Last updated: Sep 25, 2026

Privacy Policy

This Privacy Policy explains what information the Follo mobile app for Android and iOS (the "app") and the website www.follotracker.com (the "website") handle, why, and what choices you have. Follo is an independent followers and unfollowers tracker for Instagram. It is not affiliated with, sponsored or endorsed by Instagram or Meta.

The short version

You sign in on Instagram's own login page, shown inside the app. We never read or store your Instagram password.
The app reads your Instagram data directly from Instagram, on your phone. Your follower lists and reports are stored on your phone. We do not run servers that receive them.
The app only acts on your Instagram account when you tap a button to do so (Follow or Unfollow). It never posts, comments, likes or sends messages.
Some information does leave your phone: usage analytics and crash reports (Google Firebase), purchase and subscription records (RevenueCat, Apple, Google) and push notifications (OneSignal). Section 5 lists exactly what.
We do not sell your personal information.

1. Who is responsible

The app and the website are operated by Oyku Sena Sayan, who publishes the app on the App Store and, under the developer name "Follo App", on Google Play ("Follo", "we", "us"). Follo is the controller of the personal data described in this policy (the "data controller" under the Turkish Personal Data Protection Law No. 6698, "KVKK"). You can reach us at support@follotracker.com.

2. How the app works

To use Follo you sign in to your own Instagram account on Instagram's login page, which opens in a browser window inside the app. After you sign in, the app uses that Instagram session to request your data from Instagram, from your device, in the same way the Instagram website does when you browse it. The app then compares your lists between checks and builds your reports on your device.

Password. You type your password into Instagram's page, and it is sent to Instagram. The app does not read, record or store it, and we never receive it.
Login outcome. The app watches the login page only to detect when you are signed in. If a sign-in fails, it records a short technical category of the result (for example "two-factor required" or "wrong password") in our analytics so we can fix login problems. It does not record what you typed.
Session. After you sign in, Instagram's session cookies and session tokens are kept in the app's private storage on your device so you stay signed in. They are only used to talk to Instagram and are never sent to us. Logging out in the app deletes them.

4. Instagram data the app reads

Depending on the features you use, the app reads the following from Instagram:

Your profile: Instagram user ID, username, full name, bio, profile photo, whether the account is private or verified, and your follower, following and post counts. Instagram's account settings endpoint also returns the email address and phone number linked to your Instagram account, if you have added them.
Your follower and following lists: for each account, its user ID, username, name, profile photo and basic flags (for example private or verified).
Engagement signals: who liked or commented on your recent posts, who viewed your stories, your activity notifications, and the list of your recent Direct conversations (who the participants are and when the conversation was last active). The app uses these only to calculate insights such as ghost followers, biggest fans and interaction-based "profile visitors". It does not keep or show the text of your messages.
Profiles you choose to view: when you search for an account, add it to your Watchlist, watch its stories with Ghost Mode or save a photo or video, the app loads that account's public profile information, posts, stories and highlights. You only ever see what your Instagram account is allowed to see.

Where it is stored. These lists, earlier snapshots used for comparison, your Watchlist and your reports are stored in a database on your device, and profile photos are cached on your device. We do not copy your follower lists or reports to our own servers. Photos and videos you choose to save go to your device's photo library.

Actions on Instagram. The app only changes something on your Instagram account when you tap Follow or Unfollow in the app. It never posts, comments, likes, sends messages or follows or unfollows anyone on its own.

5. Information that leaves your device

We use the following service providers. They process data on our behalf to run the app.

Google Firebase (Google Analytics for Firebase, Crashlytics, Authentication, Remote Config)

Usage events, such as screens opened, features used, paywall views and purchase events, and technical events such as loading errors and the login outcome categories described above.
Device and app information: device model, operating system, app version, language, and approximate location (country or region) derived from your IP address.
Identifiers: an app instance ID, a pseudonymous app user ID created for your installation (Firebase Authentication creates this sign-in automatically, without your email or name), a device identifier, and, where allowed, your device's advertising ID.
Account-size information about your own Instagram account: follower and following counts and ranges, whether it is private or verified, and whether it has posts. Your Instagram username is not included in analytics events.
Where the app was installed from (for example the name of an ad campaign), used to measure our advertising.
Crash reports: technical details of the crash, the screen you were on and the pseudonymous app user ID.

