Privacy Policy

1. Who is responsible

FollowLens (the “app” and the “website”, together the “Service”) is made by Federica Benacquista, an individual developer, Via del Lido 106, 04100 Latina (LT), Italy (“we”, “us”). For the limited personal data described in this policy, we are the data controller under the EU General Data Protection Regulation (GDPR) and similar laws.

Contact for anything about privacy: support@copycut.it (please put “FollowLens Privacy” in the subject). We are not required to appoint a Data Protection Officer and have not done so.

2. What FollowLens is, and what it is not

FollowLens helps you read the data export that Instagram itself gives you when you use Instagram’s “Download your information” or “Export your information” feature. From the files in that export it works out, for example, which accounts you follow that do not follow you back, your mutual follows, how your lists changed between exports, and statistics about your messages and activity.

FollowLens is an independent product. It is not affiliated with, associated with, endorsed by, sponsored by or approved by Instagram, Threads, Meta Platforms, Inc. or any of their affiliates. Instagram and Threads are trademarks of Instagram, LLC and Meta Platforms, Inc.; we use these names for identification and descriptive purposes only, to say which files FollowLens can read. Meta is not responsible for FollowLens and does not process any data for us.

FollowLens does not connect to your Instagram account. It never asks for, stores or uses your Instagram username and password, session, cookies or access tokens: not in the app, not on the website, not through an embedded browser. It does not use Instagram’s systems, does not collect (“scrape”) information from Instagram, and never follows, unfollows, likes, comments or messages anyone for you. Everything it shows comes from the files you choose to open.

3. Your Instagram export

You request the export from Instagram, Instagram prepares it and you download it. That exchange is between you and Meta, under Instagram’s Privacy Policy. We are not involved in it.

In the app

• When you import an export, the app reads it on your device. The export and the results are never uploaded to us or to anyone else, and the analysis works offline.
• The app keeps what it needs to show you results and compare future exports, in a private database inside the app’s storage on your device: the lists of accounts (usernames, display names where present, and the dates recorded by Instagram), counts and dates of messages and activity, and the notes, review statuses and labels you add yourself.
• The text of your messages is discarded while the export is read and is never stored. For messages the app keeps only the time, who sent it and its type (for example text, photo, voice note, reaction).
• Temporary copies made while importing or sharing are deleted afterwards. If you let the app watch a folder for new exports, it only reads file names, sizes and dates there until you import a file, and you can withdraw that access at any time (“Stop using this folder”).
• The app’s data can be included in the device backups that you yourself turn on (iCloud Backup or a computer backup), which Apple protects under your Apple Account; we cannot access those backups.
• You can delete one import, one workspace or all local data from the app at any time (More → “Delete all local data”). Deleting the app deletes everything it stored.

On the website

The website lets you analyse an export once, inside your browser tab. The file is read by code running in your browser; it is not uploaded, not saved and not kept after you close or refresh the tab. The analyser never sends it anywhere: the website’s security settings let the page talk only to Google Analytics, which loads only if you accept visit statistics and never receives your export (see section 9).

Because we never receive your export, we cannot see it, recover it, correct it or delete it for you. You hold the only copy, and you decide what to do with it.

4. Other people in your export

Your export also contains information about other people, for example the usernames of your followers and of the accounts you follow, and when you exchanged messages with someone. FollowLens reads this only on your device and only to show it to you. We never receive it.

Using your own export for purely personal purposes is generally outside the scope of the GDPR (the so‑called “household exemption”, Article 2(2)(c) GDPR). If you use the information for anything beyond that, for example publishing it, sharing it widely or using it for business purposes, you become responsible for complying with the law that applies to you. Please treat other people’s information with respect; our Terms forbid using FollowLens to harass, monitor or expose anyone.

5. Data in the app

Apart from the export (which stays on your device), the app works with the following data.

