Privacy policy
What Peekghost records when you use it and why, and how to use your rights under the GDPR, UK GDPR, CCPA/CPRA, LGPD, India's DPDP Act and Israeli law.
Policy version 2026-10-29. Last updated 2026-10-29. Changes are listed on the changelog.
The short version
We show public Instagram content without you logging in, so Instagram does not see you. What our own server records is described below; it includes daily totals of page views and lookups, a seven-day visit log and a count of how often each public username is looked up. We set no analytics cookie. You may still see a consent banner: it is for the third-party advertising and analytics tags described below, if the operator has any switched on, and your answer to it stays in your browser.
Who is responsible
Peekghost is run by an independent operator based in Israel. It is not affiliated with Instagram or Meta Platforms, Inc.
- Contact for anything in this policy, including privacy requests: support@peekghost.com
We publish a contact mailbox rather than a company and a postal address because the site is run by one person, with no company.
What "anonymous" does and does not mean
- Anonymous towards Instagram and the account owner. When you look up a public account, our servers and our data providers fetch the public content. Your browser talks only to us. Instagram therefore sees a request from a provider, not from your device or your Instagram account, and no logged-in viewer is recorded in a story's viewer list. This works only for public accounts.
- Not anonymous towards your network or device. Your internet provider, employer, school or the device itself can still see that you visited this site, and your browser history records what you opened.
- We see your IP address while we answer you, as every web server does, and so do our hosting and network providers. Render Services, Inc., USA (Frankfurt, Germany region) and Cloudflare, which sits in front of it, keep their own logs under their own policies, which we do not control; see their privacy policies.
What we record
- The lookup you make. You send us a username or link; our servers ask a data provider for that account's public data and send it back to you. The provider receives the public username, not your IP address and not any cookie.
- Searching by name. If you search for a person by name instead of a username, the text you typed is sent to our server and on to the data provider, which returns matching public accounts. We do not store what you typed: it is not written to a log, an analytics row or an error report. To keep costs down we keep the list of matching public accounts for up to 24 hours under a hash of the search text (not the text itself), so the same search is not paid for twice. This happens only when you ask for a name search, never while you type.
- A visit log, for seven days. One row per visit: when it started (to the second), country, device type, browser, whether it looked like a bot, how the visitor arrived (channel and referring site), how many pages and how many searches. A second table ties each visit to the public accounts looked up during it: the username, the exact time, the outcome, the page and whether the answer came from cache. Neither table has an IP address, a cookie, a user or account identifier. Only the operator can read them, in the private admin area, and both are deleted after seven days; after that only the daily counts below remain.
- Daily counts. Our own server keeps counters, incremented as requests arrive and stored per day, never per person: page views by page, language, country, device type, browser, operating system, referring site and campaign parameters, and whether the request came from a search-engine crawler; how long pages were read and how far they were scrolled, summed per page; how often things were clicked, counted per page and target; and how many lookups happened, with what outcome. None of these rows contains an identifier, an IP address or a session.
- Which features get used. For each feature (for example the watchlist, name search, sharing, installing the app, theme and language) we count, per day, how many times each action happened and how many different people did it that day, optionally with one coarse category such as a list-size band ("2-5") or the kind of item. Whether a person already did it that day is decided in memory with a daily-rotating hash that is never saved; what is saved is only the two counts. We never store what you typed, the usernames you search for or watch, or what is on your watchlist (the watchlist stays in your browser).
- Lookup counts per username. For each day we count how many times each public username was looked up. That row holds a day, a username and a number — no IP address, no cookie, no session, nothing about who looked. We keep it because those lookups are what we pay for, so it is how we understand our own costs and which accounts drive them. It is data about the account holder, not about you, and we rely on our legitimate interest in running a service we can afford; account holders can object and ask us to delete it (see "People whose public accounts are looked up").
