Privacy Policy

IG Exporter is designed to process public profile and follower information without requiring an Instagram login. This policy describes the current application architecture and the third-party services involved in operating it.

When you check a profile or start an export, you provide an Instagram username, @username, or profile URL. The application normalizes that input to a username. The profile-check and export interface does not require an account, password, physical address, or Google login. A Waffo Pancake hosted checkout may request processor-controlled billing or contact information directly when paid plans are offered. If you later choose billing recovery, Supabase Auth processes the email you submit to send a one-time verification link.

• The submitted Instagram username or profile URL and the normalized username used for the request.
• Public profile information and public follower rows returned in response to the request, including only fields present in that response.
• A generated export CSV and its download metadata. Standard export files remain temporary; the Unfollower Tracker separately stores stable public follower identities in long-lived snapshots so complete snapshots can be compared over time.
• A Cloudflare Turnstile token used for server-side bot verification before follower requests.
• Request, device, network, security, performance, and error information that may be processed by Cloudflare, Vercel, or their infrastructure.
• Page views and product events processed by Vercel Web Analytics. Product-event properties do not include the submitted username, follower rows, or CSV content.
• For paid checkout, the selected plan, product identifier, amount and currency, checkout status, and transaction or subscription identifiers handled by Waffo Pancake and returned through checkout or signed webhook events.
• For optional billing recovery, Supabase Auth processes the submitted email and a temporary authentication session. Application billing tables store only a keyed, non-reversible email identity HMAC rather than the plaintext payment or recovery email.

The server sends the normalized username to a third-party service that supplies public Instagram data in order to request available public profile or follower information. Follower requests begin only after profile review, bot verification, and an explicit export action. The server maps the fields actually returned in the response and generates the CSV during that export request.

Standard follower exports and generated CSV files are temporary. The Unfollower Tracker maintains a separate, long-lived database of public follower snapshot members, stable Instagram account identifiers, usernames, available public presentation fields, collection diagnostics, and capture times. These snapshots are shared by target profile so the same recent public follower list does not need to be requested repeatedly.

The most recently checked public profile may be stored in browser localStorage under igexporter:last-profile for up to 30 minutes so the profile card can be restored after a refresh. It contains the last validated public profile response and estimate. It does not contain follower export rows, a generated CSV, a Turnstile token, API keys, or the Waffo private key. Expired or invalid entries are removed when the application reads them.

• A third-party public data service receives the normalized username from the server and returns available public Instagram data.
• Cloudflare Turnstile processes a verification token and request information to help prevent automated abuse before an export.
• Vercel hosts the application and provides Web Analytics for page views, visitors, and limited product events.
• Waffo Pancake provides payment processing when paid plans are offered. It processes checkout, payment, transaction, and subscription information.
• Supabase stores billing ledger records and provides passwordless email verification for optional purchase recovery.

Payment processing is provided by Waffo Pancake. Full payment card information is handled by the payment processor and is not stored on IG Follower Exporter's servers.

These providers process information under their own terms and privacy practices. IG Exporter does not send Instagram usernames, follower lists, CSV content, API keys, payment secrets, or Turnstile tokens as analytics event properties.

The application does not require a persistent login account or password. It uses an HTTP-only billing identity cookie, the limited 30-minute localStorage profile cache described above, and Vercel Web Analytics for page views and product events. Optional billing recovery temporarily uses Supabase Auth cookies to complete email verification; that Auth session is cleared after the recovery attempt. Cloudflare Turnstile, Vercel, Waffo Pancake, or Supabase may use cookies or similar technologies according to their own services and configuration.

API keys and other credentials are kept on the server, and follower exports require server-side bot verification. Reasonable safeguards are used to reduce unauthorized access or disclosure, but no internet service or storage method can be guaranteed completely secure.

The local profile cache is accepted for up to 30 minutes and is then treated as expired. Standard export CSV files remain temporary, while complete and incomplete Unfollower Tracker snapshots are retained to support later identity-level comparison and data-integrity diagnostics. A Turnstile token is cleared from the interface after use and is not stored in the application database.

Retention periods for Vercel operational logs, Vercel Web Analytics data, Cloudflare security data, Waffo Pancake transaction and subscription records, and support communications are controlled by the relevant provider policies and account settings rather than this application repository.

Depending on the law that applies to you, you may have the right to know about or access personal information, correct inaccurate information, request deletion, restrict processing, receive portable data, object to certain processing, withdraw consent where processing relies on consent, and complain to the relevant data-protection authority.

These rights are subject to legal limits and may not apply in every case. To submit a request, email [email protected]. Reasonable identity verification may be required before acting on a request.

You can avoid submitting a username, choose not to start an export, clear this site's localStorage through your browser, block optional browser storage, or stop using the service. Blocking required security features may prevent exports from working.

The Service is intended for users aged 18 or older. IG Exporter is not directed to children and does not knowingly invite anyone under 18 to use the service. Do not submit personal information about children through the service.

The service and its providers may process information in multiple jurisdictions, including countries other than your own. Those locations may have different data-protection laws. This policy does not claim that specific Standard Contractual Clauses, Binding Corporate Rules, adequacy decisions, or data-processing agreements are in place unless separately confirmed.

This policy may be updated when the application, providers, or legal requirements change. The latest version will be posted here with a revised last-updated date.

For privacy requests, billing questions, or general support, email [email protected].

This policy should be read together with the Terms of Service.