Privacy Policy

FollowerOwl is a product of Next Yazılım Teknoloji Anonim Şirketi (“we”, “us”), of Üniversiteler Mahallesi, 1606. Cadde, 4A Blok No: 304, Ankara, Türkiye. This policy describes how we process personal data when you use followerowl.com and api.followerowl.com (the “service”).

It is written to match how the product actually works, not a generic template. The short version: your Instagram ZIP is parsed in your browser and is never uploaded. If you save a snapshot, we receive three lists of usernames and the dates attached to them. An account is optional. You can check the architectural claims yourself.

This policy covers the Kişisel Verilerin Korunması Kanunu (KVKK) because we are a Turkish company, and the EU/UK GDPR because we offer the service to people there. Using the service is also subject to our Terms of Use.

1. What never leaves your device

Dropping an export on the home page runs entirely in your browser. We do not receive:

• the ZIP, folder, or any other file you selected
• photos, videos, stories, or other media
• messages, comments, likes, or search history
• personal_information.json (email, phone, date of birth, and similar)
• display names, profile pictures, or numeric Instagram account ids (fbids)
• your Instagram password, cookies, or session tokens — there is no login form

The open-source parser reads the archive index, inflates only connections/followers_and_following/*, and drops every field that is not a username or a follow timestamp before a result exists. A Content-Security-Policy header (connect-src 'self' https://api.followerowl.com) stops our own JavaScript from sending data anywhere else. There is no API endpoint that accepts a file.

Instant analysis therefore creates no account and stores nothing with us. A draft of the parsed lists may sit in IndexedDB on your device so a refresh does not lose the result; that copy never leaves the browser unless you choose to save a snapshot.

2. When we do process personal data

We process personal data only if you take a further step:

• Save a snapshot — we receive the three lists (followers, following, pending follow requests), each username, an optional follow timestamp, a content hash of those rows, the export date, and the Instagram handle you confirm.
• Create or sign in to an account — we process your email address to send a magic link and keep you signed in.
• Subscribe to Pro — Stripe processes your payment details. We store a Stripe customer and subscription identifier, not your card number.
• Contact us — we process whatever you send in that message.

3. Data inventory

Every field we store is listed here. If a field is not in this list, we do not keep it.

Email address

D1 (control plane)Sign-in links, reminders, account notices

Session record (hashed token, created/used/expiry times)

D1Keep you signed in; revoke on logout or deletion

Magic-link record (hashed token, purpose, expiry)

D1Single-use sign-in; email change; re-verification

Instagram handle you confirmed

D1 profileLabel the profile; detect a different account on the next save

Storage jurisdiction (EU or unset)

D1 profileWhere that profile's follower lists are stored; fixed at creation

Export date and how it was obtained

Profile Durable ObjectOrder snapshots; phrase unfollow dates as a range

Usernames in followers / following / pending, plus follow timestamps

Profile Durable ObjectCompute diffs, loyalty, and (on Pro) named unfollower lists

Content hash of a snapshot

Profile Durable ObjectDetect an unchanged export without storing the rows twice

Watchlist usernames and optional note

Profile Durable ObjectPro: tell you when a specific account leaves

Dismissed rows

Profile Durable ObjectHide a username you have already dealt with

Stripe customer and subscription ids

D1Entitlements, invoices, cancellation

Stripe event ids (id and type only, no payload)

D1Idempotent billing; kept after deletion

Email delivery log (address, type, state, error)

D1Answer “the link never arrived”; wiped on account deletion

Suppression entry (bounce or “stop mailing me”)

D1Never email that address again; kept after deletion

Audit log (login, snapshot saved/deleted, plan change, export, deletion)

D1Security and support; user id randomised on deletion; 12 months

Opt-in structure report (JSON key paths, array lengths, HTML tag skeleton)

D1Detect Instagram format changes; no values, no user id

Anonymous usage analytics (page viewed, funnel step, parse success/failure class, size band, page speed, JavaScript errors)

tinyanalytics, proxied through followerowl.com/_taKeep the parser working and see where people get stuck; cookieless, not tied to an account

Request logs (request id, user id; never emails or list contents)

Cloudflare Workers LogsOperate and debug the service

IP address and bot-challenge result

Cloudflare (rate limits, Turnstile)Stop anonymous upload abuse

Country code from the request

Used at save time, not stored as a profile fieldPre-set the EU-storage toggle; you can change it before saving

Pending snapshots that have not been claimed yet are keyed by an email hash, live for 24 hours, and are wiped if you discard them or they expire.

4. Usernames of other people

A snapshot contains Instagram usernames of people who follow you, whom you follow, or who have a pending follow request. Those usernames are personal data of those people. We receive them only because they appear in your export, and only after the parser has already discarded display names, photos, and numeric ids.

We:

• store them only inside the Durable Object for your profile
• do not index them globally — there is no directory and no search across users
• do not contact those people, build a social graph, or sell the lists
• do not use them to advertise, profile, or make decisions about those people

If you are not a FollowerOwl user and you believe your username sits in someone else's snapshot, we cannot look it up. Snapshots are not searchable by username, by design. Write to privacy@followerowl.com and we will help to the extent we can identify a relevant account. We will not silently rewrite another person's copy of their own Instagram export unless the law requires it.

5. Legal bases

Under GDPR (and the corresponding KVKK conditions for lawful processing) we rely on:

• Contract — email, sessions, snapshots, diffs, reminders, export, and deletion are processed to provide the service you asked for.
• Legitimate interests — abuse prevention (rate limits, Turnstile, drift checks), security (audit log, request ids), keeping the parser working (anonymous counters and opt-in structure reports), and recovering a suppressed address through support. Those interests do not override your rights: lists are isolated per profile, logs omit list contents, and structure reports contain no values.
• Legal obligation — tax and accounting records around a paid subscription.
• Consent — only where we ask for it (the opt-in structure report; optional summary emails). You can withdraw it at any time without affecting processing that does not rely on consent.