• Settings stored on your device: language, theme, accessibility choices, which tutorial steps you have seen, your workspaces. They never leave the device.
• Reminders. Notifications are optional: the app asks in its own message first, and only a yes there shows the system permission prompt. If you allow them, the app schedules two kinds of reminder on your device, with no server and no push service involved: export reminders, a nudge a few hours after you go through the export guide (or tap “Remind me”) and another two days later, before Instagram’s download window closes, cancelled once you import an export; and a weekly check‑in, a week after your newest export and then on the same weekday every week, which moves on each time you import a newer export. To stop both, turn notifications off for FollowLens in your device’s settings.
• Opening a profile. When you choose “Open on Instagram”, the app opens that profile in the Instagram app or in your browser. From then on you are using Instagram, and Instagram’s own terms and privacy policy apply.
• Sharing a report. CSV reports are created on your device. They leave it only if you share or save them through your device’s share sheet, to a destination you choose.
• Ads and usage statistics: see section 6.
• Contacting support. The app’s support form prepares an email that you send from your own mail app (or another app you pick). Nothing is sent until you press send there. The email contains the topic, subject and message you write; the attachments you choose, if any: screenshots you pick from your photo library (their location and camera details are removed first), files you pick, and, when you report an import problem, an anonymised import report that lists the export’s file and folder names, formats, sizes, counts and warning codes, with no usernames, names, messages or chat names, which you can look at or remove before sending; and a short diagnostics block: the app’s version and build, your iOS version, your language and region setting, your time zone and the time. We receive your email address and everything in the email, and use them only to answer you. Please do not send us your export or other people’s data.
• App Store. Apple handles the download, updates and, if you allow it in your device settings, crash and performance reports that Apple shares with developers. Apple does so as an independent controller under its own privacy policy.
• FollowLens Pro: optional in‑app purchases and subscriptions; see section 7.

The app asks for these device permissions only when you use the related feature: notifications (for reminders), App Tracking Transparency (for ads, see section 8), photos (only to let you pick screenshots to attach to a support message; the app reads only the images you pick), and access to the files or folder you pick. It does not use your contacts, camera, microphone or location.

6. Ads and usage statistics in the app

The app is free to use. It is funded by ads and by the optional FollowLens Pro, which removes ads (see section 7), and we look at simple usage statistics to understand which features work. For this the app includes two Google services. Neither of them ever receives your export, usernames, lists, counts, messages or anything else read from your Instagram data: the app is built so that this information cannot be passed to them.

Advertising: Google AdMob

The free app shows a banner, native ad cards and, occasionally, a full‑screen ad between an import and its results. With FollowLens Pro no ads are shown. Ads are delivered by Google AdMob. To deliver ads, measure them, limit how often you see the same ad and prevent fraud, Google processes data such as: your device’s advertising identifier (IDFA, only if you allow tracking), IP address and the approximate location derived from it, device type, operating system, language, app information, and your interactions with ads (views, taps).

• Personalised ads (based on your interests from activity in other apps and websites) are shown only if you allow them: through Google’s consent message where the law requires it (for example in the EEA, the UK and Switzerland), and only if you also choose “Allow” in Apple’s App Tracking Transparency prompt.
• Otherwise you see non‑personalised ads, chosen from context such as the app and your approximate location. Google may still use limited data to deliver them, count them and prevent fraud. If you refuse consent where it is required, Google may show limited ads or none.
• When AdMob has no ad, the app may show a “house ad” promoting another of our own apps. House ads are part of the app and do not involve any third party.

Usage statistics: Google Analytics for Firebase

We record a small number of events designed not to identify you: that an import finished or failed (with the file type or a technical error code), that the tutorial was completed, whether you turned reminders on or off, which kind of report was shared, which FollowLens Pro plan was bought (the pro_purchased event: only “monthly”, “yearly” or “lifetime”), and views and taps on house ads. Firebase also collects standard technical data automatically: a random app‑instance identifier, device model, operating system and app version, language, country or region derived from the IP address, when the app is opened and for how long it is used, and that an in‑app purchase was made (product, price and currency, never payment details). We use this only in aggregate to improve the app. We do not use it to identify you, and we do not combine it with other data about you. Where the law requires consent (for example in the EEA, the UK and Switzerland), statistics are collected only after you agree in the consent message.

7. FollowLens Pro: purchases and refunds

FollowLens Pro is an optional upgrade that unlocks extra features and removes ads. It is sold through the App Store as a monthly or yearly subscription or as a one‑time lifetime purchase.

