Privacy

This is how Lurk handles data, in plain English. If something here is unclear, email privacy@lurk.icu.

The short version

• Lurk only shows information that's already public on Instagram.
• We never ask for your Instagram password and never log in to Instagram as you.
• Your Instagram export ZIP never leaves your browser. Only the follower/following username lists are sent to us.
• No ad trackers. We use Cloudflare Web Analytics, which doesn't use cookies or track you across sites.
• You can export or permanently delete your data at any time from Account settings.

What we collect about you

• Account: your email address, and your name and profile photo if you sign in with Google.
• Billing: your plan and subscription status. Card details are handled by Stripe; we never see or store them.
• Settings: notification preferences, timezone, quiet hours, and push-notification endpoints for your devices.
• Your watch list: the public accounts you choose to watch, with any labels you add.
• “My account” uploads: the follower and following username lists from your export, and the differences between uploads.

Data about the accounts you watch

For each watched public account we store its public profile details (username, display name, profile picture, counts) and its public following list, obtained through a third-party public-data provider. We don't collect posts, messages, stories, or anything from private accounts. If an account goes private, we stop collecting its following list.

How long we keep things

• Follow/unfollow events: 1 year.
• Raw provider responses (kept only to debug and re-check changes): 14 days.
• Data for a watched account that nobody watches any more: deleted after 7 days.
• Your account data: until you delete your account. Deletion is immediate and permanent across our database and storage.

Who we share data with

Only the services that run Lurk: Cloudflare (hosting, database, storage, email), Stripe (payments), our public-data provider (it receives the usernames/IDs of accounts being checked, never anything about you), and Google if you choose Google sign-in. We don't sell data.

Cookies

One essential, secure session cookie to keep you signed in. No advertising or tracking cookies.

Your rights

You can download everything we hold about you (Account → Export my data) and delete your account (Account → Delete account). If you're in the EU, UK, or California you have additional rights to access, correct, and erase data; email privacy@lurk.icu and we'll respond within 30 days.

Lurk is not affiliated with Instagram or Meta.