Open-source Instagram analytics that remember
Connect your accounts. Record the trend. Understand what works. Decide what to post next.
Your data stays in your own database. Next: an optional AI strategist, with you in control.
User manual · How it works · Security · Roadmap · Contributing
The account overview (dark theme), running on real data, with the account names replaced. Tabs: Overview, Growth, Posts, Stories, Content, Comments, Moderation, Followers.
What it is
in2Sight is a self-hosted dashboard that pulls your Instagram insights through Meta's official API and keeps them. Instagram's own Insights forgets: account-level numbers reach back only about 90 days and Stories vanish after 24 hours. in2Sight records continuously (Stories every 30 minutes, everything else daily) into a database you own, so the history, and what you can learn from it, grows every day.
Who it is for: creators and small brands who run one or more Instagram accounts and want to answer "what is working, what changed, and what should I post next" without screenshots and spreadsheets. Where it stands: a working prototype used on two real accounts, one owner per deployment, built openly. See Project status for the honest list of what is and is not verified.
✨ What works today
🔌 Connect and record
Connect Instagram Creator or Business accounts through Instagram's own login. A scheduled sync stores follower and reach history, every post's metrics over time, Story metrics while a Story is live, audience demographics and covers. A new account fills newest-first: useful within minutes.
One failing account never stops the others. Tokens renew themselves.
📈 Trends and analysis
A shared time range with compare-to-previous, a Growth tab with a stated-method projection and "why did this change?", a Content lab (leaderboards, formats and times, hashtags, cadence), a per-post scorecard against your own history, tags, a calendar and a free-form Explorer.
Every analysis states its sample size and confidence. A missing number is never shown as zero.
💬 Decide and follow through
Comments: unanswered questions, top fans, topics. Optional moderation (reply, hide, delete, banned-word rules), always confirmed and logged. Alerts and Web Push (installable PWA). Excel and PDF reports.
Export or delete everything from Settings. English and 简体中文, light and dark themes, phone to desktop.
🧭 How it works
You run your own copy. A scheduler wakes the sync every 30 minutes; the sync reads Instagram through Meta's official API and writes to your database; the app reads it back under row-level security.
flowchart LR
subgraph META["Instagram / Meta"]
API["Instagram API<br/>with Instagram Login"]
end
subgraph HOST["Your deployment (Vercel)"]
CRON["Scheduler<br/>every 30 min"] -- "secret header" --> TICK["/api/cron/tick"]
TICK --> SYNC["Sync engine<br/>one account fails,<br/>the rest continue"]
WEB["Next.js app<br/>dashboards, analysis,<br/>exports, alerts"]
end
subgraph SUPA["Your Supabase project"]
DB[("Postgres<br/>row-level security,<br/>owner only")]
ST[("Storage<br/>cover images")]
end
SYNC -- "read insights" --> API
SYNC -- "upsert snapshots" --> DB
SYNC --> ST
WEB -- "owner session" --> DB
YOU(("You")) -- "password + 2FA" --> WEB
YOU -. "connect an account" .-> API
Stack: Next.js 16 (App Router, TypeScript strict) on Vercel · Supabase (Postgres, Auth, Storage) · Tailwind + shadcn/Radix · Recharts · next-intl · Vitest. Small on purpose: plain fetch for the Meta API, analysis as pure unit-tested functions in lib/analysis/, every database change a SQL migration in supabase/migrations/.
🔒 Security and compliance
in2Sight handles Instagram tokens and other people's names and comments, so security is a feature, not an afterthought. The full write-up is SECURITY.md; the summary:
| Layer | What is in place |
|---|
| Access | One owner per deployment · sign-ups off · TOTP two-factor enforced by the database (a password-only session reads nothing) · exact public-route allow-list · every page, route and action re-checks the owner |
| Data | Row-level security on every table · private cover storage · export and delete-all with password re-check and typed confirmation · third-party data excluded from exports unless you opt in |
| Secrets | Instagram tokens readable only by the server's service role · no secrets in the browser · no secret logging · cron and Meta callbacks authenticated (constant-time secret, HMAC-signed requests, OAuth state) |
| Writes to Instagram | Confirmed, logged, reversible where possible · auto-hide off by default |
| Verification | 3,000+ automated tests including guard tests for the rules above (run on every push by CI) · AI-assisted security review of each sensitive feature (no Critical findings open) · a live-verification runbook per feature |
Compliance posture, honestly:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