Payment and auto‑renewal

• Apple handles the payment, as an independent controller under its own privacy policy and terms. We never receive your name, email, payment card or billing address.
• Subscriptions renew automatically. Payment is charged to your Apple Account when you confirm the purchase. A subscription renews at the end of each period, at the price shown in the App Store, unless you turn off auto‑renewal at least 24 hours before the period ends. You can manage or cancel it at any time in your Apple Account settings (Settings → your name → Subscriptions); the app’s Pro screen also has a “Manage Subscription” link. Cancelling stops the next renewal; Pro stays active until the end of the period you have paid for. The lifetime purchase does not renew.
• Checking that you have Pro. The app asks the App Store on your device whether you hold an active Pro purchase (at launch, when you return to the app and when a purchase changes) and keeps the last answer on the device for at most 3 days so that Pro works offline. “Restore Purchases” asks again. This check uses Apple’s own data on your device; it does not send anything to us.
• Usage statistics. When a purchase completes, the app records the pro_purchased event in Google Analytics for Firebase with only the plan bought (see section 6). It follows the same consent choices as the other statistics.

Refund requests

Refunds for App Store purchases are decided by Apple. When someone asks Apple for a refund, Apple may ask the developer whether the purchase was used. From the moment you buy Pro, the app notes which Pro features you open. Right after buying or restoring Pro, it asks you once whether we may share this with Apple (“Keep refunds fair?”). Apple accepts the information only with your yes. If you say no, the notes stop and the ones already made are deleted.

• What is recorded: which Pro features you open (one of “changes between exports”, “statistics”, “people”, “Threads reports” or “more than one account”), at most once a day per feature, and when, together with the App Store’s own signed record of your Pro purchase (product, purchase identifiers and dates, issued by Apple) so that we can check it is genuine and link the notes to that purchase. Never your export, usernames, lists, counts, messages, your name, email or a device or advertising identifier.
• Where it is kept: in one record per purchase on our server (Cloud Functions for Firebase in Belgium and Cloud Firestore in a European multi‑region location, both run by Google in the European Union; not in Google Analytics): the product, whether it was a test purchase, your answer and when you gave it, the times a Pro feature was opened, and a count per feature. If you said no, only that answer is kept, so it applies on all your devices. Nobody else can read it.
• What is shared, only with Apple, only if you said yes and only if a refund is requested: that you consented, whether Pro was used during what that payment covered and an estimate of how much of it was consumed (none if Pro was not opened in that subscription period; otherwise the share of the period that has passed, or all of a lifetime purchase), that Pro was delivered, and our preference (grant the refund if Pro was not used, decline it if it was). Apple makes the final decision. We share this with no one else and never use it for advertising or analytics.
• Change your mind at any time in the app, even after Pro has ended: More → My data → Privacy → “Share Pro usage for refund requests”. Turning it off stops the notes and deletes them from our server.

8. Your consent choices

• Google’s consent message. If you are in a region where consent is required (for example the EEA, the UK or Switzerland) or where privacy laws give you choices about ads (for example some US states), the app shows a message from Google’s User Messaging Platform the first time you open it. You can accept, refuse or choose purposes individually. Refusing does not stop you from using any feature.
• Apple’s App Tracking Transparency. After that, the app asks for permission to track through Apple’s system prompt. If you choose “Ask App Not to Track”, the advertising identifier is not shared and ads are not personalised with data from other companies’ apps and websites. You can change this at any time in Settings → Privacy & Security → Tracking.
• Change your mind at any time in the app: More → Legal → Manage consent. Withdrawing consent does not affect what happened before.
• More about how Google uses data: How Google uses information from sites or apps that use its services. You can manage Google ad personalisation at My Ad Center.

