Privacy Policy

1Data controller

The data controller is SPYGRAM, 66 avenue des Champs-Élysées, 75108 Paris, France. For any question about your data: privacy@spygram.app.

2Data we collect

• Account: your email and password, managed via Firebase Authentication (Google). The password is encrypted and never visible to us.
• Device identifier & usage: a unique ID (UUID) generated locally, linked to the app screens you open and when, to the country inferred from your IP address (no precise location), and to which variant you were shown during our layout tests. We use this to understand where people stop in the app and improve it. It carries neither your name nor your email, but since the identifier is persistent, it remains personal data.
• Subscription: your Apple transaction ID, the product purchased, the amount and the payer account's country, used to verify your subscription with Apple and keep our accounts.
• Instagram session: you log into your own Instagram account in a WebView. We don't store your Instagram password; a session identifier remains on your device to keep you signed in.
• Tracked activity: the following history of the profiles you track is stored locally on your device. The list of profiles you chose to watch (public Instagram ID and username), however, is stored on our servers so that tracking keeps working when you change device.
• Our campaign links: when you open a spygram.app/go/… link shared on our social accounts, we count the click. Your IP address and browser are used only to avoid counting the same click twice: they are turned into an irreversible fingerprint, kept for a few seconds, and never stored in clear.
• Diagnostics & usage: technical crash and performance data via Microsoft App Center, to improve stability.
• Emails we send you: our sending provider (Brevo) records when our emails are opened and when their links are clicked, using an invisible image and redirect links. This tracking is built into their service and we cannot turn it off. We use it only to know whether our messages are read, never to profile you. Most email clients let you block remote images, which prevents open tracking.
• Visits to this site: we measure spygram.app traffic with Vercel Analytics, which sets no cookie and builds no profile: it counts page views without being able to recognise you from one visit to the next.
• Waitlist: if you enter your email on our waitlist page, it is sent to Kit (ConvertKit) and used only to tell you about what that page announces. You can unsubscribe from any of those emails.

3Purposes

We use this data to provide and maintain the tracking service, manage your account and subscription, send notifications (if you allow them), email you about Spygram news and updates (unless you opt out), measure whether those emails are opened and read, and diagnose technical issues.

4Legal basis (GDPR)

• Performance of contract: account, subscription, tracking features.
• Consent: push notifications (revocable anytime in iOS settings).
• Legitimate interest: security, fraud prevention and technical diagnostics.
• Legitimate interest: product update emails sent to account holders, and measuring their opens through our sending provider. You can opt out at any time via the unsubscribe link included in every such email, without losing access to the service. Emails related to your account (security, subscription) will still be sent.

5Sharing & processors

We do not sell your data. We rely on processors acting on our behalf: Apple (payments and subscriptions), Google Firebase (authentication, database), Microsoft App Center (diagnostics), Brevo (sending and open-tracking our emails, data hosted in the European Union), Kit (waitlist), Vercel (hosting this site and measuring traffic) and Netlify (hosting our API). Each is bound by its own confidentiality obligations.

We also keep a copy of our usage and subscription statistics on a computer we administer ourselves, in France, to limit the cost of querying our main database. That copy is accessible to us only, over an encrypted link, and contains neither your password nor your Instagram session.

6Transfers outside the European Union

Some of our processors are established in the United States (Apple, Google Firebase, Microsoft, Vercel, Netlify, Kit). Your data may therefore be transferred outside the European Union, relying on the mechanisms provided by the GDPR — the European Commission's standard contractual clauses and, where applicable, Data Privacy Framework certification. Write to privacy@spygram.app to find out more. Brevo, which sends our emails, hosts its data in the European Union.

7Instagram & public data

Spygram only reads information that is already public on Instagram (following lists of public accounts, or private accounts you already follow). Tracking incoming followers is not possible. Your use must comply with Instagram's terms and respect others' privacy.

8Retention

Account data and the list of watched profiles are kept while your account exists, and erased within 30 days of its deletion. Activity history stays on your device: it disappears when you remove a tracked profile or uninstall the app. Payment recordsare kept for 10 years, as accounting law requires. Usage statistics tied to the device identifier are kept for at most 25 months. Click fingerprints on our links expire within seconds. Finally, if you unsubscribe from our emails, we keep your address on an opt-out list: that is the only way to stop writing to you, even if you create a new account later.

9Your rights

Under the GDPR, you have rights of access, rectification, erasure, objection, restriction and portability. You can delete your account directly in the app via Settings → Delete your Account, or write to privacy@spygram.app. You may also lodge a complaint with your data protection authority.

10Security

We implement reasonable technical and organizational measures to protect your data. However, no transmission over the Internet is fully secure.

11Minors

Spygram is intended for people aged 17+ and is not directed at children.

12Lawful use

13Changes

We may update this policy. The "last updated" date at the top indicates the current version.

14Contact

Questions? privacy@spygram.app