[vintagedave]

Upvoting because you're struggling with a faceless megacorp.

> how we use the username (we save it against a user model in our database)

But what are you doing with that data? If I got that explanation, I'd ask again too. From what you wrote, I have no idea why you use IG, why you even need usernames, and definitely not how they are used after they are saved against other data.

[ryandrake]

Sounds like a good avenue to explore would be: If you did not have this access, how would your product fail to achieve its use cases? If you can answer this, then you can probably provide the information they are asking for.

And NOT the technically correct answer of "The product would fail to use Instagram OAuth to retrieve the username from the authorised user." Think about why the username is needed in the first place.

[stephenbez]

Yeah, at least in this post the OP talks about the technical details, but if they are not explaining what the purpose of the product is, and why users would use it, I could see that getting rejected.

[hipgrave]

Fair point. I didn't want to paste the whole reply because it would be a wall of text but here is my latest desperate attempt for reference. I'm obviously open to any suggestions for edits:

Our app is used to authenticate users—specifically musicians—via the Instagram OAuth flow. We request access only to the instagram_business_basic permission and retrieve minimal public profile data, specifically the Instagram username. This information is used solely to associate an Instagram account with the corresponding user profile in our platform's database for identity verification purposes.

Our role as a Tech Provider is limited to enabling musicians to link their verified Instagram accounts as a form of professional identity on our platform. This helps to ensure authenticity and trust among users, particularly industry professionals engaging with our artist-focused services.

We do not collect, store, or process any private Instagram data. We do not publish content, provide analytics, or perform automated actions on behalf of users. The data retrieved is strictly limited to the public username field and is never shared with third parties.

The user journey is as follows:

1. The user visits [REDACTED] and clicks the Connect Instagram button.

2. They are redirected to the official Instagram OAuth dialog to authorize access to their public profile.

3. Upon successful authentication, they are redirected back to our app, which then makes a request to the Instagram Graph API endpoint https://graph.instagram.com/me using the access token.

4. We extract the username field from the response and associate it with the user’s profile in our database to complete the verification process.

Users have full control over their accounts and data. If a user wishes to remove their account and associated data from our platform, they can follow the instructions provided here: [REDACTED].

This implementation strictly follows Instagram's platform guidelines and privacy principles by minimizing data usage, requiring explicit user authorization, and ensuring transparency and user control.

1. How our business uses Platform Data to enable a product or service for our clients:

[REDACTED] uses Instagram Data to show that content on our platform has been provided by an official source.

More detailed info:

Our platform, [REDACTED], provides a service that allows musicians to authenticate their identity by linking their Instagram accounts. This process utilises the Instagram OAuth flow to obtain the instagram_business_basic permission, specifically retrieving the public Instagram username.

The data retrieved is used exclusively to associate an Instagram account with a user's profile on our platform, facilitating identity verification for musicians. This process ensures that the musicians' profiles are authentic and trusted by users engaging with our services.

Our role as a Tech Provider is to enable musicians to link their verified Instagram accounts as a form of professional identity on our platform. This helps to ensure authenticity and trust among users.

2. How our clients use our product or service:

Our clients are musicians with published music releases that the [REDACTED] service ties to additional content uploaded via our platform, including sleeve art image files, appropriate links and other contextual content. Our clients then share their profile and content with their fan base communities on social media, for users to experience an enhanced music release experience.

More detailed info:

Our clients are musicians who utilise our platform to manage their professional presence. By linking their verified Instagram accounts, they can:

Enhance their profile's credibility and visibility to industry professionals.

Provide a verified link to their public Instagram profile, showcasing their work and engagement with their audience.

Utilise our platform's features to manage their professional identity and interactions within the music industry.

This integration allows musicians to maintain a consistent and verified online presence, fostering trust and recognition within the industry.

Additional Information:

Data Handling: We do not collect, store, or process any private Instagram data. The data retrieved is strictly limited to the public username field and is never shared with third parties.

User Control: Users have full control over their accounts and data. If a user wishes to remove their account and associated data from our platform, they can follow the instructions provided here: Delete your artist account.

Compliance: This implementation strictly follows Instagram's platform guidelines and privacy principles by minimizing data usage, requiring explicit user authorization, and ensuring transparency and user control.

[vintagedave]

Thanks, that is a thorough reply.

> enabling musicians to link their verified Instagram accounts as a form of professional identity on our platform. This helps to ensure authenticity and trust among users, particularly industry professionals engaging with our artist-focused services.

This seems the key bit to me. Maybe make it more obvious? Move to the top? Note that IG is used by many musicians and so why IG specifically, ie, really develop the last part of the last sentence?

That Additional Information is also really key, yet is at the bottom. I'd suggest making it really clear at the top: key info, key reassurances, then get into details.

(As a side note, is the IG username the right field to save? I think people can change usernames, can't they? So an ID is better?)