Privacy Policy

Last updated: October 28, 2026

Followny is operated by Kue Labs, Inc., a Delaware corporation ("Followny", "we", "us"). This policy explains what information we process, how we use it, who our service providers are, and your choices. In this policy, "personal information" means information that identifies or relates to an identifiable person.

This policy covers the Followny website and the Followny iOS app. Kue Labs, Inc. decides how and why your personal information is processed (it is the "controller").

1. Information we process

Account data (website): your email address. We do not collect a password (you sign in with Google or a one-time magic link) and we do not collect your name or date of birth at sign-up.
Payment data: handled directly by our payment processor (Stripe). We never receive or store full card numbers; we store only your Stripe customer and subscription identifiers and your plan status. If you actively opt in to Checkout recovery messages, Stripe also returns the billing email and that consent choice to us. After a completed purchase, we retain only a one-way hash of the billing email to prevent an older unfinished Checkout from sending a reminder to an inbox that has already purchased.
Tracked data: public information about Instagram accounts you choose to look up or track — for example a public account's username and the public accounts it follows, and changes to those over time. For accounts on tracking plans this can include small preview copies (thumbnails) of public stories and public profile pictures, kept for a limited period so you can review recent changes.
Usage data: your in-service lookup history and the reports generated for you. Our application database stores IP-derived security and abuse-prevention identifiers only in hashed, truncated form. Hosting and analytics providers also receive network request metadata as described in Sections 5 and 7.

If you use the Followny iOS app:

Anonymous account identifiers. The app has no login. We create an anonymous account ID for you, send that same ID to Apple with your App Store purchases (Apple calls it the app account token), and store Apple's app transaction ID for your Apple Account so your membership can follow it. We also create a short Support ID that you can share with Support.
App Store purchase records. Transaction IDs, product, purchase, expiry and refund dates, price and currency, and subscription status, which we receive from Apple to confirm and keep your membership. Apple handles payment; we never receive your card or bank details.
Device security data. To keep someone else from taking over your account on another device, we store Apple App Attest data for each device (a key ID, public key, attestation receipt and counter), a one-way hash of Apple's device verification identifier (never the identifier itself), and dates such as when a device was added, last seen or removed.
Push notification tokens. If you turn on change alerts, we store your device's push token and push settings so we can send them.
Support requests. If you use Contact support, we receive the email address and message you enter, plus your Support ID and app version.
Usage records. We record events about your use of Tracking (for example, when a baseline is saved or an alert is sent) under your anonymous account ID to measure and improve the service.
Network data. For rate limiting we keep a hashed form of your IP address for up to 2 days.

2. How we use it

To provide the Service: to detect and show changes in public following lists, generate character and insight reports, manage your subscription and billing, secure the Service and prevent abuse, and send you service messages (such as sign-in links and account notices).

If you actively opt in during Checkout and leave that Checkout unfinished, we may use the billing email collected there to send a Checkout recovery message. We limit these reminders to one per inbox in a seven-day period. Every recovery message includes an unsubscribe link, and an unsubscribe suppresses future Checkout recovery messages to that email.

In the iOS app we also use this information to confirm App Store purchases with Apple, keep your membership on the Apple Account that bought it, protect your account when you add a device, send change alerts you turned on, answer support requests, and measure how Tracking is used.

Change alerts. iOS change alerts show only a count of detected changes (for example, "2 following changes detected."). They never include an account name or handle. You can turn them off in Settings › Account › Notifications or in iOS Settings.

3. Automated processing and AI

To generate character and insight reports, we use automated processing, including a third-party AI service provider (Anthropic). We send that provider the public content and identifiers needed for classification — public post thumbnail images, post captions, and public profile signals such as profile images, usernames (handles), display names, and, when present in the captured profile input, bios. Anthropic acts as our service provider under its Commercial Terms; under those terms it does not use this content to train its models. These reports are automated and provided for entertainment and insight only; consistent with our Disclaimer, they are not a consumer report and must not be used for any FCRA-covered purpose.