- A cost ledger. Every paid request we make to a data provider is recorded as one row: the time, which provider, whether it worked and what it cost us. We keep it to see what we are spending and to enforce a monthly ceiling, and it is deleted once its history has been folded into daily totals — for space, not for privacy.
- Rate limiting and abuse prevention. Per-IP limits and daily caps on paid upstream calls are applied in memory, while the request is being handled.
- Telegram alerts (optional). If you connect alerts we store your Telegram chat identifier, your language, the usernames you follow and a delivery log, until you send /stop.
- Requests you send us. Removal, copyright and privacy requests: username, reason, your message, an email address if you give one, and a salted (keyed) one-way hash of your IP address for rate limiting, saved with the request.
- Browser storage. Your watchlist, recent searches, theme and player settings are stored in your browser only; the list itself is never uploaded or saved on our servers. One thing to know: when you open the watchlist your browser asks us for the current stories of each account on it, one request per account, so our server handles those accounts at that moment (and your IP address, as with any request). We do not keep them together as a list: each request is handled like any other lookup, as described above. See "Cookies and browser storage".
- Your consent choice for third-party tags. If a consent banner appears, your answer is written in your own browser (the
cmcookie, listed below) and read back by the page. It is not sent to us and we keep no record of it; we used to keep one on the server, and that record and the endpoint behind it are gone. - Optional third-party services. If the operator enables Google Analytics, Microsoft Clarity, Google AdSense or advertising pixels (Meta, TikTok, Pinterest, Reddit, X, Microsoft Advertising, LinkedIn, Snap), those companies receive data from your browser and set their own cookies under their own policies — that is their processing, not ours, and it is the one thing on this page that could still identify you. The exact list that is enabled right now is at the bottom of this page; where the law requires consent, they load only after it has been given through that vendor's own consent message. If the list is empty, none of them is enabled.
- Google advertising. When Google AdSense is enabled, Google, as a third-party vendor, uses cookies to serve ads based on your visits to this and other websites. Google's use of advertising cookies lets it and its partners show you ads based on those visits. You can opt out of personalised advertising in Google's Ads Settings (Opens in a new window), and read how Google uses information from sites that use its services (Opens in a new window). Other ad networks the operator enables, such as Adsterra, are named in the list at the bottom of this page with a link to their own policy.
We do not make automated decisions with legal effects about you. Rate limits and bot detection are automatic and can block requests that look like scraping.
What we do not have
Because it is easier to check a list of absences than to trust a list of promises:
- No visitor identifier and no analytics cookie, in your browser or on our server.
- No server-side record of your consent answer: it is written and read in your browser only.
- No stored session identifier and no returning-versus-new numbers. Unique visitors, sessions and bounce rate are counted from a daily-rotating hash that lives only in memory (its salt is replaced every day, Israel time, and never written anywhere), so what is saved is a number, never an identifier.
- No city or region, only the country a request came from.
- No profiles of visitors and no profiles of the people who are looked up.
Why we use your data and on what legal basis
Where the GDPR or UK GDPR applies, each purpose has one lawful basis.