6. Where data lives

The service runs on Cloudflare. Follower lists live in a Durable Object dedicated to your profile. If you leave the EU-storage toggle on at save time, that object is created with Cloudflare's EU jurisdiction, and the lists stay there. The toggle is pre-set from the country of the request; it is your choice, and it cannot be changed later because the object cannot be moved.

That claim is scoped on purpose. The following are not pinned to the EU:

• the D1 control plane (email, sessions, profile metadata, billing identifiers)
• Cloudflare request logs
• anonymous usage analytics (tinyanalytics)
• transactional email via Amazon SES (we send from the eu-central-1 region by default; Amazon still operates a global network)
• Stripe, if you subscribe

Providers may process data in the United States and other countries. Where a transfer out of Türkiye or the EEA/UK takes place, we rely on the provider's data-processing terms, including Standard Contractual Clauses where they apply.

7. Who else sees data

We do not sell personal data. We use processors to run the service:

• Cloudflare, Inc. — hosting, Durable Objects, D1, KV, CDN, bot management (Turnstile), logs, and analytics counters.
• Amazon Web Services EMEA SARL / Amazon SES — transactional email (magic links, reminders, deletion confirmation). SES also keeps its own suppression list of addresses that have hard-bounced or complained, so we do not mail them again.
• Stripe, Inc. / Stripe Payments Europe, Ltd. — checkout, invoices, and the customer portal, only if you subscribe. Their privacy policy applies to the payment data they collect.
• tinyanalytics — cookieless usage analytics. It never receives a username, a filename, an email address or an exact follower count: sizes are recorded as bands such as “1k-4.9k”. Requests are proxied through followerowl.com/_ta, so no third-party origin is contacted from your browser. See /verify for how to inspect or disable it.

We may disclose data if required by law, to protect the service or a person from serious harm, or to a successor if the company is reorganised — in which case this policy continues to apply unless you are notified otherwise.

Support tooling looks up an account by email hash. It cannot search follower lists by username.

8. Cookies and local storage

Instant analysis uses no cookie. If you sign in, the API sets one first-party cookie named fo_session on api.followerowl.com only — HttpOnly, Secure, SameSite=Lax, host-only (no parent-domain cookie), rolling 30-day expiry, revoked on logout. It holds a random session secret; the database stores only a hash of that secret.

Cloudflare Turnstile, when shown, may set a cookie of its own to complete the bot check. We do not use advertising cookies, cross-site trackers, or a cookie banner for cookies that are not strictly necessary, because we do not set those.

Usage analytics set no cookie either. The tracker keeps a random visitor identifier in this browser’s local storage so that two page views in one visit are not counted as two people; it is not readable by any other site and never leaves your device attached to anything you typed. Clearing site data clears it, and localStorage.setItem('disable-tinyanalytics', '1') turns the tracker off entirely.

The browser may keep a parsed draft in IndexedDB so a refresh does not lose your work. You can clear it by clearing site data. Private windows have no IndexedDB; we warn you to keep the tab open until you save.

9. How long we keep it

• Unclaimed snapshots — 24 hours, then purged.
• Free accounts — the two most recent snapshots (by export date) are retained; older saves are refused rather than silently dropped.
• Pro accounts — snapshot history is kept until you delete it or the account.
• Sessions — 30 days of inactivity, or immediately on logout or deletion.
• Magic links — 15 minutes, single use.
• Inactive accounts — if there is no login, no snapshot, and no paid renewal for 12 months (active and trialing subscriptions excluded), we email a warning at 11 months and then delete the account as if you had requested it.
• After you delete — we tombstone the account first, then wipe users, sessions, profiles and their Durable Objects, subscriptions (including the Stripe customer), reminders, pending snapshots, upload sessions, and the email log. We keep a deletion record and an audit log with a randomised user id for 12 months. We keep Stripe event ids (no payload) and suppression entries so a deleted address is never mailed again. Opt-in structure reports have no user id and stay in the aggregate.

10. Your rights

You can access, correct, export, and delete your data from the account settings once those controls are available, and at any time by emailing privacy@followerowl.com. Under GDPR and KVKK you may also:

• learn whether we process your personal data and receive a copy (access)
• have inaccurate data corrected
• have data deleted, subject to the retention noted above
• restrict or object to processing that relies on legitimate interests
• receive the data you provided in a portable JSON export
• withdraw consent where processing is based on consent
• complain to a supervisory authority

In Türkiye that authority is the Kişisel Verileri Koruma Kurulu (kvkk.gov.tr). In the EEA or UK you may complain to your local data-protection authority. Sensitive actions (email change, export, deletion, billing) require a fresh magic-link confirmation, not just a live session.

We will answer without undue delay and within the time the applicable law allows. We may need to verify that the request comes from the account holder.

11. Children

The service is not directed at children. You must be old enough to have an Instagram account to use the in-browser analysis, and at least 18 (or the age of majority in your country, if higher) to create a FollowerOwl account or subscribe. We do not knowingly collect personal data from children. If you believe we have, write to us and we will delete it.

12. Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects. Drift detection asks you to confirm that a new export is still the same Instagram account; it does not lock you out by itself.

13. Changes

If we change this policy in a way that matters, we will update the date above and, when the change is material, email the address on the account. Continued use after the effective date is acceptance of the updated policy.

14. Contact

Data controller: Next Yazılım Teknoloji Anonim Şirketi
Üniversiteler Mahallesi, 1606. Cadde, 4A Blok No: 304
Ankara, Türkiye
Privacy: privacy@followerowl.com
General: hello@followerowl.com