Privacy Policy

• We only use information that Instagram makes public, and we never ask for your Instagram password.
• We do not sell personal information or show ads. We use self-hosted OpenPanel for website and product analytics.
• Card details are handled by our payment providers, Stripe and Waffo Pancake, and never reach our servers.
• You can ask us to delete your account at any time, and anyone can remove their Instagram account from Instoryview on the removal page.

The operators of Instoryview (“we”) are responsible for the personal information described in this policy. You can reach us at support@instoryview.com.

If you have an account:

• Account details — your email address. If you sign in with Google, Google also shares your name and profile picture; they are stored with your sign-in record, but we do not use them.
• What you do on Instoryview — the accounts you track and their settings, your credit balance and how your credits were spent, and the scans run for you.
• Lookup records — when you are signed in and a lookup needs a fresh request for data, we record which Instagram account it was for together with your user ID. We use this for billing and to stop abuse, and delete it after 90 days. Your list of recent searches is kept only in your browser.
• Plan and payment records — your plan and its status, the email address you paid with, and the payment details your payment provider (Stripe, or Waffo) sends us: amounts, tax, currency and possibly the card brand and last four digits. The name, address and tax ID you enter at Stripe’s checkout stay with Stripe; we do not keep them. We never receive or store full card numbers.
• Signals that protect free credits — to keep free credit allowances to one per person, we record a device ID, a browser fingerprint, your IP address and network, and a normalised form of your email address when you sign in. We keep them only as keyed hashes (HMAC), not in readable form, and never for private or local network addresses.
• Affiliate program — if you join: your payout email (PayPal), the referrals and commissions credited to you, and your payouts.

If you use Instoryview without an account, we keep a salted hash of your IP address (or of your IPv6 /64 network) to count your one-off free credits and to limit the rate of requests. The rate-limit data is kept for about a day; the count of free credits you have used is kept for up to five years, so the allowance cannot be claimed again, and is not linked to anything else about you.

We do not collect your Instagram password, and we never access your Instagram account.

Website analytics. Our own OpenPanel server receives page routes, referring domains and campaign tags, device/browser and approximate location, interactions, timing and error categories. Signed-in usage can be linked to your internal account ID. Verified payments provide revenue totals and transaction references. We do not send searched Instagram usernames, form contents, emails, authentication tokens or payment card information to analytics.

Session replays. For visits where usage analytics is on, the same server keeps a replay of the pages you use — their layout, which pages you open, and where you move, click and scroll — so we can see where Instoryview is hard to use. It is masked in your browser before it is sent: every piece of text except our own interface copy is replaced by asterisks, and what you type, search results, Instagram content, pictures, video and your email address are never recorded; our server masks it again before storing it. Signed in, a replay belongs to the same visit as the rest of your usage, so it is linked to your internal account ID. Replays are kept for 30 days, then deleted.

Customer support. When you open chat, our self-hosted Chatwoot service stores your messages, attachments you choose to send, chat session identifiers and technical browser information. If signed in, your verified account ID and email are linked to the conversation. Our AI assistant uses recent messages and, only for account-specific questions from a verified session, a limited account summary (plan, credits and tracking status). You can request a human at any time.

Instoryview shows what Instagram makes public about public accounts. The people behind those accounts are usually not our users, so this is what we keep about them:

We obtain this information through HikerAPI, a third-party data service. We do not provide access to private account content. The available information can be incomplete or outdated.

• Profile details of accounts that are looked up — username, name, bio, profile picture link, follower, following and post counts, and whether the account is private or verified. For accounts someone tracks, we also keep a small copy of the profile picture.
• Following and follower lists of tracked accounts, stored as snapshots of account IDs, and the changes we detect between them, each with the time we detected it. Accounts that appear in those lists are stored with their username, name and profile picture link.
• Stories, highlights, posts, comments and the lists of who liked a post are not stored in our database. They are held in a short-term cache for a few minutes to a day, and images and videos pass through our servers, so Instagram never sees our visitors’ IP addresses.

We process this information on the basis of our legitimate interest, and our users’ interest, in viewing and researching public accounts. If you own one of these accounts, you can remove it on the removal page: we delete what we store about it and stop it from being looked up or tracked again.