| Purpose | Data | Lawful basis | Notes |
|---|---|---|---|
| Delivering the lookup you asked for | The username or link you submit; your IP address and request headers, used to answer | Contract | Necessary to provide the free service you requested (Art. 6(1)(b)). |
| Rate limiting and counting unique visitors | IP address, user agent and request pattern, held in memory while the request is handled, including a daily-rotating hash (salt in memory only, replaced every day (Israel time)) that decides whether a unique-visitor counter moves | Legitimate interests | Art. 6(1)(f): per-IP limits, daily caps on paid upstream calls, and counting visitors without storing an identifier. |
| Fair use of the comments feature | A one-way hash of your IP address, with the day and a number of comment pages loaded | Legitimate interests | Art. 6(1)(f): stops one client loading unlimited paid comment pages. A counter, not a record of what you opened. |
| Security of the administrator area | IP address of each attempt to sign in to the private administrator page, and of actions taken there, in an audit log only the operator can read | Legitimate interests | Art. 6(1)(f) and Recital 49: detecting guessing of the administrator password. Visitors never reach this unless they try to sign in. |
| Counting traffic and usage (page views, dwell time, scroll depth, clicks, lookups and their cost) | Daily counts by page, language, country, device type, browser, operating system, referrer and campaign, and whether the request was a crawler. No identifier, no IP address, no session. | Legitimate interests | Art. 6(1)(f): knowing whether the site works and what it costs. There is no cookie and no device storage involved, so no consent is required and there is nothing to opt out of. |
| Visit log (7 days): when, country, device and browser type, how the visitor arrived, pages and searches, and which public accounts were looked up in each visit | One row per visit and one row per lookup within it. No IP address, cookie, user or account identifier in this table. Deleted after 7 days; only the operator can read it. | Legitimate interests | Art. 6(1)(f): checking that lookups work, spotting failures and bots, and understanding costs. |
| Counting how often each public username is looked up | Day, username, number of lookups. No visitor, visit, session or IP column exists in that table. | Legitimate interests | Art. 6(1)(f): those lookups are what we pay for, so this is our cost attribution. This is data about the account holder, not about the visitor, and it carries no link between the two; the account holder can object and ask for deletion (removal page). |
| Third-party analytics (Google Analytics, Microsoft Clarity), only if enabled | Page paths with usernames removed, approximate location, device, interactions -- collected by that vendor in your browser | Consent | Loaded only after consent is given where consent is required, through that vendor's own consent message. |
| Advertising and ad measurement (AdSense, Meta, TikTok and other pixels), only if enabled | Cookie and device identifiers, page views and coarse events, IP address -- collected by that vendor in your browser | Consent | Loaded only after consent is given where consent is required. Google ads in the EEA, UK and Switzerland are not served at all unless a Google-certified consent platform is in place. |
| Telegram alerts you request | Telegram chat identifier, language, the usernames you follow, delivery log | Contract | Only after you link a chat; stop any time with /stop. |
| Removal, copyright and privacy requests | Username, reason, message, contact address if given, salted (keyed) one-way hash of your IP address | Legal obligation | Art. 6(1)(c) and (f): handling your request and keeping a block in place. |
| Showing public Instagram content that account owners made public | Public profile data, stories, highlights and posts of the account you look up | Legitimate interests | Art. 6(1)(f). The account owner can ask us to block lookups on the removal page. |
Cookies and browser storage
We do not need cookies to show stories, and we set none of our own for analytics or advertising. The table lists everything this site itself stores in your browser: preferences you chose, your consent answer, a pointer if you connected Telegram alerts, and an administrator session that only the operator ever gets. Third-party services that the operator enables set their own cookies; they are described in the vendor list at the bottom of this page and in each vendor's own policy.