9. This website

• Hosting. This website is hosted on Google Firebase Hosting, provided by Google Ireland Limited. To deliver each page, Google’s servers process your IP address, the page you ask for, the date and time, and your browser’s details, and keep these technical logs for a limited time for security. We do not use them to identify or profile visitors. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
• Visit statistics, only if you accept. If you choose “Accept” in the cookie banner, we use Google Analytics 4 (Google Ireland Limited) to count visits and see which pages are useful: the pages you view, how you reached the site, your approximate location (country and city, worked out from your IP address, which Google Analytics does not store), your device, browser and language. Google signals and advertising features are switched off, we use no user ID, and we never link this data to who you are. Legal basis: your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code). You can withdraw it at any time with “Cookie settings” at the bottom of every page, without affecting what happened before. If you choose “Reject” or close the banner, Google Analytics is not loaded at all. Visit data is kept for no longer than 14 months.
• Your choice stays on your device. The site remembers your answer in your browser’s local storage (followlens-analytics), not in a cookie, for 12 months (6 months if you rejected), then asks again.
• Your export stays in your browser. The analyser reads it in the tab and never sends it anywhere. The page’s security policy lets it talk only to Google Analytics, which loads only after you accept and never receives your export, usernames or results.
• Transfers outside the EU. Google may process this data in the United States. Google LLC is certified under the EU‑U.S. Data Privacy Framework, and Google also uses the European Commission’s Standard Contractual Clauses.
• Nothing else follows you. This website shows no advertising, has no social media plugins and loads no fonts or scripts from other companies. Your language choice is not remembered.
• Links to Instagram and the App Store. Profile links in the analyser open instagram.com in a new tab, and the App Store badge opens Apple’s App Store. Those sites are run by Meta and Apple under their own policies. Our pages tell the browser not to pass on the address you came from.
• Writing to us. If you email support@copycut.it, we use your message only to reply, and keep it only as long as that takes (see section 13).
• Every cookie and storage key, with its name and duration, is listed in the Cookie Policy.

10. Our partners

These are the only companies involved in running FollowLens. None of them receives your Instagram export.

We do not use any other analytics, crash‑reporting, attribution, marketing or data‑broker service. If this ever changes, we will update this policy first.

11. Legal bases (GDPR, UK GDPR, Swiss FADP)

• Personalised ads (AdMob) and usage statistics (Firebase Analytics): your consent (Article 6(1)(a) GDPR, and the rules on accessing information on your device, such as Article 5(3) of the ePrivacy Directive and Article 122 of the Italian Privacy Code), where consent is required. Where it is not required, our legitimate interest in funding a free app and improving it (Article 6(1)(f)), balanced by the safeguards in this policy and your right to object.
• FollowLens Pro purchases and checking that you have Pro: performing the contract you enter into when you buy Pro (Article 6(1)(b)). The pro_purchased statistic has the same basis as the other usage statistics.
• Recording Pro feature use: our legitimate interest (Article 6(1)(f)) in being able to show, when a refund of a delivered purchase is requested, whether it was used; it is limited to feature names and times, and you can stop it at any time. Sharing it with Apple for refund requests: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Showing the consent message and remembering your choice: our legal obligation to collect and record valid consent (Article 6(1)(c) and Article 7(1)).
• Website visit statistics (Google Analytics): your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), given with “Accept” in the cookie banner and withdrawn at any time with “Cookie settings”. Remembering your cookie choice in your browser is strictly necessary to respect it.
• Website hosting logs: our legitimate interest in delivering a secure website (Article 6(1)(f)); this data is strictly necessary to load the page.
• Support emails and their attachments: taking the steps you ask for (Article 6(1)(b)) and our legitimate interest in answering you (Article 6(1)(f)).
• Records required by law (for example to answer an authority or defend a legal claim): legal obligation and legitimate interest (Article 6(1)(c) and (f)).

Reading your export on your device is not processing by us: we do not receive it, decide nothing about it beyond writing the software, and have no access to it.

12. International transfers

Google may process data in the United States and other countries outside the European Economic Area. Google LLC is certified under the EU‑US Data Privacy Framework (and its UK and Swiss extensions), and Google also relies on the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.

13. How long data is kept

• Data on your device: until you delete it in the app or delete the app. The website keeps nothing from your export after you close or refresh the tab.
• Website visit statistics (Google Analytics, only if you accept): no longer than 14 months, then deleted automatically. Your cookie choice stays in your browser for 12 months, or 6 months if you rejected, and then the website asks again.
• Firebase Analytics: event data is kept for no longer than 14 months, then deleted automatically.
• AdMob and the consent platform: as set out in Google’s retention policy. Your consent choice is stored on your device until you change it or delete the app.
• Pro usage record for refund requests: until you say no (then only that answer is kept), or until the purchase is refunded or revoked; then it is deleted. Otherwise for as long as the purchase exists and Apple may ask about it.
• Hosting logs: for a short period, as needed for security and operation.
• Support emails and attachments: as long as needed to handle your request, and then for no more than 24 months, unless a longer period is required by law or to defend a legal claim.