We use this data to understand how the app is used, fix bugs, measure the performance of our own app-install ads (for example on Google Ads) and change app settings remotely.

RevenueCat (purchases and subscriptions)

Your subscription and purchase status, store transaction details, the pseudonymous app user ID and device identifiers (on iOS the IDFV and, only if you allow tracking, the IDFA; on Android the advertising ID, where available), and your IP address.
Details of your Instagram profile that the app attaches to your customer record: username, full name, Instagram user ID, the email address and phone number linked to your Instagram account (if Instagram returns them), follower, following and post counts, and whether the account is private or verified.
Your Firebase and OneSignal IDs, so that purchases can be matched with analytics and notifications.

We use this data to unlock the features you paid for, restore purchases, provide customer support and understand subscription performance.

OneSignal (push notifications)

If you allow notifications, OneSignal receives a push token, the pseudonymous app user ID, basic device information (such as device model, operating system, language and time zone) and whether you open notifications. We use it to send you notifications about the app. You can turn notifications off at any time in your device settings.

Apple and Google

Payments are processed by the App Store or Google Play. We never see your card details. Apple and Google share limited transaction information with us (through RevenueCat), such as the product, price, country and renewal status.
On iOS, if Apple Search Ads information is available, an attribution token is sent to RevenueCat so we can see which Apple ad led to an install.
On iOS, if your Instagram account has an email address or phone number, the app passes it to Google's on-device conversion measurement feature in the Firebase SDK to measure our Google ads. Google states that this matching happens on your device and that the email address or phone number is not sent off the device.

Email support

If you contact us from the app, your email app opens with a message that already contains your app version, device model, operating system, language, pseudonymous app user ID and device ID. You can edit or delete these before sending. We use what you send only to answer you.

6. The website

Report preview and public profile card. When you type an Instagram username into the report preview, our server fetches that account's public Instagram profile details (profile photo, name, bio, category, link domain, follower, following and post counts, verified and private status and, for public accounts, recent post thumbnails with their like and comment counts) from Instagram and uses them only to show this card. We don't sign in to Instagram, ask for a password or access the account's follower lists. These details are cached for up to 7 days (the profile photo for up to 24 hours) and then deleted automatically. Cache entries are named with a one-way hash (HMAC), not the username, and we keep no record of who looked up which account. To prevent abuse, your IP address is used only in hashed form in a 10-minute counter. The username is not sent to our analytics tools. Legal basis: our legitimate interest in providing the preview you asked for (GDPR Art. 6(1)(f)).
Google Analytics 4. We measure visits to www.follotracker.com: pages viewed, clicks on the App Store and Google Play buttons, page loading performance (Core Web Vitals), browser and device type, and approximate location derived from your IP address. Google Analytics uses cookies such as _ga. Where the law requires your consent (for example in the EEA, the UK and Switzerland), we ask for it before analytics cookies are stored.
Necessary cookies. follo_app_session and XSRF-TOKEN keep the site working and protect forms (they expire after 2 hours). follo_lang remembers your language for one year.
Newsletter. If you subscribe, we store your email address to send you Follo updates. Email us to unsubscribe and we will delete it.
Server logs. Like any website, our servers process your IP address and browser information to deliver pages and to protect against abuse (for example, limiting repeated form submissions).

The website has no user accounts, and you cannot sign in to Instagram on it. You can block or delete cookies in your browser settings.

7. Why we use your data and our legal bases

To provide the app and its features, including purchases and restoring them: necessary to perform our contract with you.
Analytics, crash reports and app improvement: our legitimate interest in running a reliable app, or your consent where the law requires it.
Advertising measurement using advertising identifiers: your consent where required. On iOS, the IDFA is only used if you allow tracking in the App Tracking Transparency prompt.
Push notifications: your consent, given in the system prompt.
Support, security and fraud prevention: our legitimate interests.
Legal obligations, such as tax and accounting records for purchases.