| Name | Type | Category | What it is for | How long |
|---|---|---|---|---|
| cm | Cookie | Strictly necessary | Remembers your choice about third-party advertising and analytics tags, plus the policy version and vendor list you saw. Written by the page itself, never sent to our server. Mirrored in localStorage under the same name. | 365 days |
| cm | localStorage | Strictly necessary | Copy of the consent choice, used if cookies are blocked. | Until you clear site data |
| __Host-ig_admin (ig_admin outside production) | Cookie | Strictly necessary | Signed administrator session for /admin (HttpOnly). Only ever set for the operator signing in; no visitor receives it. | 12 hours |
| theme | Cookie | Preference | Your light or dark theme, so the page renders in the right theme on first paint. Mirrored in localStorage. | 365 days |
| theme | localStorage | Preference | Your theme choice. | Until you clear site data |
| al | Cookie | Strictly necessary | Signed pointer to your Telegram alert subscription. Only set if you connect alerts, at your request. | 365 days |
| sv.recent-searches | localStorage | Preference | Your recent searches (usernames and a 72 px avatar thumbnail), kept on your device only. | Until you clear it or site data |
| ig:watchlist:v1:* | localStorage | Preference | Your watchlist, kept on your device only (fallback when IndexedDB is unavailable), plus a badge counter and last-refresh time. | Until you clear it or site data |
| peekghost-watchlist | IndexedDB | Preference | Your watchlist and archive, kept on your device only. Never uploaded. | Until you clear it or site data |
| sv.a11y | localStorage | Preference | Your accessibility options (text size, contrast, grayscale, link highlighting, readable font, text spacing, paused animation, large cursor), kept on your device only. | Until you reset it or clear site data |
| player:muted | localStorage | Preference | Whether the story player is muted. | Until you clear site data |
| sv.stories-view | localStorage | Preference | Grid or list view of stories. | Until you clear site data |
| ig.pubcfg.v1 | sessionStorage | Strictly necessary | Caches which third-party services are enabled, for 10 minutes, so the page can decide what may load. | Browser session |
| ig:pwa:views | sessionStorage | Preference | Counts pages viewed in this session to time the "install app" suggestion. | Browser session |
| ig-static-v2, ig-pages-v2 | Cache Storage | Preference | Service-worker copies of the app shell, static files and public pages for offline use. Profile pages, the API, embeds and anything carrying signed media links are never cached. | Until the next site version or you clear site data |
Where the law requires consent for the third-party tags, a banner asks for it before they load, and you can change your answer at any time with "Privacy choices" in the footer. Clearing this site's data in your browser removes all of it. If your browser sends a Global Privacy Control signal we treat it as an opt-out of advertising.
Who receives your data
| Who | Role | What they receive | Where |
|---|---|---|---|
| Hosting provider and network (server, backups) | Processor | Everything stored on the server, including the daily counts, the lookup counts per username and the content cache. They also necessarily see the IP address of every request in order to deliver the site, and keep their own logs under their own policies | See the international transfers section |
| Data providers that supply public Instagram data (for example RocketAPI, HikerAPI, RapidAPI) | Processors / independent providers | The public username or user id we look up. Your IP address and cookies are not sent to them. | Vendors are not location-controlled by us; treated as transfers |
| Instagram / Meta Platforms | Independent controller | Requests made by our providers for public content. Instagram sees our providers, not you. If you open an Instagram link yourself, Instagram's own policy applies. | Various |
| Telegram Messenger | Independent controller | Alert messages you asked for, and your chat identifier when you talk to the bot | Various |
| MaxMind GeoLite2 (offline database) | Not a recipient | A file on our server used to guess a country from an IP address, in memory, so a count can be attributed to a country. Nothing is sent to MaxMind. | On our server |
We do not sell personal data. We may disclose what we have to authorities when the law requires it.
International transfers
The operator is in Israel and the servers are hosted by Render Services, Inc., USA (Frankfurt, Germany region). Visitors come from all over the world.
- Israel. The European Commission and the UK recognise Israel as providing an adequate level of protection, so personal data of EU and UK visitors can be handled by the operator in Israel without further safeguards.
- Other countries. Data providers in the United States and elsewhere receive the public username being looked up, as described above. Where required we rely on the EU-US Data Privacy Framework (and its UK extension) for certified providers, or on the European Commission's standard contractual clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the safeguards.
- Brazil and India. Transfers are made to providers and countries that give a level of protection compatible with the LGPD (Art. 33) and, for India, to countries not restricted by the government under the DPDP Act.
