Methodology: how we test and what we record

This page is the plain-language version of what the site does behind the scenes. If something here stops being true, it is a bug and the page gets fixed.

How content is fetched

When you look up a public username, our servers ask commercial data providers (and, for some public data, Instagram's own public endpoints) for that account's public profile, stories, highlights and posts. Your browser only ever talks to us. Instagram therefore sees a request from our infrastructure, not from you, and there is no logged-in viewer for it to record in a story's viewer list.

Results are cached so repeated lookups are fast and do not multiply upstream requests: profile data for up to six hours, active stories for fifteen minutes, highlights for about six hours, posts for about three hours, and "not found" or "private" answers for 15 to 60 minutes. Stories that have expired on Instagram are filtered out when served. Cached text metadata (names, biographies, counts, media links) is deleted a week after its cache window ends.

What our servers log

• Visit log (7 days): one row per visit with its start time, country, device type, browser, bot flag, how the visitor arrived, and the number of pages and searches, plus a second table listing which public accounts were looked up during each visit (username, time, outcome, page, cache flag). Neither table has an IP address, cookie or account identifier, only the operator can read them, and both are deleted after seven days.
• Lookups and analytics: we count, per day, how many lookups happened, with the outcome (found, private, not found, error), which data provider answered and what the upstream request cost us — and, separately, how many times each public username was looked up. We also count page views, reading time, scroll depth and clicks per page, with country, device, browser, referrer and campaign as attributes of the count. None of these counts holds an IP address, a cookie identifier or a session; rate limits and the unique-visitor count are worked out in memory (the unique-visitor count through a daily-rotating hash that never leaves memory). The privacy policy has the full list, the lawful bases and the retention table.
• Media: we do not keep Instagram videos or original-size files: they are streamed through a signed, short-lived link. We do keep resized copies of public images (profile pictures, story and post images) in a size-capped disk cache; the least recently used files are removed first, so the time a copy stays varies with traffic.
• Alerts (optional): if you connect Telegram alerts, we store the chat identifier and the accounts you chose to follow, until you stop the bot or delete them.
• Removal requests: the username, the reason you gave, your message, the contact address if you provided one, and a salted (keyed) one-way hash of your IP address.

What stays in your browser

Your watchlist, recent searches, theme, language and player settings, and the installation prompt state are stored in your browser only, and we set no analytics cookie at all. Your answer to the consent banner for third-party tags is also kept in your browser only — we no longer record it on the server. The privacy policy lists every cookie and storage key. Clearing site data removes them.

Corrections

If something on this page is wrong, tell us and we will check it and publish the correction.