, your phone makes a pair of keys and a secret, and keeps them in its Keychain, on this device only.
Instagram encrypts each notification for your phone
Your phone gives Instagram a push address and the public key, from your own login, as a browser does when you allow notifications on instagram.com. Instagram then encrypts each notification for your phone and sends it to that address.
Three stops on the way, none with the key
The address belongs to Mozilla's push service, which hands the encrypted notification to Unreeled's relay, which passes it to Apple's push service, which delivers it to your phone. None of the three can read it. Your phone decrypts it and shows it.
What the relay knows
It keeps
- A random ID for your phone
- Your phone's address at Apple's push service
- The push address
- When your phone was last seen
It sees
- When a notification passes
- How large it is
It never has
- The keys
- Your login
- What a notification says
- Which Instagram account it's for
Only whoever runs the relay can see those counts and times, and it logs nothing from a notification. The app contacts the relay when you turn notifications on or off, and at most once a day when you open the app, to keep the address current. Like any web request, this reaches the relay with your IP address; we don't log these requests or use them to identify anyone.
Turning them off
Turning notifications off, or logging out, deletes the keys from your phone and the relay's record of it. If you delete the app instead, the relay drops the record the first time Apple reports the app gone, or after 30 days without a sign of your phone.
Who runs what
The relay runs on Cloudflare. Mozilla, Apple and Cloudflare handle the encrypted notifications under their own privacy policies. If you built Unreeled yourself, the relay is the one your build was made with, run by whoever runs it.
The privacy policy has all of this in full.
Check it yourself
Unreeled is free software under the GNU General Public License, version 3. Everything described here is in its repository:
- How the app works: the requests it sends, and how the query list is checked.
- How notifications work: the keys, the encryption, and what's been tried.
- The relay, as a Node program and as a Cloudflare Worker.
- The privacy policy.
Found a security problem? Please write to hello@unreeled.app.
One caution
Unreeled isn't made or endorsed by Instagram or Meta. Instagram doesn't approve apps like this one, and it could restrict or disable an account that uses it. Use it at your own risk.
Questions
Can Unreeled see my Instagram password?
No. You log in on Instagram's own login page, shown inside the app, and Unreeled never reads or stores your password.
Can the notification relay read my messages?
No. Instagram encrypts each notification for a key that never leaves your phone. The relay passes the encrypted notification on; it sees when one passes and how large it is, never what it says or which account it's for.
Does Unreeled collect any data?
No, unless you turn notifications on; then only what the relay keeps: a random ID for your phone, its address at Apple's push service, the push address, and when it was last seen.
Is Unreeled safe to use?
Your account goes only between your phone and Instagram, as this page describes. The risk is to the account itself: Instagram doesn't approve apps like this one, and it could restrict or disable an account that uses it.
The video was made with free software, from files in the repository: its voice is Kokoro, an open text-to-speech model, and its pictures and sounds are drawn by a script.