For Relationship Orbit, we use those public profile signals to estimate a target or candidate account's gender signal as female, male, or unknown. Any estimate below a 0.70 confidence score is forced to unknown, and some features require a higher score before using an estimate. Unknown accounts remain in composition denominators. The estimate may affect Recent Follows composition and display order and may act as an eligibility gate for Off Signal; it is not multiplied into a relationship score, is not a relationship probability, and is not used for Tracking observations or legal, credit, employment, housing, insurance, or other eligibility decisions.

We do not use facial recognition, match faces to identities, or create or extract biometric identifiers. The gender signal is an automated estimate from public profile context, not a verified fact, and it may be wrong. We store the resulting bucket and confidence with a classifier version, keyed to the exact report snapshot. The first stored result for a given snapshot and classifier version is reused, so it does not silently change within that version. A later classifier version may create a separately pinned result for the same snapshot. To report an inaccurate estimate or request correction or removal, use our contact form at /support or email followny.info@gmail.com.

4. Information about people who are not our users

When a user looks up or tracks a public Instagram account, we process publicly available information about that account and its public activity — such as its username and the public accounts it follows, short excerpts of public comments on public posts, and thumbnail-size copies of public stories and public profile images — to generate reports and detect changes and, for Relationship Orbit, create the limited automated gender-signal estimate described in Section 3. The inputs are publicly visible; the resulting estimate is not hidden or verified account data. We never access private accounts, direct messages, logins, or non-public data. If you are the subject of information processed through the Service and want it corrected or removed, contact us at followny.info@gmail.com and we will delete data about you where we are able to identify it.

If you live in the European Economic Area, the United Kingdom, Switzerland, or Brazil, we process this public information on the basis of our legitimate interest, and our users', in providing the reports they request. You can object to this processing at any time using the contact details in Section 14.

5. Service providers

We share information with categories of service providers, who may process it only to provide services to us:

Hosting and infrastructure — running the Service and its scheduled jobs (receives the network information needed to deliver and secure a request; our application stores only a hashed, truncated IP-derived identifier).
Database, authentication, and storage — keeping your account, subscription references, tracked-account data, and generated reports, and managing sign-in.
Sign-in and identity providers — when you choose "Sign in with Google", the sign-in is handled by Google and we receive only your email address from Google; nothing else.
Payment processing (Stripe) — Stripe handles your card details directly; we store only your Stripe customer and subscription identifiers.
Email delivery — sending transactional and sign-in email, including magic links, and a Checkout recovery message when you actively opt in (receives your email address).
Product analytics and error monitoring — measuring feature use, performance, and failures (receives bounded event, device, browser, and request metadata). Product analytics is configured to discard raw client IP before storing new events, after bot detection and coarse location enrichment. Historical analytics events collected before August 29, 2026 may retain the request IP under the provider's access, retention, and deletion controls.
Public-data retrieval — obtaining public Instagram data (receives the public username you look up).
AI classification (Anthropic) — classifying public content to generate reports (receives public post thumbnails, captions, profile images, usernames, display names, and bios, as described in Section 3).
Apple — App Store payments and subscription status, push delivery for the iOS app, and device checks (App Attest).
Bot protection — a verification check (Cloudflare Turnstile) runs before your first scan. In the iOS app it runs in a temporary web view that keeps no cookies after it closes.

The iOS app does not track you across other companies' apps or websites, does not use Apple's advertising identifier, and contains no third-party advertising or analytics code.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Not affiliated with Instagram. Instagram is a trademark of its owners.