Under KVKK, we process personal data on the grounds in Article 5 (performance of a contract, legal obligations, legitimate interests and, where required, your explicit consent).

We share personal data only with the service providers above, with Apple and Google as the app stores, when the law requires it (for example a valid court order), or as part of a sale or reorganisation of the app, in which case this policy continues to apply. We do not sell personal information for money.

We do not show ads in the app. We do use advertising identifiers and install data to measure our own ad campaigns on advertising platforms such as Google Ads and Apple Search Ads. Under some laws, including California's, this can count as "sharing" personal information for advertising. You can stop it at any time (see section 11).

9. International transfers

Our service providers may process data in the United States and in other countries outside Türkiye, the EEA and the UK. When they do, we rely on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider takes part in it, and, for data from Türkiye, the transfer mechanisms in Article 9 of KVKK.

10. How long we keep data

On your device: your Instagram session stays until you log out. Your lists, reports and Watchlist stay until you delete the app or clear its data.
Analytics and crash data: kept for a limited period set in our Firebase settings, then deleted automatically.
Purchase records: kept for as long as you have an active subscription and afterwards for as long as tax, accounting or legal rules require.
Push notification data: kept until you turn notifications off or ask us to delete it.
Support emails and newsletter addresses: kept for as long as needed to answer you, or until you unsubscribe.

11. Your choices and rights

Choices in the app and on your device:

Log out in the app's settings to remove your Instagram session from the device.
Delete the app, or clear its data in your device settings, to remove everything the app stored on your device.
Turn tracking off (iOS: Settings, Privacy & Security, Tracking) or delete or reset your advertising ID (Android: Settings, Privacy, Ads), and turn notifications off in your device settings.
To remove your Instagram profile details from our providers, or to have data linked to your installation deleted, email support@follotracker.com. Include the app user ID and device ID shown in the support email from the app, so we can find your records.

EEA, UK and Switzerland (GDPR and UK GDPR). You have the right to access your personal data, correct it, delete it, restrict or object to its processing (including processing based on legitimate interests), receive it in a portable format, and withdraw consent at any time without affecting earlier processing. You can also complain to your local data protection authority.

California (CCPA/CPRA) and other US states. You have the right to know what personal information we collect, use and disclose, to access it, to correct it, to delete it, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising. We do not sell personal information, and we will not treat you differently for using your rights. The categories we collect are identifiers (such as app user ID, device and advertising IDs, IP address), commercial information (purchases), internet or app activity (usage events), approximate location, and the Instagram profile details listed above. We collect them from you, your device and Instagram, for the purposes in section 7, and disclose them to the providers in section 5.

Türkiye (KVKK). Under Article 11 of KVKK you can ask whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used for that purpose, learn to whom it is transferred in Türkiye or abroad, ask for it to be corrected or deleted and for those third parties to be told, object to a result that is against you and arises only from automated analysis, and claim compensation for damage caused by unlawful processing. You can also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To use any of these rights, email support@follotracker.com. We may ask for information to confirm that the request is yours, and we will reply within the time the law requires (for example, one month under GDPR and 30 days under KVKK).

12. Security

Your Instagram data stays on your device, in the app's private storage, and all connections to Instagram and to our service providers are encrypted (HTTPS). No method of storage or transmission is completely secure, so keep your device protected with a screen lock and keep your operating system up to date.

13. Children

Follo is not intended for anyone under 13, or under the minimum age for using Instagram in their country. We do not knowingly collect personal data from children. If you believe a child has used the app, contact us and we will delete the related data.

14. Instagram and other services

Instagram's login page and Instagram's own services are run by Meta and covered by Instagram's own Privacy Policy. Apple, Google, RevenueCat and OneSignal also have their own privacy policies. This policy does not cover how those companies handle data they collect themselves.

15. Changes to this policy

We may update this policy when the app or the law changes. We will post the new version on this page and change the date at the top. If a change is significant, we will also let you know, for example with a notice on the website.

16. Contact

Questions or requests about privacy: support@follotracker.com.