How long we keep it
| Data | How long | Basis / setting |
|---|---|---|
| Your IP address and request pattern for rate limits, and the daily unique-visitor count | Held in memory while requests are handled; the unique-visitor hash uses a salt that lives only in memory and is replaced every day (Israel time) | Art. 6(1)(f); protecting a free service and counting visitors |
| One-way hash of your IP address in a per-day comment fair-use counter (day, hash, number) | Rows deleted after two days; the hash uses a key that exists only in memory and changes daily; not shown to anyone but the operator | Art. 6(1)(f); fair use of the comments feature |
| IP address of attempts to sign in to the administrator page, in the audit log (also present in the backups of the main database) | Deleted after 90 days; readable only by the operator | Art. 6(1)(f) and Recital 49; security |
| Your IP address as seen by our hosting provider and the network in front of it | Under their own logging policies, which we do not control; see their privacy policies | They need it to deliver the site |
| Visit log: one row per visit (start time, country, device type, browser, bot flag, how it arrived, pages and searches) and the public accounts looked up during each visit (username, time, outcome, page, cache flag). This table has no IP address, cookie or account identifier | Deleted after 7 days, automatically; readable only by the operator. After that only the daily counts remain | Art. 6(1)(f); seeing whether the site works and what the lookups cost |
| Daily counts of page views, dwell time, scroll depth, clicks, lookups and their cost, by page, country, device, browser, referrer and campaign | Kept as long as the site runs. They contain no identifier, so there is nothing in them that ages into a risk | Operating and paying for the service |
| Lookup counts per public username (day, username, number) | Kept as long as the site runs; deleted for an account on the owner's request | Cost attribution (Art. 6(1)(f)); see the removal page |
| Cost ledger: one row per paid upstream request (time, provider, outcome, what it cost) | Kept at least 32 days, then deleted once its history has been folded into the daily totals | Operational: it bounds the database, and the monthly spend cap has to be able to count a whole month |
| Application container logs (errors and warnings) | Rotated by size rather than by date, so the span varies; normally days. They carry no visitor identifier and no searched username | Diagnosing faults |
| Telegram alert subscription (chat identifier, followed usernames, delivery log) | Until you send /stop or delete it; then removed | Only if you connect alerts |
| Nightly backups of both databases, kept on the same server | One backup a night, the newest 14 are kept, then overwritten. A backup holds the data as it was that night, so a record deleted after its own retention period (for example a visit-log entry after seven days) can still sit in older backups for up to 14 more days, until they roll off | Disaster recovery; a deletion reaches the backups as they roll off |
| Removal and copyright requests (username, reason, contact address if given, salted IP hash) | Kept while the block or dispute is in force, then reviewed at least yearly | Needed to keep a block in place and to answer disputes |
| Cached public Instagram profile and story metadata (names, bios, counts, media links) | Fresh for minutes to hours (profiles and highlights 6 hours, posts 3 hours, stories 15 minutes, not-found and private answers 15-60 minutes); expired rows are deleted 7 days after their stale window ends | Performance cache; pruned automatically |
| Resized copies of public images (profile pictures, story and post images) | Kept in a size-capped disk cache; the least recently used files are deleted first, so the time varies with traffic | Performance cache; see the methodology page |
| Videos and original-size files | Streamed through us and not stored | See the methodology page |
Your rights and how to use them
Depending on where you live you may have the right to: know what we hold about you and get a copy; correct it; delete it; restrict or object to processing; receive your data in a portable format; withdraw consent; not be discriminated against for using your rights; and complain to a regulator.
If you own an Instagram account, you can ask us to stop lookups of it and to delete the lookup counts recorded for that username. Use the removal page or write to support@peekghost.com. We may ask you to show that you control the account, for example by posting a short code in its bio.
Third-party services, if any are enabled, are controlled by those companies. Their cookies are removed by clearing this site's data in your browser, and their own policies say how to exercise rights against them.
How fast. We confirm your request and answer within one month (30 days) of receiving it. If we need more time or more information we tell you within that period, and we may extend once where the law allows. For requests under Brazilian law we send a simplified answer immediately where possible and a full answer within 15 days. There is no fee unless a request is clearly unfounded or excessive.
Complaints. You may complain to your data-protection authority: in the EU/EEA the authority of your country of residence, work or the alleged breach; in the UK the Information Commissioner's Office; in Switzerland the FDPIC; in Brazil the ANPD; in Israel the Privacy Protection Authority; in California the Attorney General or the California Privacy Protection Agency. We would appreciate the chance to fix things first.