• To provide the service: signing you in, running lookups and scans, showing changes, and keeping your credits and plan in order (performance of our contract with you).
• To prevent abuse and keep the service secure, including one signup credit grant per person and rate limits (legitimate interests).
• To bill you and meet tax and accounting obligations, together with our payment providers, Stripe and Waffo (contract and legal obligation).
• To answer your messages and requests, and to tell you about important changes to the service or our policies (contract and legitimate interests).
• To understand our costs and fix problems, using records of the requests we make (legitimate interests).
• To email you when automatic tracking has stopped because your credits ran out, or when your credits are already too low to cover the next scan: at most two emails each time, never more than one a week, and only to free-plan accounts that have reminders switched on. Every such email has an unsubscribe link, and there is a switch in Settings. We keep a do-not-email list of addresses the email service rejects for good (legitimate interests).
• On a paid plan, to email you when changes are detected on the accounts you track: at most one email a day, naming only the accounts you track and how many changes of each kind — never the people in their lists. Every such email has an unsubscribe link, and there is a switch in Settings (performance of our contract with you).
• On a paid plan, to have an AI model write a short summary of a change overview when you open it. We send the model only that overview’s numbers (counts, how many changes, how many scans) and stand-ins such as “p1” for the people involved — never a username, your email or anything else about you. The summary is checked against those numbers before you see it and kept for 30 days so the same overview is not summarized twice (performance of our contract with you).
• On a paid plan, to answer the questions you ask Ask AI about the accounts you track. We send the AI model your question, with every username in it replaced by a stand-in such as “p1”, and the numbers it needs from your saved scans — never a username, your email or anything else about you. Each answer is checked against those numbers before you see it; you can tell us when an answer is wrong (performance of our contract with you).

We do not use your information for advertising, and we do not sell or rent it. The only automated decision we make about you is whether an account qualifies for signup credits; if you think we got it wrong, write to us and a person will review it.

We use no advertising or analytics cookies. We use:

• Sign-in cookies (sb-…-auth-token), which keep you signed in.
• isv_did and isv_fp, a random device ID and a hashed browser fingerprint set when you sign in. They are used only to keep signup credits and daily credits to one per person, and last up to 400 days.
• isv_ref, set only when you arrive through an affiliate link so the referral can be credited. It lasts 60 days.
• NEXT_LOCALE, which remembers a language other than English if you choose one.

Your browser’s local storage keeps your last few searches, a copy of the device ID and your preference for scan confirmations. Apart from the device ID, none of it is sent to us. While usage analytics is on, your browser’s session storage also remembers, for the open tab only, whether this visit is one we keep a replay of (isv_replay).

OpenPanel usage analytics does not set an analytics cookie. Your browser stores your analytics opt-out preference (isv_analytics_optout) in local storage and a preference cookie for up to one year. You can turn usage analytics off below, which also stops session replays; browser Do Not Track and Global Privacy Control signals also turn both off. Operational billing records remain necessary for your purchase.

Opening support chat creates Chatwoot session cookies and local storage to keep your conversation available. The chat service is not loaded before you open it. Signing out resets the chat identity on that browser.

The Instoryview app for iPhone and Android uses the same account and service as the website. On your phone it keeps your sign-in session, your recent searches, the account you were about to track while you sign in, and a few preferences, such as the language and your choice about scan confirmations. If you turn on the daily digest, it keeps the phone’s push token and the account it was registered for. It also keeps a random device ID in the phone’s secure storage; on an iPhone this ID can remain after the app is deleted and installed again. When you are signed in, the app sends the sign-in session with its requests to show that it is you. With each request to us, signed in or not, it also sends the device ID and a fingerprint: a hash, made on the phone, of its platform, model, system version, screen size, time zone and languages; pictures and videos are loaded without them. Your recent searches and preferences stay on the phone; the one exception is the app’s language, which is sent to us with the push token if you turn on the daily digest (see below). We use the device ID and fingerprint only when you ask for a sign-in email (to check a new sign-up against our blocklist), in the check that runs after you sign in and each time the app starts while you are signed in, and when you claim daily credits. As on the website, we keep them only as keyed hashes, together with your IP address and network, to keep free credits to one per person (see “What we collect about you”). The app contains no advertising or analytics SDK.

Daily digest. The app can send you one notification a day about the accounts you track. It is off until you turn it on. For the digest, we store:

• the time you choose and your phone’s time zone (for example Europe/Berlin), so the digest arrives at your local time. The app sends the time zone only while the digest is on: when you turn it on, when you change its time, and when you open the app in another time zone;
• for each of your phones registered for it, a push token — an address Expo issues for the app on that phone, based on the phone’s Apple or Google push address, so that notifications can reach it — with the phone’s platform (iOS or Android), the app’s language, the app’s version, and when the phone was first and last registered;
• a record of each day’s digest: the day it was for, when it was sent, the period it covered, how many changes, tracked accounts and phones it counted, whether the push service accepted it for each phone, and the delivery IDs the push service returned. It never contains Instagram usernames or account IDs.

Once a day, at your chosen time, we look at the changes we have already detected on the accounts you track since the previous digest, or since you last turned the digest on if that was later, leaving out those you have already seen by opening that account’s timeline. If there are any, we send one notification to each of your registered phones. It names up to 2 of those accounts and says how many other accounts had changes and how many changes were detected. On days without such changes, we send nothing. If a digest is skipped because our service was down at its time, or sending it fails on every one of your phones, its changes are included in the next digest. The digest does not run scans, makes no requests to Instagram and does not charge you credits. It never names the people in an account’s lists.

Notifications are delivered through Expo’s push service (650 Industries, Inc., United States), which passes them to Apple’s push service for iPhones or to Google’s Firebase Cloud Messaging for Android phones. Expo, and Apple or Google, receive the phone’s push address and the text of the notification. Your phone may show that text on the lock screen; the phone’s notification settings control this. We use the push tokens and your time zone only to send the digest you turned on, on the basis of your consent.