6. Retention

We retain your account data and the public tracking data associated with your account for as long as your account is active and we need it to provide the Service. Cache data used to keep results fresh is retained only for short technical periods and is then refreshed or discarded. When you delete an account on the website, we cancel any active Stripe subscription and delete owner-scoped data associated with the account, including saved baselines, diffs, lookup history, and generated report artifacts. Report snapshots are a shared public-data cache and are not deleted solely because one user deletes an account. Superseded snapshots that are not pinned by a saved or shared artifact are normally deleted after approximately 90 days; the newest snapshot for a public account and snapshots pinned by saved or shared artifacts may be retained longer so those results remain stable. The stored gender-signal bucket, confidence, and classifier version are deleted when their corresponding snapshot is deleted. Thumbnail copies of public stories and profile images are deleted automatically on a rolling basis (approximately 12 weeks), and sooner if the tracked account becomes private, is deleted, or tracking for it ends. Tracking data from a free look-up that is not converted to a paid plan is deleted after about 30 days of inactivity. For Checkout recovery, we may retain a one-way hash associated with a completed purchase to prevent post-purchase reminders. If you unsubscribe from Checkout recovery messages, we retain a one-way hash of the email address as long as needed to honor that choice; these records do not contain the email address itself. We may retain a limited amount of information where required for legal, tax, security, or fraud-prevention purposes. A correction or deletion request about a public account is handled as described in Sections 3, 4, and 10.

Deleting your account in the iOS app. Settings › Account › Delete account deletes your anonymous account and every device linked to it, together with your saved results, Tracking profiles, updates, push tokens, device security data and Support ID. Deleting your account does not cancel an App Store subscription; Apple keeps billing until you cancel it in your Apple Account settings. We keep App Store transaction records after you delete your account, with your Followny account ID removed, for accounting, tax, refund and fraud-prevention purposes.

If your App Store subscription expires or is refunded, we delete the Tracking data for your tracked profiles 30 days later; if Apple is still retrying a failed renewal, we delete it up to 90 days after the retries began. We keep only a minimal record of each tracked profile — its public Instagram account ID, the username when you started tracking it, and its tracking settings — so Tracking can restart if you subscribe again, and we delete that record 90 days after it was retired. Records of account-recovery and device security events are deleted 90 days after they are created. A device you remove stays recorded as removed until you delete your account.

7. Security and data minimization

We practice data minimization: on the website, to use the Service you provide an email address — no password (you sign in with Google or a secure magic link) and no payment card details (handled by our payment processor). The iOS app asks for no email address, name or password unless you contact Support. Our application stores only hashed, truncated IP-derived identifiers. Network providers necessarily process a request IP to deliver and secure the Service. For new analytics events, the analytics provider may use that IP for bot detection and coarse location enrichment, then discards it before event storage; the historical boundary is described in Section 5. We require our service providers to protect data and use it only to provide their service to us. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

8. International users

Where we process information

Followny is operated from the United States and is available worldwide. If you use Followny from outside the United States, your information is transferred to, stored and processed in the United States and in other countries where our service providers operate, whose data-protection laws may differ from yours. Where the law requires a transfer safeguard, we rely on the European Commission's Standard Contractual Clauses (with the UK and Swiss addenda) or another mechanism the law recognizes.

Legal bases (European Economic Area, United Kingdom, Switzerland, Brazil)

We process personal information to perform our contract with you (providing scans, reports, Tracking, alerts, purchases and your account); for our legitimate interests (keeping the Service secure, preventing fraud and abuse, measuring and improving the Service, and producing the reports users request about public accounts); to comply with legal obligations (such as tax and accounting records); and with your consent where we ask for it (such as optional push alerts and Checkout recovery messages).

Your rights (European Economic Area, United Kingdom, Switzerland)

You can ask to access, correct, delete, restrict or receive a copy of your personal information, object to processing based on legitimate interests (including analytics), and withdraw consent at any time without affecting earlier processing. Followny does not make decisions about you that produce legal or similarly significant effects. You can also complain to your data protection authority, such as the authority in your EU member state, the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner.

Republic of Korea

If you live in the Republic of Korea, you can ask to access, correct, delete or suspend the processing of your personal information, and withdraw consent; a legal representative may do so for a child. We keep personal information for the periods in Section 6 and then delete it so that it cannot be restored. The service providers that process personal information for us, mostly outside Korea, are Vercel (hosting), Supabase (database, sign-in and storage), Stripe and Apple (payments), Google (sign-in and our support inbox), Resend (email delivery), PostHog (product analytics), Sentry (error monitoring), Cloudflare (bot protection), Anthropic (AI classification of public content) and our public-data provider. To reach the person responsible for privacy at Kue Labs, Inc., email followny.info@gmail.com. You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (kopico.go.kr).

