Privacy Policy

The short version.

When you are not signed in, nothing leaves your browser. Your snapshots are kept on your own device, in your browser's local storage.
If you sign in, your snapshots are stored in a database, so you can reach them from any device you sign in on with the same email address. Only your own account can read them.
Signing out returns the device to local-only; the uploaded snapshots stay in your account on the database until you sign back in and delete them, or delete the account. Deleting the account erases everything stored under it. The snapshots stay locally on your device after the deletion. From then on they are yours and they live only locally in your browser.

Who is responsible

Social Signal Scanner is run by an individual in the Netherlands. For anything in this policy, including any requests, write to support@socialsignalscanner.com.

To be clear about what that covers: under the GDPR Social Signal Scanner is the controller of the data described under “If you sign in” below, and only of that. It is not the controller of anything that stays locally in your browser, because none of that ever reaches Social Signal Scanner.

If you sign in

Signing in is the only way anything is uploaded, and it exists for that one purpose: keeping a backup and reaching your history from another device. It stores:

Your email address, which is what identifies the account. There is no password. You receive a link and a code by email to log in.
Your snapshots: the follower and following usernames in each list you upload or paste, the date of each snapshot, and where Instagram's export provides them, the dates people followed you.
Accounts you have hidden, and your theme setting.

This is held in a Supabase project hosted in Ireland. Every table is protected by row-level security scoped to your own account id, so no other user of the app can read your rows. Signing in does not take anything away from your device: your snapshots stay in your browser and they are also stored in the database.

If you don't sign in

The app works fully without an account, and this is the default. Everything is kept in your browser's local storage on your own device:

Your snapshots: the follower and following usernames in each list you upload or paste, the date of each snapshot, and where Instagram's export provides them, the dates people followed you.
Accounts you have hidden, and your theme setting.
Your app preferences.

None of it is transmitted anywhere. There is no analytics, no advertising, no tracking pixel and no third-party script of any kind, specifically so that loading the page does not reveal your IP address to anyone else. Clearing your browser data deletes all of it. Clear everything in the app deletes the snapshots and the accounts you have hidden, and leaves your preferences as they are.

Who else processes data

Three services, each doing one job:

Supabase: the database and sign-in.
Resend: sends the sign-in email. It sees the address the email goes to.
Cloudflare: serves the site. Like any web host it processes the IP address of requests.

Resend and Cloudflare are US companies and may process data outside the EEA under their own published safeguards. There is no advertising network, no analytics provider and no data broker involved, because the app does not use any.

Cookies

The app sets no cookies and there is nothing to consent to.

How long things are kept

If you are not signed in: everything stays on your device until you delete it yourself. Nothing expires on its own.
If you are signed in: the same is true, and what is stored in your account stays there until you delete it as well. Deleting things while signed out does not change the account, so you have to be signed in for a deletion to reach it. Deleting the account removes everything stored under it, which is the snapshots, the accounts you have hidden and your app preferences, and it cannot be undone. The snapshots on your device are left alone on purpose after the deletion.
Paid plan: ending a subscription or paid plan does not delete anything. It only stops you uploading new snapshots beyond the maximum for your plan. Reading, downloading and exporting keep working, and whatever is in your account stays there until you remove it yourself.

Your rights

Under the GDPR you have rights over any data held about you: getting hold of a copy, having it corrected, having it deleted, restricting or objecting to the way it is held, and taking it elsewhere in a portable file. Two of those are buttons here rather than requests: Save backup exports your whole history as a file, and Delete account erases the stored copy immediately. For anything else or any questions, write to support@socialsignalscanner.com.

If you think your data has been handled wrongly, you can also complain to a data protection authority. For Social Signal Scanner that is the Dutch Autoriteit Persoonsgegevens, and you may also go to the authority in the country you live in.

Security

The site is served over HTTPS only. Access to the database is enforced by row-level security in Postgres rather than by the app, so a modified or malicious client cannot read another account's rows.

Children

The app is not intended for children under 18, and no account should be created by one.

Changes

This version is from 28 August 2026, and that date changes whenever the policy does.