Privacy policy

Last updated October 8, 2026

Crest is a research project run by James Swinehart, an undergraduate at Princeton University, as part of a senior thesis on how AI-generated advice affects Instagram creators' engagement and revenue. This policy explains what Crest collects when you connect your Instagram account, how it is used, and how to have it deleted.

What Crest collects

When you connect a professional Instagram account, Crest uses Instagram's official API to read:

• Your profile: username, account ID, and follower, following, and post counts.
• Your posts: captions, post type, links, and when they were posted.
• Post performance: likes, comment counts, reach, views, saves, shares, and interactions.
• Comments on your posts: the text, the commenter's username, and the time.
• Your direct messages: the text, the sender's username, and the time.

Crest also stores an access token that Instagram issues when you connect. Crest never sees your Instagram password, and never posts, comments, or sends messages on your behalf.

How it is used

• To show you summaries of your performance and audience, content ideas, a posting schedule, and draft posts.
• To measure, for the research study, whether these features change engagement over time.

Research results are reported in aggregate or with identifying details removed. Crest does not sell your data or use it for advertising.

Comments and messages from other people

Comments and messages are written by people other than you. Crest uses them only to analyze your audience for you and for the study. It does not contact those people, build profiles of them, or publish what they wrote in a way that identifies them.

Who processes the data

• Supabase stores the data in a database.
• Vercel hosts the application.
• Anthropic: Crest sends your data to Anthropic's Claude API to generate summaries and suggestions.

These providers process data only to run Crest. Data is not shared with anyone else, except where required by law.

How long it is kept

Crest keeps your data for as long as it is needed for the study and the resulting thesis, and then deletes it. You can ask for it to be deleted sooner at any time.

Disconnecting and deleting your data

• Disconnect: in Instagram, go to Settings → Website permissions → Apps and websites and remove Crest. Crest stops collecting data and discards your access token.
• Delete: email jamesswine@princeton.edu, or request deletion from the same Instagram settings page. Crest then deletes your profile, posts, performance data, comments, and messages.

Taking part in the study is voluntary, and you can withdraw at any time.

Security

Data is encrypted in transit, and the database can only be read by Crest's server.

Contact

James Swinehart · jamesswine@princeton.edu