Privacy Policy.

StalkyApp watches public Instagram accounts on your behalf. This page covers what data we collect, why we collect it, and how we keep it safe. If anything's unclear, email [email protected].

1. Who we are

StalkyApp ("we", "us") is the operator of stalkyapp.com. We're the data controller for the personal data described below.

2. What we collect

From you

• Account data — your email address, name, and Google profile picture (via Google Sign-In).
• Subscription data — handled by Whop. We store a Whop membership ID and subscription status. We never see or store your card number.
• Push subscription — if you enable push notifications, your browser-issued push endpoint and keys.
• Settings & preferences — email digest opt-ins, story-alert toggles, timezone.

About the accounts you watch

• Public Instagram data — handles you add, plus the public follow lists and stories of those accounts.
• Diff history — daily snapshots of who they follow, plus archived stories captured at scan time.

We only read information that anyone could see by visiting a public Instagram profile. We do not bypass privacy settings. Private accounts you do not follow are not accessible.

Automatically

• Analytics — anonymous, cookie-less page views via Fathom Analytics.
• Server logs — IP address and request metadata, retained for security and debugging.

3. How we use it

• Run the daily scan and serve your dashboard.
• Send digest emails and push notifications you opted into.
• Process payments and manage your subscription.
• Detect abuse, fix bugs, improve the product.

We do not sell your data. We do not share it for advertising. We do not train AI models on it.

4. Who we share it with

Only the third parties needed to operate the service:

• Google — sign-in only. See policies.google.com/privacy.
• Whop — payments. See whop.com/privacy.
• Laravel Cloud / our hosting provider — application + database hosting.
• Email + push delivery providers — to deliver digests and notifications.
• Fathom Analytics — privacy-focused, cookie-less traffic analytics.

5. Where data lives

Application data is stored on EU-based servers. Backups are encrypted at rest. Account credentials use industry-standard hashing.

6. How long we keep it

• Account data — until you delete your account.
• Watched-account history — kept while your subscription is active. Deleted within 30 days of cancellation if you don't return.
• Whop billing records — retained as legally required (typically 7 years).
• Server logs — 30 days, then purged.

7. Your rights (GDPR)

If you're in the EU/EEA or UK, you have the right to:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data (CSV export available in Settings while subscribed).
• Lodge a complaint with your local data protection authority.

To exercise any of these, email [email protected]. We'll respond within 30 days.

8. Cookies

We use one essential cookie to keep you logged in. We do not use tracking cookies. Analytics is cookie-less (Fathom).

9. The accounts you watch

StalkyApp watches public follow data and public stories. The watched accounts are never notified, contacted, or logged into. We process this public data on your behalf as the controller. If you watch someone in violation of local laws (stalking, harassment, restraining orders), you're responsible — not us. See the Terms.

10. Children

StalkyApp is for adults. You must be at least 16 (or the digital-consent age in your country, whichever is higher) to use it.

11. Changes

If we materially change this policy, we'll update the "Last updated" date and notify subscribers by email.

12. Contact

Questions, requests, or complaints: [email protected].