Privacy Policy
Last updated 7 August 2026 · FollowSort
FollowSort sorts the accounts an Instagram user follows by topic. This page describes exactly what we collect, why, who we send it to, and how to get rid of it. It describes what the service actually does — not what we might do one day.
The short version
- We never ask for, receive, or store your Instagram password. There is no login.
- We only read information Instagram already shows publicly. Private accounts cannot be processed at all.
- We don't use cookies and we don't run advertising or analytics trackers.
- We don't sell your data or share it for marketing.
- You can ask us to delete everything tied to you at any time.
What we collect
| What | Why |
|---|---|
| The Instagram handle you type in | To look up the public following list you asked us to sort, and so you can reopen your results later |
| Public profile information about the accounts that handle follows — username, display name, biography, category, external link, verification status, and how recently the account posted | This is the product. Topics are derived from this text |
| The topic label assigned to each account | To build your dashboard and CSV export |
| A salted, irreversible hash of your IP address | To enforce rate limits and stop automated abuse. We do not store your raw IP address |
| Your email address, if you buy | Collected by Stripe at checkout and passed to us so you can recover your purchased results |
| Payment records — Stripe identifiers, amount, and fee | Accounting. We never see or store your card details |
| Basic usage events — a page was visited, a run started, a paywall was viewed, a purchase happened | To understand whether the product works. These are counts, not profiles of you |
What we never collect
- Your Instagram password, or any Instagram login or session token.
- Direct messages, private posts, stories, or anything behind a private account.
- Your card number, expiry, or security code — those go directly to Stripe.
- Location data, contacts, or device identifiers.
About the accounts you follow
To sort your following list we necessarily process information about other people's public Instagram profiles. We only ever read what Instagram publishes publicly, we do not attempt to access private accounts, and we do not build advertising profiles or contact anyone.
If you are the owner of an Instagram account and want your public profile information removed from our cache, email 609poncho@gmail.com and we will delete it.
Who we share it with
We use a small number of processors. Each receives only what it needs:
| Service | What it receives |
|---|---|
| Apify | The handles to be looked up, in order to retrieve public Instagram data |
| Anthropic | Public display names, biographies and categories, in order to assign a topic. Anthropic does not train on data submitted through its commercial API |
| Stripe | Payment details and your email, if you buy. Stripe is the controller of your card data |
| Railway | Hosting and the database. Data is stored in the United States |
Our pages also load fonts from Google Fonts and icons from jsDelivr. Those providers will see your IP address and browser user-agent as a normal consequence of your browser fetching a file from them. They receive nothing else about you, and we send them nothing.
We will disclose data if legally required to, and we would transfer it as part of a sale of the business. Nothing else.
How long we keep it
- Cached public profiles: reused for up to 30 days, then refetched. This is what keeps the service cheap enough to run.
- Your run and its results: kept so you can reopen a dashboard you paid for.
- Payment records: kept as long as accounting and tax rules require.
- Everything else: deleted on request.
Your rights
Depending on where you live you may have the right to access, correct, export, or delete your personal data, to object to processing, and to complain to a data protection authority. We honour these requests regardless of where you live.
To exercise any of them, email 609poncho@gmail.com. We'll confirm within a few days and action it within 30 days. Deletion is permanent — if you delete a purchased run, we cannot restore it.
If you are in Mexico — derechos ARCO
Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares you have the rights of Acceso (to know what data we hold and how we use it), Rectificación (to correct it), Cancelación (to have it deleted), and Oposición (to object to a particular use). You may also limit the use or disclosure of your data without cancelling it outright.
Send any ARCO request to 609poncho@gmail.com, stating which right you are exercising and enough detail for us to identify your data — normally the Instagram handle you submitted, and the email you paid with if you made a purchase. We will respond within 20 business days as the law requires. There is no charge. If you are unsatisfied with our response you may complain to the INAI.
Security
Traffic is encrypted in transit. IP addresses are stored only as salted hashes. The administrative dashboard is password protected. No system is perfectly secure, and we don't claim otherwise.
Children
FollowSort is not intended for anyone under 16, and we don't knowingly process their data. If you believe a child's data is here, email us and we will remove it.
Changes
If this policy changes materially we'll update the date above. Continuing to use FollowSort after a change means you accept the revised policy.
Contact
FollowSort — 609poncho@gmail.com