California residents (CCPA/CPRA) and other US states
- Categories collected in the last 12 months: the information described under "What we record" above. We do not collect sensitive personal information.
- Sources and purposes: from the requests your browser makes, to operate, secure, understand and pay for the service. Recipients are the service providers listed above.
- We do not sell or share personal information. If advertising services are enabled, those vendors may receive identifiers and browsing data from your browser for advertising and measurement, which US state laws call "sharing" or "sale" — that is their collection, and a Do Not Sell or Share My Personal Information link appears in the footer when it applies. We also treat a Global Privacy Control signal from your browser as that opt-out. Whether advertising services are enabled right now is shown in the vendor list at the bottom of this page.
- Your rights: know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information (not applicable), and non-discrimination. An authorised agent may submit a request with your written permission. We answer within 45 days.
- We have no actual knowledge that we sell or share the personal information of anyone under 16.
Brazil (LGPD)
Our legal bases are those in the table above, expressed in LGPD terms: performance of the service you asked for, legitimate interest (security, cost control, showing public content) with the safeguards described here, and compliance with legal obligations. You have the rights of Art. 18 (confirmation, access, correction, anonymisation or deletion, portability, information about sharing, withdrawal of consent and review of decisions). The contact for data protection (encarregado) is support@peekghost.com.
India (DPDP Act, 2023)
For visitors in India we process personal data only for the "legitimate uses" the Act allows — providing the service you request, security and legal compliance. You have the right to information, correction and erasure, grievance redressal, and to nominate another person to exercise your rights. Grievance contact: support@peekghost.com. We do not track or target advertising at children (in India, anyone under 18) and we do not knowingly process their data.
Israel
We process personal data in line with the Protection of Privacy Law, 5741-1981. You may ask to see and to correct data we hold about you, and you may complain to the Privacy Protection Authority.
People whose public accounts are looked up
The tool displays public content that account owners chose to make public on Instagram, obtained from commercial data providers and, for some public data, Instagram's public endpoints. This includes public profile details (name, username, biography, counts, profile picture), stories, highlights and posts. We cache this metadata for a limited time so repeat lookups are fast (see the retention table) and keep resized copies of public images in a size-capped cache.
The only lasting record we keep about an account is how many times its username was looked up on a day, with no information about who looked. We rely on our legitimate interest in knowing what our own costs are made of. We do not build profiles of the people looked up, we do not display private accounts, and we do not tell anyone who looked. If you own or represent an account (or are a parent of a minor who owns it) you can ask on the removal page for lookups of that account to be blocked and for its lookup counts to be deleted.
Children
The service is intended for people aged 16 and over (13 and over in countries where that is the lowest age at which a child can consent to online services). It is not directed at children, and we do not knowingly collect personal data from children under 13, or under the local age of digital consent for consent-based processing. If you believe a child has given us data, or that a minor's account is being looked up, contact us or use the removal page and we will act promptly.
Security
What we keep is stored on our own server. Access to the admin area requires a strong password and can be limited by IP address, admin actions are logged, and deletion requests are logged by a hash of the subject, never the subject itself. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.
Changes to this policy
When we change this policy in a material way we change the version number above and add an entry to the changelog.
Third-party tags on this site
The following third-party services are currently enabled. Their scripts load only after the matching consent in the cookie banner (visitors in the EEA, UK and Switzerland are asked first; you can change your choice at any time via “Privacy choices” in the footer). Google advertising is not served at all to visitors in the EEA, UK and Switzerland unless a Google-certified consent platform is in place.
- Adsterra: Adsterra serves advertising (banners, native ads and, when enabled, a social bar or pop-under); Adsterra and its ad partners may use cookies and device identifiers for ad delivery, fraud prevention and measurement. Vendor privacy policy