Brazil

If you live in Brazil, you have the rights in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, and withdrawal of consent. You can contact us about data protection, including as our point of contact under the LGPD, at followny.info@gmail.com, and you can petition the National Data Protection Authority (ANPD).

How to exercise your rights

Email followny.info@gmail.com or use our contact form at /support. The iOS app has no login, so include the Support ID shown in Settings › Account › Support; we may ask for details, such as your App Store purchase, that let us confirm the request comes from the account holder. You can also delete your iOS account yourself in Settings › Account. We respond within the time the law requires (for example, one month under the GDPR).

9. Children

The Service is intended for users age 13 and older, or older if the law where you live sets a higher minimum age, and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If we learn we have collected such information, we will delete it. A parent or guardian who believes we may hold information about a child under 13 can contact us at followny.info@gmail.com. The iOS app is rated 13+ on the App Store; it does not ask for or verify your age and relies on the App Store age rating and our Terms.

10. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended. In the preceding 12 months we have collected the following categories of personal information:

Identifiers — email address; hashed and truncated IP address.
Commercial information — subscription tier and Stripe customer/subscription identifiers.
Internet or network activity — your lookup history within the Service.
Inferences — the character and insight report summaries we generate and the limited gender-signal estimates described in Section 3.

Sources: you (your email and the handles you look up); Google (your email address, if you sign in with Google); Stripe (billing status); our public-data provider (public Instagram data). Business purposes: providing the Service, billing, security and fraud prevention, and service communications. Third parties: the categories of service providers listed in Section 5 (hosting/database, sign-in and identity, payments, AI classification, public-data retrieval, and email).

We do not sell or share (as defined by the CPRA for cross-context behavioral advertising) your personal information, and we have not in the preceding 12 months. We do not collect sensitive personal information for any purpose that would require a right to limit its use.

You have the right to know/access, delete, and correct your personal information, the right to opt out of the sale or sharing of personal information (not applicable here, as we do neither), and the right not to receive discriminatory treatment for exercising your rights. To exercise a right, use our contact form at /support or email followny.info@gmail.com, or delete your account from Settings. We verify requests using the email address on file (for example, by confirming control of the email address you sign in with), and we accept requests submitted by an authorized agent.

11. Other US state privacy rights

Depending on your US state, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. Followny does not sell personal data, does not use it for targeted advertising, and does not engage in profiling that produces legal or similarly significant effects. To exercise a right, contact followny.info@gmail.com. If we deny your request, you may appeal by replying to our decision, and we will respond within the time your state requires. You may also contact your state Attorney General.

12. Automated decision-making and profiling

Reports are generated by automated processing (profiling) of public information, for entertainment and insight only. They do not make decisions that produce legal or similarly significant effects about any person, they are not a consumer report, and they must not be used for eligibility decisions such as employment, credit, housing, insurance, or similar purposes. We do not use biometrics or facial recognition and do not use the limited gender-signal estimate described in Section 3 for legal or similarly significant effects. That estimate is used only for the specified Relationship Orbit presentation and product eligibility gates.

13. Your choices and changes to this policy

You can view and update your email and delete your account at any time from Settings. In the iOS app, you can delete your account in Settings › Account and turn change alerts off in Settings › Account › Notifications or in iOS Settings. You can opt out of Checkout recovery messages through the unsubscribe link in any such email. We do not use third-party advertising or tracking cookies, and we do not respond differently to browser Do-Not-Track signals; the only cookies we set are strictly necessary authentication cookies and a functional language-preference cookie set only if you switch languages (see our Cookies Policy). We may update this policy; material changes will be posted here with a new effective date, and where appropriate we will notify you by email before a material change to how we use personal information applies to data we already hold.

14. Contact

This Service is operated by Kue Labs, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. For privacy questions or to exercise your rights, use our contact form at /support or email followny.info@gmail.com. We aim to respond within 30 days, or sooner where a law requires.