14. Security

The safest data is data we never receive, so FollowLens is designed to keep your export on your device. The app checks every imported file for malicious content before reading it, stores data only in its private storage protected by your device’s encryption and lock screen, and discards message text. The website uses strict security settings that stop it from loading outside code or sending data anywhere, except Google Analytics after you accept visit statistics. No system is perfectly secure: please protect your device with a passcode and keep your export file safe, because it contains your personal information.

15. Your rights

Under the GDPR and similar laws you have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected or deleted;
• restrict its processing;
• receive it in a portable format;
• object to processing based on legitimate interest, at any time;
• withdraw consent at any time (in the app: More → Legal → Manage consent for ads and statistics, Settings → Privacy & Security → Tracking for tracking, More → My data → Privacy for refund sharing; on the website: “Cookie settings” at the bottom of every page), without affecting earlier processing;
• complain to a data protection authority: in Italy the Garante per la protezione dei dati personali, or the authority where you live or work (list of EU authorities).

Write to support@copycut.it. We answer within one month (extendable by two months for complex requests, in which case we will tell you). We may ask for information to confirm your identity.

Please note: we hold almost nothing that identifies you. Ad and analytics data is linked to random device identifiers, not to your name or Instagram account, so we may not be able to find “your” data unless you give us your app‑instance identifier. The quickest way to erase it is to withdraw consent, turn off tracking and delete the app. Everything about your Instagram account is on your device, where you can delete it yourself.

16. United States residents

Some US state laws (for example in California, Colorado, Connecticut, Virginia and others) give residents specific rights. We extend them to every user, whether or not the law applies to us.

• Categories of personal information collected in the last 12 months, through the partners above: identifiers (advertising and app‑instance identifiers, IP address, and your email address if you write to us); commercial information (which FollowLens Pro plan was bought and, only if you agree, the App Store’s record of your purchase and which Pro features you opened); internet or other electronic activity (interactions with the app and with ads, and the pages you view on the website if you accept visit statistics); approximate geolocation derived from IP. We collect no sensitive personal information about you.
• Sources: your device, the app, the website (only if you accept visit statistics) and the emails you send us. Purposes: showing and measuring ads, understanding app usage, answering Apple’s questions about refund requests (only with your consent), answering support requests, security.
• “Selling” and “sharing”. We do not sell personal information for money. When personalised ads are enabled, the data Google AdMob processes may count as “sharing” for cross‑context behavioural advertising, or as “targeted advertising”. You can opt out at any time through More → Legal → Manage consent (where Google shows a US state choice) or by choosing “Ask App Not to Track”.
• You can ask to know, access, correct or delete your personal information, and to appeal our decision, by writing to support@copycut.it. You may use an authorised agent. We will never discriminate against you for using these rights.

17. Other countries

We apply this policy to everyone. If you live in the United Kingdom, Switzerland, Brazil (LGPD), Canada (PIPEDA) or another country with data protection laws, you have the rights those laws give you, and you can use them by writing to us as above.

18. Age and children

FollowLens is not directed at children. The app is rated 13+ on the App Store, and you must be old enough to have an Instagram account (at least 13). The app does not ask for your age. In the EEA and the UK, if you are under the age at which you can give consent to online services in your country (14 in Italy, between 13 and 16 elsewhere), ask a parent or guardian before accepting personalised ads. We do not knowingly collect personal data from children under 13; if you believe this has happened, write to us and we will make sure it is deleted.

19. What we never do

• We never receive, sell, rent or share your Instagram export or anything read from it.
• We never ask for your Instagram password or log in on your behalf.
• We do not create accounts, profiles or contact lists of you or of the people in your export.
• We do not make automated decisions that have legal or similarly significant effects on you. The results in FollowLens are simple counts and comparisons of your own files, with no artificial intelligence.

20. Changes to this policy

We will update this policy if the Service changes, for example if we add a partner. The date at the top shows the current version. If a change is significant, we will tell you in the app or on the website before it takes effect, and ask for your consent again where the law requires it.

21. Contact

Federica Benacquista, FollowLens
Via del Lido 106, 04100 Latina (LT), Italy
Email: support@copycut.it, or the support form in the app

This policy is available in English and Italian. Both versions have the same value; if they differ, the one more favourable to you applies.