Methodology: how we test and what we record

This page is the plain-language version of what the site does behind the scenes. If something here stops being true, it is a bug and the page gets fixed.

How content is fetched

When you look up a public username, our servers ask commercial data providers (and, for some public data, Instagram's own public endpoints) for that account's public profile, stories, highlights and posts. Your browser only ever talks to us. Instagram therefore sees a request from our infrastructure, not from you, and there is no logged-in viewer for it to record in a story's viewer list.

Results are cached so repeated lookups are fast and do not multiply upstream requests: profile data for up to six hours, active stories for ten minutes, highlights for about an hour, posts for about half an hour, and "not found" or "private" answers for 15 to 60 minutes. Stories that have expired on Instagram are filtered out when served. Cached text metadata (names, biographies, counts, media links) is deleted a week after its cache window ends; a cleanup runs every six hours.

What our servers log

• Lookups and analytics: for each search we store the username or link you searched, a timestamp, your IP address, the outcome (found, private, not found, error), how long it took, which data provider answered, and what the upstream request cost us. This lookup record is part of our security and cost controls and is kept even if you decline analytics cookies. If analytics is on (in the EEA, UK and Switzerland only after you accept it) we also record a random visitor identifier, pages visited, time on page, scroll depth, approximate location, device and clicks. We use this to keep the tool healthy, prevent abuse and control costs. Raw records are kept for 90 days and IP addresses are shortened after 30 days; only aggregate daily totals remain after that. Nothing is sold or given to advertisers, and you can opt out on the analytics choices page. The privacy policy has the full list, the lawful bases and the retention table.
• Web server logs: IP address, time, path, status and user agent, kept up to 14 days. Lookup, profile, story and embed URLs are excluded, and the Referer header is dropped, so the username you searched is not written next to your IP address there.
• Media: we do not keep Instagram videos or original-size files: they are streamed through a signed, short-lived link. We do keep resized copies of public images (profile pictures, story and post images) in a disk cache limited to 200 MB by default; the least recently used files are removed first, so the time a copy stays varies with traffic.
• Cookie choices: each time you use the cookie panel we keep a record of the time, the policy version, your choices and a coarse country, without any identifier, for up to three years.
• Alerts (optional): if you connect Telegram alerts, we store the chat identifier and the accounts you chose to follow, until you stop the bot or delete them.
• Removal requests: the username, the reason you gave, your message, the contact address if you provided one, and a salted hash of your IP address.

What stays in your browser

Your watchlist, recent searches, theme, language and player settings, and the installation prompt state are stored in your browser only, plus a small choices cookie. The privacy policy lists every cookie and storage key. Clearing site data removes them.

How the status page is measured

Every few minutes we request each tracked site from our own monitors and record whether it answers, how fast, whether it returns a block page (for example an HTTP 451 legal block), a challenge page, a parked page, or a redirect to a different domain. We also check domain registration and nameserver changes so ownership changes are visible. Uptime figures on the status pages are computed from those checks and nothing else. We never call a competitor's private API.

Corrections

If a status claim about your site is wrong, tell us and we will re-check it and publish the correction.