Privacy Policy.

StalkyApp watches public Instagram accounts on your behalf. This page covers what data we collect, why we collect it, and how we keep it safe. If anything's unclear, email [email protected].

1. Who we are

StalkyApp ("we", "us") is the operator of stalkyapp.com. We're the data controller for the personal data described below.

2. What we collect

From you

• Account data — your email address, name, and Google profile picture (via Google Sign-In).
• Subscription data — handled by Whop. We store a Whop membership ID and subscription status. We never see or store your card number.
• Push subscription — if you enable push notifications, your browser-issued push endpoint and keys.
• Settings & preferences — email digest opt-ins, story-alert toggles, timezone.

About the accounts you watch

• Public Instagram data — handles you add, plus the public follow lists and stories of those accounts.
• Diff history — daily snapshots of who they follow, plus archived stories captured at scan time.

We only read information that anyone could see by visiting a public Instagram profile. We do not bypass privacy settings. Private accounts you do not follow are not accessible.

Automatically

• Analytics — anonymous, cookie-less page views via Fathom Analytics.
• Whop attribution pixel — records page views, a small set of conversion events (creating an account, adding your first watched account, selecting a plan) and two engagement events (an engaged visit to our home page — at least 10 seconds on the page plus a scroll or a tap — and reopening StalkyApp in your browser from an app’s built-in browser) so Whop can attribute subscriptions to the marketing that produced them. It runs on every page, including your dashboard while signed in. Unlike Fathom it is not cookie-less: it stores a persistent visitor identifier in a first-party cookie and in your browser’s local storage, derives a device fingerprint, and reads advertising click identifiers (such as gclid or fbclid) from the page URL. It also collects your screen size, browser language and time zone. When one of those conversion events happens, we attach your email address, display name and StalkyApp account ID to it, and send the same event to Whop from our server too, along with your IP address, browser user agent and the pixel’s visitor identifier. When you start a subscription, we also tell Whop which StalkyApp visitor that membership belongs to. We only send these server-side copies if the pixel has already run in your browser.
• Ad attribution — when you arrive from an ad or a link with campaign parameters, we keep that page address (it names the campaign, ad group and ad, and carries the ad network’s click identifier) and the page you came from in two first-party cookies, sa_lt (your latest such visit, 30 days) and sa_ft (your first, 90 days). If you then create an account, we store them with it, attach the address to the conversion events above, and include the campaign, ad group and ad identifiers with your checkout, so we know which ads bring paying customers.
• Server logs — IP address and request metadata, retained for security and debugging.

3. How we use it

• Run the daily scan and serve your dashboard.
• Send digest emails and push notifications you opted into.
• Process payments and manage your subscription.
• Detect abuse, fix bugs, improve the product.

We do not sell your data. We do not share it for advertising. We do not train AI models on it.

4. Who we share it with

Only the third parties needed to operate the service:

• Google — sign-in only. See policies.google.com/privacy.
• Whop — payments, and marketing attribution via the Whop pixel described in section 2. See whop.com/privacy.
• Laravel Cloud / our hosting provider — application + database hosting.
• Email + push delivery providers — to deliver digests and notifications.
• Fathom Analytics — privacy-focused, cookie-less traffic analytics.

5. Where data lives

Application data is stored on EU-based servers. Backups are encrypted at rest. Account credentials use industry-standard hashing.

6. How long we keep it

• Account data — until you delete your account.
• Watched-account history — kept while your subscription is active. Deleted within 30 days of cancellation if you don't return.
• Whop billing records — retained as legally required (typically 7 years).
• Server logs — 30 days, then purged.

7. Your rights (GDPR)

If you're in the EU/EEA or UK, you have the right to:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data (CSV export available in Settings while subscribed).
• Lodge a complaint with your local data protection authority.

To exercise any of these, email [email protected]. We'll respond within 30 days.

8. Cookies

We use one essential cookie to keep you logged in. Our own analytics (Fathom) is cookie-less. The two ad attribution cookies described in section 2 (sa_lt, sa_ft) are only set when you arrive with campaign parameters in the address; you can clear them in your browser at any time.

The Whop attribution pixel described in section 2 does set a cookie: a first-party identifier used to link your visit to a later subscription. It also stores identifiers in local storage and derives a device fingerprint. If you do not want this, block t.whop.tw in your browser or an ad blocker — nothing on StalkyApp depends on it, and the service works normally without it. Blocking it also stops the server-side copies described in section 2, because we only send those when the pixel’s cookie is present.

9. The accounts you watch

StalkyApp watches public follow data and public stories. The watched accounts are never notified, contacted, or logged into. We process this public data on your behalf as the controller. If you watch someone in violation of local laws (stalking, harassment, restraining orders), you're responsible — not us. See the Terms.

10. Children

StalkyApp is for adults. You must be at least 16 (or the digital-consent age in your country, whichever is higher) to use it.

11. Changes

If we materially change this policy, we'll update the "Last updated" date and notify subscribers by email.

12. Contact

Questions, requests, or complaints: [email protected].