Don’t trust us. Check.

Every unfollower tool says it is safe. That is worth nothing, so here is how to confirm this one, without taking our word for any part of it.

1. Watch the network panel while it works

Open your browser's developer tools, switch to the Network tab, then drop your export on the home page. You will see requests for this page's own files, a few hundred bytes of anonymous usage analytics described below, and nothing else — no upload, and no request that grows with the size of your ZIP. A 1.3 GB export produces the same network traffic as an empty one, which is the part worth checking.

The analytics requests are the ones under /_ta/. They are cookieless, and you can read exactly what they contain: expand one and look at the payload. It records that a parse happened, roughly how long it took, and a size band such as 1k-4.9k — never a username, a filename, or an exact count. You can switch them off for good by running localStorage.setItem('disable-tinyanalytics', '1') in the console, and the product works identically afterwards.

2. Read the header that makes uploading impossible

This site sends a Content-Security-Policy header with connect-src 'self' https://api.followerowl.com. That is a browser-enforced rule: our own JavaScript is physically unable to send data anywhere else. Check it in the Network tab, on the response headers for this page.

Our API accepts only lists of usernames. It has no endpoint that accepts a file, so there is nowhere for a ZIP to go even if the header allowed it.

That header is also why the analytics above are served from our own domain rather than an analytics vendor's. Loading a third-party tracker would have meant widening this rule to name another origin, which would have made the sentence above less true than it is. Instead the requests under /_ta/ are proxied through followerowl.com, and the rule stays as narrow as it reads.

3. Read the parser

The code that reads your export is open source under AGPL-3.0. It is worth knowing what it does not do: a ZIP file keeps its index at the end, so the parser reads that index, picks out the three files it needs, and never fetches the bytes of anything else. Your photos, messages and personal information are not skipped after being read — they are never read.

What that costs, measured

Run against a real 1.27 GB Instagram export containing 5,092 files:

What we do store, if you make an account

An account is optional and only matters for the second question — who unfollowed you — which needs two exports to answer. If you save a snapshot, we receive three lists of usernames and the dates attached to them. We never receive display names, profile pictures, numeric account ids, your email history, or anything from the rest of the export, because the parser discards those fields before the result exists.

What we never do

• Ask for your Instagram password. There is no login form, anywhere, ever.
• Perform actions on your account. We cannot follow, unfollow, like or message on your behalf — this product has no connection to your Instagram account at all.
• Make your data searchable. One person's snapshots are readable only by them.

If any statement on this page turns out to be wrong, that is a bug and we want to hear about it more than we want anything else on our roadmap.

Where to go next

This page covers one claim: that your archive is never uploaded. Two others carry the rest. The methodology sets out which three files we read and the exact set operations that turn them into the number on your screen, so you can recompute it yourself. The trust centre lists the controls protecting a saved snapshot, the four companies involved, and the things we have not built yet. About us explains who is behind all three.