Privacy Policy.

StalkyApp watches public Instagram accounts on your behalf. This page covers what data we collect, why we collect it, and how we keep it safe. If anything's unclear, email [email protected].

1. Who we are

StalkyApp ("we", "us") is the operator of stalkyapp.com. We're the data controller for the personal data described below.

2. What we collect

From you

• Account data — your email address, name, and Google profile picture (via Google Sign-In).
• Subscription data — handled by Whop. We store a Whop membership ID and subscription status. We never see or store your card number.
• Push subscription — if you enable push notifications, your browser-issued push endpoint and keys.
• Settings & preferences — email digest opt-ins, story-alert toggles, timezone.

About the accounts you watch

• Public Instagram data — handles you add, plus the public follow lists and stories of those accounts.
• Diff history — daily snapshots of who they follow, plus archived stories captured at scan time.

We only read information that anyone could see by visiting a public Instagram profile. We do not bypass privacy settings. Private accounts you do not follow are not accessible.

Automatically

• Analytics — anonymous, cookie-less page views via Fathom Analytics.
• Whop attribution pixel — records page views and a small set of conversion events (creating an account, adding your first watched account, selecting a plan) so Whop can attribute subscriptions to the marketing that produced them. It runs on every page, including your dashboard while signed in. Unlike Fathom it is not cookie-less: it stores a persistent visitor identifier in a first-party cookie and in your browser’s local storage, derives a device fingerprint, and reads advertising click identifiers (such as gclid or fbclid) from the page URL. It also collects your screen size, browser language and time zone.
• Server logs — IP address and request metadata, retained for security and debugging.

3. How we use it

• Run the daily scan and serve your dashboard.
• Send digest emails and push notifications you opted into.
• Process payments and manage your subscription.
• Detect abuse, fix bugs, improve the product.

We do not sell your data. We do not share it for advertising. We do not train AI models on it.

4. Who we share it with

Only the third parties needed to operate the service:

• Google — sign-in only. See policies.google.com/privacy.
• Whop — payments, and marketing attribution via the Whop pixel described in section 2. See whop.com/privacy.
• Laravel Cloud / our hosting provider — application + database hosting.
• Email + push delivery providers — to deliver digests and notifications.
• Fathom Analytics — privacy-focused, cookie-less traffic analytics.

5. Where data lives

Application data is stored on EU-based servers. Backups are encrypted at rest. Account credentials use industry-standard hashing.

6. How long we keep it

• Account data — until you delete your account.
• Watched-account history — kept while your subscription is active. Deleted within 30 days of cancellation if you don't return.
• Whop billing records — retained as legally required (typically 7 years).
• Server logs — 30 days, then purged.

7. Your rights (GDPR)

If you're in the EU/EEA or UK, you have the right to:

• Access a copy of your data.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data (CSV export available in Settings while subscribed).
• Lodge a complaint with your local data protection authority.

To exercise any of these, email [email protected]. We'll respond within 30 days.

8. Cookies

We use one essential cookie to keep you logged in. Our own analytics (Fathom) is cookie-less.

The Whop attribution pixel described in section 2 does set a cookie: a first-party identifier used to link your visit to a later subscription. It also stores identifiers in local storage and derives a device fingerprint. If you do not want this, block t.whop.tw in your browser or an ad blocker — nothing on StalkyApp depends on it, and the service works normally without it.

9. The accounts you watch

StalkyApp watches public follow data and public stories. The watched accounts are never notified, contacted, or logged into. We process this public data on your behalf as the controller. If you watch someone in violation of local laws (stalking, harassment, restraining orders), you're responsible — not us. See the Terms.

10. Children

StalkyApp is for adults. You must be at least 16 (or the digital-consent age in your country, whichever is higher) to use it.

11. Changes

If we materially change this policy, we'll update the "Last updated" date and notify subscribers by email.

12. Contact

Questions, requests, or complaints: [email protected].