Privacy Policy

1. Data We Process Locally

When you upload your Instagram data export (ZIP file), all processing happens entirely within your web browser:

• Your followers and following lists
• Account relationships (mutual, non-mutual, etc.)
• Timestamps from Instagram's export

2. Data We Collect

We collect minimal, anonymized analytics to improve the service:

2.1 Analytics (Optional)

We use privacy-friendly analytics services (Vercel Analytics, Umami) that collect:

• Page views and navigation patterns
• Device type and browser (anonymized)
• Geographic region (country-level, not precise location)
• Referral sources

You can disable all analytics by clicking "Don't Track Me" in the footer. Your preference is stored locally and respected immediately.

2.2 Local Storage

We store the following in your browser's local storage:

• Theme preference (dark/light mode)
• Analytics opt-out preference
• UI state (filter selections)
• Pro Export license (su-pro-export) — the license key from your purchase and the activation id returned by Dodo Payments, stored so the export stays available on this device

In the EEA, UK and Switzerland, Google's consent tool additionally stores your advertising consent choice on your device so it does not have to ask again on every visit (see section 5.4).

3. Data We Do NOT Collect

To be absolutely clear, we never collect or have access to:

• Your Instagram username or profile
• Your followers or following lists
• Any content from your Instagram export
• Your email address or personal information
• Your IP address (analytics are anonymized)
• Any data that could identify you personally

This describes what we receive. Loading any page also involves third parties that serve it — our host and our ad provider — which necessarily see your IP address, as any website you visit does. Section 5 lists them.

4. How Your Data is Protected

4.1 Browser Sandboxing

All data processing occurs within your browser's security sandbox. IndexedDB storage is:

• Isolated to this website only
• Inaccessible to other websites or applications
• Encrypted at rest by modern browsers
• Deleted when you clear browser data

4.2 No Server Storage

Our servers only serve static files (HTML, CSS, JavaScript). There is no backend database, no user accounts, and no way for us to store your data even if we wanted to.

4.3 Open Source

Our code is open source under the MIT license. You can audit exactly what the application does at GitHub.

5. Third-Party Services

5.1 Hosting (Vercel)

Our website is hosted on Vercel. They may collect standard web server logs (IP addresses, request timestamps) as part of their infrastructure. See Vercel's Privacy Policy.

5.2 Payments (Dodo Payments)

If you choose to unlock Pro Export, clicking the purchase button redirects you to Dodo Payments, our payment provider (merchant of record), where any payment details you enter are handled entirely by them — we never see or store them. Your Instagram data is not sent anywhere during this: the export file is still generated inside your browser. See Dodo Payments' Privacy Policy.

After a successful payment, Dodo Payments sends you back to this site with your license key, a payment reference and the email address you used at checkout attached to the web address. We remove all of them from the address bar on the first render, so they do not reach your browser history, the referrer sent to other sites, or our analytics. One copy is outside our reach: like every request to this site, that web address is recorded in our hosting provider's short-term request log before any of our code runs. We do not read those logs to identify buyers, and we store your email address nowhere else.

Unlocking the export sends your license key to Dodo Payments' license service (live.dodopayments.com) to activate it on this device. We check it again at most once per browser session, when you open the export dialog; that check also sends the activation id Dodo Payments issued for this device. Nothing else is sent — the response is neither logged nor passed to analytics, and no part of your Instagram data is included in either request.

5.3 External Links

When you click on an Instagram profile, you are redirected to Instagram.com. Instagram's privacy policy applies to any interaction on their platform.

5.4 Advertising (Google AdSense)

This service is free and has no paid tier. Ads from Google AdSense cover its running costs. Google, as a third-party vendor, uses cookies and similar technologies to serve and measure those ads, and receives the data any web request carries — your IP address, browser and the page URL the ad appears on.

AdSense units are not shown on the sample-data page, and there are none on the upload screen. The upload screen does carry one partner link, described in 5.5.

If you are in the EEA, UK or Switzerland, a consent dialog from Google's certified consent management platform appears before personalized ads are served, and your choice is remembered on your device. You can reopen it at any time to change or withdraw consent. Everywhere else, you can turn off ad personalization at My Ad Center. Details of Google's own processing are in How Google uses information from sites that use its services.

5.5 Affiliate Links

Some outbound links on this site are affiliate links, including a partner block on the upload screen and the tool suggestions on the results screen. If you buy something after following one, we may earn a commission at no extra cost to you. Every such link is labelled where it appears.

When you do click, you leave for the partner's site, and from that point their privacy policy applies: like any site you visit, they can see your IP address, your browser, and that you arrived from us, and they may set their own cookies to attribute the referral. On our side we record only that a click happened and which offer it was — no identifier of you, and nothing derived from your Instagram export, which never leaves your browser in the first place.

Which partner offer you see depends on the language you are viewing the site in, because these programmes are not available in every country. We do not claim to use these products ourselves.

5.6 Feedback Form (Tally)

The results screen carries a feedback link. Nothing reaches Tally until the form is opened — the script included: opening it loads Tally's widget, which then receives whatever you type, plus your language, the page you opened it from, and the site version.

Tally uses Cloudflare Turnstile to check that whoever opened the form is not a bot, and Turnstile processes the opener's IP address to do that check.

6. Children's Privacy

This service is not intended for children under 13 years of age. We do not knowingly collect any information from children. Since all data processing is local and we collect no personal information, there is no data to protect or delete.

7. Your Rights

Since we don't collect personal data, traditional data rights (access, deletion, portability) don't apply in the usual sense. However:

• Delete your data: Clear your browser's IndexedDB storage or use the "Clear Data" button in the app
• Opt out of analytics: Click "Don't Track Me" in the footer
• Change your ad consent: Reopen the consent dialog (EEA, UK, Switzerland) or use Google's My Ad Center — see section 5.4
• Audit the code: Review our open-source codebase on GitHub

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, please contact us at: [email protected]