Privacy & Security

Thread Vault CLI was built with privacy as a primary design constraint. This page documents exactly what data is stored, where, and when it is deleted.

Core Privacy Guarantees

🏠

100% Local Storage

All scraped data is stored in data/vault.db on your local machine. No data leaves your device during scraping or unsending operations — only direct API calls to Instagram.

🧹

Zero Persistence Policy

All scraped message rows, pagination cursors, session credentials, and thread cache are deleted automatically upon logout or Scrape Dashboard exit. This is a hard-coded behavior, not a setting.

🚫

No Telemetry

Thread Vault CLI contains zero analytics, telemetry, tracking pixels, or error reporting calls. The only outbound HTTP requests are to www.instagram.com — verifiable in app/core/http.py.

🔑

No Password Handling

Thread Vault never asks for, intercepts, or stores your Instagram password. Login happens in a standard Chromium browser window pointed at instagram.com/accounts/login/ — identical to logging in normally.

📖

Open Source — Auditable

Thread Vault is MIT-licensed open source. Every line of code is available for review in the repository. You can verify exactly what data is stored, what network requests are made, and how the purge lifecycle works.

🔒

Atomic File I/O

Session credentials are written atomically via temp-file swap in app/core/cache.py. This prevents partial writes that could expose truncated credential data if the process is killed mid-write.

What Is Stored On Disk

FILE INVENTORY
cache/session.json — Created on login, deleted on
              logout
            {
            "session_id": "...", // Instagram sessionid cookie
            "csrf_token": "...", // csrftoken cookie
            "user_pk": "...", // Numeric user ID
            "username": "..." // Display username
            }

            cache/inbox_cache.json — Thread directory listing, deleted on logout
            [{ "thread_id": "...", "thread_title": "...", "users": [...], ... }]

            data/vault.db — SQLite database
             threads table — Persists between sessions (no message content)
             scraped_messages — Deleted on dashboard exit
             scrape_progress — Deleted on dashboard exit
             unsend_progress — Deleted on dashboard exit
          

Network Requests Made

Thread Vault makes outbound requests exclusively to www.instagram.com. Here is the complete list of endpoints used:

ENDPOINTS — app/core/auth.py + pipeline.py
# Session validation (startup probe)
            GET https://www.instagram.com/api/v1/direct_v2/inbox/?limit=1

            # Thread directory (Explorer screen)
            GET https://www.instagram.com/api/v1/direct_v2/inbox/?...

            # Thread message scraping
            GET https://www.instagram.com/api/v1/direct_v2/threads/{thread_id}/?cursor=...

            # Message unsend
            POST https://www.instagram.com/api/v1/direct_v2/threads/{thread_id}/items/{item_id}/delete/

            # Browser login (Playwright — navigates to standard login page)
            GET https://www.instagram.com/accounts/login/
          

Best Practices

Run on your own machine only

Do not run Thread Vault CLI on shared or untrusted computers. The session file at cache/session.json grants full Instagram access to whoever can read it.

Restrict file permissions on sensitive files

On Linux/macOS, restrict the cache directory: chmod 700 cache/. This prevents other system users from reading your session file.

Use Browser Login on shared networks

Avoid pasting your Session ID in environments where screen content may be recorded (e.g., screen sharing, remote desktop). Browser Login doesn't expose the cookie visually.

Export data before exiting if needed

Remember that all scraped data is permanently deleted on dashboard exit. If you need records, export from SQLite using the CLI commands in the Usage Guide before closing the session.

Review the source code before use

Thread Vault is open source. Review app/core/http.py to audit network calls, app/core/cache.py for credential storage, and app/core/db.py for the purge lifecycle before trusting any CLI tool with your account session.

⚖️

Disclaimer: Thread Vault CLI is provided as-is under the MIT License. Using automated tools to interact with Instagram may violate Instagram's Terms of Service. Users are responsible for their own use. Review Instagram's Terms before proceeding.