Turning it off. You can turn the digest off in the app at any time. This withdraws your consent and deletes the push tokens of all your phones; the time and time zone stay in your settings but are not used while the digest is off. Turning off notifications for Instoryview in your phone’s settings stops them from showing on that phone.

How long we keep it. Your digest settings are kept while your account exists. A phone’s push token is removed from your account when you sign out of the app on that phone (if the app cannot reach us at that moment, the next time it is opened and can), when you turn the digest off (for all your phones), when the push service reports that it no longer reaches the app, when someone else signs in to the app on that phone and registers it for their own digest, or after 180 days in which the app has not registered it again while signed in. We keep at most 10 phones per account; registering another removes the one seen longest ago. Records of digests are kept for 30 days. All of this is deleted with your account.

We share personal information only with the service providers that run Instoryview for us, under contracts that limit how they may use it:

• Supabase — database and sign-in (United States)
• Upstash — short-term cache and counters
• Hetzner — the servers that run the site (Germany)
• Cloudflare — network delivery and protection
• Stripe, Inc. — payment processing, invoices, the billing portal and, where it applies, sales tax and VAT calculation (United States)
• Waffo.com Limited (Waffo Pancake) — payments, taxes and invoices, as Merchant of Record, for subscriptions bought through Waffo
• Google — if you choose to sign in with Google
• HikerAPI — third-party Instagram data retrieval. We send the requested Instagram username or account ID and, where needed, search terms, media or highlight IDs, and pagination information. We do not include your Instoryview account email, sign-in credentials or payment details in these API requests
• Expo (650 Industries, Inc.) — push notifications for the app’s daily digest, if you turn it on (United States); it passes them to Apple or Google to reach your phone
• kie.ai — runs the AI models that write change-overview summaries and answer Ask AI questions on paid plans. It receives only numbers, placeholders and your question with its usernames replaced, as described above, and is told not to store the conversation
• PayPal — to pay affiliate commissions

We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case this policy keeps applying. We do not sell personal information or share it for targeted advertising.

AI support sends relevant conversation text and, when needed, the limited verified account summary described above through OpenRouter to the selected model provider (currently OpenAI). We configure routing to providers that do not use these requests for training. Attachments are handled by human support and are not sent to the AI model. Our Chatwoot installation and its conversation records are hosted on our own server.

We are based in the United States, and our providers operate in the United States, the European Union and elsewhere, so your information may be processed outside your country. Where the law requires it, transfers are protected by safeguards such as the European Commission’s Standard Contractual Clauses.

• Your account and its data: while the account exists. When you ask us to delete it, we do so within 30 days, except records the law requires us to keep.
• Lookup records: 90 days. Scan history: 30 days. Session replays: 30 days.
• Ask AI conversations: 90 days. Deleting a conversation removes its questions and answers at once; a record of what it cost, without its words, stays until the 90 days are up.
• Abuse-prevention signals: IP address, network and fingerprint signals are deleted after 180 days without being seen again; email and device signals are kept while the account exists.
• Free-credit counters for visitors without an account: up to five years (the allowance is one-off).
• Instagram profile copies, list snapshots and detected changes: older snapshots are thinned out and deleted after 30 days. The latest snapshot of each list and the detected changes are kept, so an account’s history is there whenever it is tracked, until its owner removes it.
• Cached stories, posts and other content: a few minutes to about a day.
• Payment records: as long as tax and accounting law requires.
• Reminder email records (which low-credit reminders we sent you and when): while the account exists. A do-not-email entry stays until the address stops being rejected.
• Change alert records (when we emailed you and how many changes it covered — counts, never names): 30 days.

Support records: we retain conversations while needed to handle and follow up on your request; you can request deletion by email. The AI delivery queue keeps completed message identifiers for 30 days. Support backups rotate after 14 days.

Traffic to Instoryview is encrypted with HTTPS. Our data is read and written only by our own servers — browsers cannot query our database directly — and the signals we use against abuse are stored as keyed hashes. Only the people who run Instoryview can access personal information. No system is perfectly secure; if a breach affects your personal information, we will tell you and the authorities as the law requires.

Depending on where you live, you may have the right to access the personal information we hold about you, to correct or delete it, to receive a copy in a portable format, to object to or restrict how we use it, and to withdraw consent where we rely on it. You can also complain to your local data protection authority.

To use any of these rights, write to support@instoryview.com from the email address of your account. We reply within 30 days, and we never charge for it. Owners of Instagram accounts shown on Instoryview can use the removal page or write to us.

California residents: we do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.

Instoryview is not meant for children. You must be 18 or older to create an account, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, write to us and we will delete it.

We update this policy when what we collect, or how we use it, changes. For material changes we tell you by email or on the site at least 14 days before they take effect. The date at the top shows the current version.

For Instoryview privacy questions and requests, contact support@instoryview.com.