Privacy Policy

WhoUnfollowed (“the Service,” “we,” “us”) provides a tool that allows users to analyse their own Instagram data exports to identify follower and following relationships. The Service operates exclusively by processing data files that users have lawfully obtained directly from Instagram via Instagram's official data export feature, as permitted under applicable data protection legislation including GDPR Article 20 (Right to Data Portability).

Our processing relies on the following legal bases:

• Legitimate interest: Providing the analytical service you have explicitly requested.
• GDPR Article 20: Supporting your right to receive and reuse your own personal data from a controller, in a structured, commonly used, and machine-readable format.
• Performance of contract: Providing the features of the Pro tier to paying subscribers.

When you use WhoUnfollowed, the data you provide (your Instagram export ZIP file) is processed exclusively within your own browser using client-side JavaScript. No file contents, follower lists, usernames, or any portion of the data export are transmitted to our servers at any time during the analysis process.

If you elect to save snapshots using the Free tier, those snapshots are stored exclusively in your browser's local IndexedDB storage on your device. We have no access to this data.

Users who create a Pro account provide an email address and password. Passwords are hashed using argon2id and are never stored in plaintext. Snapshot data uploaded for cloud sync is encrypted client-side before transmission using a key derived from the user's password. This key is never stored on our servers, and we are technically unable to decrypt user snapshot data.

Pro account data is stored on infrastructure located within the European Union (Germany), and processing is governed by GDPR.

Payments for the Pro subscription are handled by Stripe, our payment processor. You enter your card details directly with Stripe. Your full card number never reaches our servers, and we do not store it. We retain only a Stripe customer and subscription reference, your current subscription status, and the email address on your account, which is the minimum needed to manage billing. Stripe processes your payment information under its own privacy policy and is PCI-DSS compliant.

WhoUnfollowed does not interact with Instagram's servers, APIs, or infrastructure in any way. The Service does not use Instagram's Graph API or any other Instagram or Meta API. Users obtain their own data directly from Instagram pursuant to Instagram's “Download Your Information” feature, which Instagram provides in compliance with GDPR Article 20.

WhoUnfollowed does not facilitate any action that violates Instagram's Terms of Service. The Service does not automate any interactions with Instagram, does not scrape Instagram, and does not perform any action on behalf of users within the Instagram platform.

We use Umami, a privacy-friendly analytics tool we host ourselves on our own EU servers. It is cookieless, does not track you across other websites, and the data never leaves our infrastructure. We collect aggregate page views and anonymous product events (for example, which buttons get clicked) to understand how the app is used.

We also use Umami's session recording for aggregate heatmaps and anonymised replays of on-site interactions, which helps us improve the interface. Form inputs such as passwords and email addresses are masked and are never recorded. Your uploaded Instagram data is processed entirely in your browser and is never part of any recording. Everything runs on our own self-hosted infrastructure, with no third parties involved.

Free tier: All data is stored exclusively in your browser's local storage (IndexedDB). We hold no copy of this data. Clearing your browser's site data permanently removes all locally stored snapshots.

Pro tier: Encrypted account data is retained for the duration of the account. You may request complete account deletion at any time via your account settings. Deletion is processed immediately and is irreversible.

If you are located in the European Economic Area, you have the following rights regarding any personal data we process:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)

As the Free tier processes no personal data on our servers, most rights are not practically applicable. Pro users may exercise all rights by contacting us at the address below.

WhoUnfollowed is provided “as is” without warranty of any kind, express or implied. We are not responsible for any actions taken by users based on results produced by the Service. Users are solely responsible for how they use the information provided and for compliance with any applicable platform terms of service, including those of Instagram and Meta Platforms, Inc.

We may update this Privacy Policy from time to time. Material changes will be communicated via the changelog. Continued use of the Service after changes constitutes acceptance of the updated policy.

Data protection enquiries and rights requests:
hello@whounfollowed.co

WhoUnfollowed · Not affiliated with Instagram or Meta Platforms, Inc.