Privacy Policy

WhoUnfollowed (“the Service,” “we,” “us”) provides a tool that allows users to analyse their own Instagram data exports to identify follower and following relationships. The Service operates exclusively by processing data files that users have lawfully obtained directly from Instagram via Instagram's official data export feature, as permitted under applicable data protection legislation including GDPR Article 20 (Right to Data Portability).

Our processing relies on the following legal bases:

• Legitimate interest: Providing the analytical service you have explicitly requested.
• GDPR Article 20: Supporting your right to receive and reuse your own personal data from a controller, in a structured, commonly used, and machine-readable format.
• Performance of contract: Providing the features of the Pro tier to paying subscribers.

When you use WhoUnfollowed, the data you provide (your Instagram export ZIP file) is processed exclusively within your own browser using client-side JavaScript. No file contents, follower lists, usernames, or any portion of the data export are transmitted to our servers at any time during the analysis process.

If you elect to save snapshots using the Free tier, those snapshots are stored exclusively in your browser's local IndexedDB storage on your device. We have no access to this data.

Users who create a Pro account provide an email address and password. Passwords are hashed using argon2id and are never stored in plaintext. Snapshot data uploaded for cloud sync is encrypted client-side before transmission using a key derived from the user's password. This key is never stored on our servers, and we are technically unable to decrypt user snapshot data.

Pro account data is stored on infrastructure located within the European Union (Germany), and processing is governed by GDPR. The Pro tier is not yet active. During the beta period, all users receive Pro features at no charge and no payment data is collected or stored.

WhoUnfollowed does not interact with Instagram's servers, APIs, or infrastructure in any way. The Service does not use Instagram's Graph API or any other Instagram or Meta API. Users obtain their own data directly from Instagram pursuant to Instagram's “Download Your Information” feature, which Instagram provides in compliance with GDPR Article 20.

WhoUnfollowed does not facilitate any action that violates Instagram's Terms of Service. The Service does not automate any interactions with Instagram, does not scrape Instagram, and does not perform any action on behalf of users within the Instagram platform.

We may use self-hosted Plausible Analytics to collect aggregate, anonymised page view statistics. Plausible Analytics does not use cookies, does not collect personal data, and does not track users across websites. No personally identifiable information is collected. Full details are available at plausible.io/data-policy.

Free tier: All data is stored exclusively in your browser's local storage (IndexedDB). We hold no copy of this data. Clearing your browser's site data permanently removes all locally stored snapshots.

Pro tier: Encrypted account data is retained for the duration of the account. You may request complete account deletion at any time via your account settings. Deletion is processed immediately and is irreversible.

If you are located in the European Economic Area, you have the following rights regarding any personal data we process:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)

As the Free tier processes no personal data on our servers, most rights are not practically applicable. Pro users may exercise all rights by contacting us at the address below.

WhoUnfollowed is provided “as is” without warranty of any kind, express or implied. We are not responsible for any actions taken by users based on results produced by the Service. Users are solely responsible for how they use the information provided and for compliance with any applicable platform terms of service, including those of Instagram and Meta Platforms, Inc.

We may update this Privacy Policy from time to time. Material changes will be communicated via the changelog. Continued use of the Service after changes constitutes acceptance of the updated policy.

Data protection enquiries and rights requests:
aekilicc@gmail.com

WhoUnfollowed · Independent · Not affiliated with Instagram or Meta Platforms, Inc.