[00] TRUST CENTER

What we do with your data. Including what we haven’t built.

Most pages like this one are a wall of green ticks. This one carries the gaps as well, in section 04, because a product whose entire argument is restraint cannot afford a trust page that overstates. Every control below names the file that implements it, so none of it has to be taken on faith.

Last reviewed 2026-08-31

[01] AT A GLANCE

Four numbers that describe the whole posture.
The rest of this page is why each one is true.

passwords stored

there is no password field

files read

out of hundreds in the archive

companies involved

all four named below

0 bytes

of your archive uploaded

for the free check

[02] CONTROLS IN PLACE

What actually protects your data.
Each one names where it lives, so you can go and read it.

The archive itself

The strongest control is structural: for the free check there is no transfer to secure, because nothing is sent.

Parsed in your browser, not on a server
The ZIP is opened by JavaScript running in your own tab. Watch your network panel while it works and you will see no request carrying it.
Only three paths are inflated
We read the archive's own index and decompress the three relationship files. Photos and messages are never read, rather than read and discarded.
packages/parser/src/locate.ts
Hostile-input ceilings
Entry counts, inflated size and compression ratio are all capped, so a deliberately malformed archive is refused rather than allowed to hang your browser.
packages/schema (CAPS)

Accounts and sessions

There is no password to steal, because we never accept one.

Sign-in by emailed link
No password field exists anywhere on the site, and we never ask for your Instagram credentials. A link works once and expires in 15 minutes.
Session cookie is HttpOnly, Secure, SameSite=Lax
It cannot be read by JavaScript, only travels over HTTPS, and is host-only to the api subdomain.
apps/api/src/auth.ts
Sign-in links are bound to the browser that asked
A nonce kept in your browser's local storage ties the link to the device that requested it. Redeeming elsewhere asks you to confirm the address instead.
Rate limits on sign-in and upload
Both are limited per client, so neither can be hammered to enumerate addresses or exhaust storage.
apps/api/src/routes

What the browser is allowed to do

A Content-Security-Policy header makes exfiltration a thing the browser refuses, not a thing we promise not to do.

connect-src is limited to this site and our API
Our own JavaScript is physically unable to send your data to a third party, and you can read the header yourself in the network panel.
apps/web/next.config.ts
No third-party origin is contacted
Fonts are self-hosted and analytics is proxied through this domain, so loading the site reaches no other company's servers.
frame-ancestors 'none'
The site cannot be framed, so it cannot be clickjacked.

What we store when you save a snapshot

Saving is the one moment data reaches us, and it is limited to what a comparison actually needs.

Three lists of usernames and their dates
Nothing else from the export is kept: no display names, no numeric ids, no photos, no messages. Fields are dropped at the point of reading.
packages/parser/src/shapes.ts
Isolated per profile, never globally searchable
Follower lists live in a storage object dedicated to your profile. No account can look up a username across profiles; support tooling looks accounts up by email hash and cannot search lists at all.
EU storage, if you choose it before saving
Leave the toggle on and the object is created in Cloudflare's EU jurisdiction and stays there. It cannot be moved afterwards, which is why the choice comes first. The control plane, logs, analytics, email and payments are not EU-pinned, and the privacy policy names each.
Uploads are integrity-checked
Each chunk is hashed in your browser and re-hashed on arrival. A mismatch fails the save loudly rather than storing a half-truth.

Analytics

First-party, cookieless, and deliberately unable to carry anything identifying.

No username ever leaves your browser
Searching your results, opening a profile and copying a list all emit nothing containing a username. Verified by hooking the browser's own send paths, not by reading the vendor's promises.
Counts leave as bands, never exact
A follower count is recorded as a range such as 1k-4.9k, because an exact count is close to a name.
apps/web/lib/analytics.ts
The token page emits nothing
The sign-in landing URL carries a single-use token, so it is excluded entirely, and report URLs are path-masked.
You can switch it off
One line in your browser console, documented on /verify.

[03] WHO ELSE IS INVOLVED

Four companies, and what each one does.
Nobody else touches any of it.

Cloudflare, Inc.
Their security page
Hosting, storage objects, database, CDN, logs
Global edge; EU jurisdiction available for follower lists
Amazon Web Services EMEA / SES
Their security page
Transactional email: sign-in links, reminders
Sent from eu-central-1 by default
Stripe, Inc. / Stripe Payments Europe
Their security page
Checkout and invoices, only if you subscribe
US / EU
tinyanalytics
How to check it
Cookieless usage analytics, proxied through this domain
Never receives a username, filename or exact count

We do not sell personal data, and there is no ad network, affiliate link or paid placement anywhere on this site. The privacy policy carries the full detail, including what is not pinned to the EU.

[04] NOT BUILT YET

The gaps, before you find them yourself.
A page that lists only what exists invites you to assume the rest.

Deleting your account and its data
There is no deletion endpoint yet. Until there is, ask us by email and we will do it by hand — and we would rather write that sentence than imply a self-serve button exists.
A bot check on profile creation
Creating a profile is currently protected by a rate limit alone. A challenge is specified and not yet wired, which is why the site is not publicised.
SOC 2, ISO 27001 or any external audit
None. We are a small company that has not been audited, and a badge we have not earned would be exactly the sort of claim this site exists to argue against.
A published uptime or status page
Not yet. Incidents are handled directly by email in the meantime.

[05] DOCUMENTS

Everything else worth reading.
All public. Nothing here is gated behind a call.

Reporting a security problem

Email privacy@followerowl.com with what you found and how to reproduce it. We will confirm receipt, tell you what we intend to do, and credit you if you want the credit. Please give us a reasonable window before publishing, and do not access an account that is not yours while testing.

If something on this page turns out to be wrong, that is itself a security report and we would like to hear it on the same address.