Also, your method will 100% get people blocked. You say it's secret sauce, but you don't seem to take into account that most people here are tech folk. There are only so many ways. I know, and I guarantee it, that you use Instagram's private API by imitating the Android app. This is tripple-wrong. You violate their community terms, you violate reverse-engineering terms and you don't communicate this to your customers.

Anyone who asks for someone else's Instagram credentials automatically is in breach of their terms. So none of our businesses would even be possible. But there clearly is room for interpretation (and I've talked through this with their lawyers, too). But your approach is not where the flexibility is at the moment.

Any social-media agency is asking their clients for credentials. They violate the terms, there is no ifs and buts. Still, this will be fine. Instagram isn't entirely robotic. But you've got to approach it from the right side of things. Use the official unmodified app, use a real phone. That's the minimum. We've been running a business on those (tough) minimum requirements, and service some of the largest brands in the world. They are aware of the risk that anything can happen to their accounts at any time. But our adherence to the crucial parts helps us stay above board.

the power of the Adwords and FB Ads customer base is sometimes overlooked I find. if Instagram stayed independent and had to build their own ad-customer base, would they have been as successful?

This suggests that you're either using people, have found an effective automated method, or have reached agreement with IG.

If the first: how well will that scale with growth? If the second: what happens when the block this current method, or otherwise block your ability to do this because it violates some obscure ToS clause?

If the third: congratulations and best of luck!

But that is the issue, you as a developer and provider may not run afoul of the terms directly, but your users will.

Section 10 in the Basic Terms forbids accessing Instagrams Private API's.

And if that isn't being used and you are a user of Instagram are running afoul of Section 4 of those terms in soliciting, collecting, or using the login credentials of other users. As well as your naming being in conflict with Terms and trademarks.

Unless you're offering the service, through a reminder system with push notifications, you or yoru customer is probably breaking the Terms somewhere. You should probably have a lawyer verify that you're not running straight into a legal mess.