Privacy Policy

1. Scope and key points

This Privacy Policy explains how ProfileSpy ("we", "us", or "our") collects, uses, discloses, and protects information in connection with the ProfileSpy app (the "App"), the website at profile-spy.com (the "Site"), and related services (collectively, the "Service"). By using the Service, you agree to this Policy.

Phone-number authentication only: we authenticate users solely by mobile phone number and a one-time passcode (OTP). We do not use email/password or social login.

Purchases happen in the app: all registration and purchases occur inside the App through the Apple App Store or Google Play. We do not process or store full payment-card numbers.

We analyze public Instagram data: to generate scan results, the Service processes publicly available information about the Instagram accounts you choose to analyze. This may include accounts other than your own. If you request Comment Analysis, we may also process public comment text from eligible public posts for that completed scan.

Estimates, not official metrics: results are estimates and are not affiliated with or endorsed by Instagram or Meta.

2. Information we collect

Account information: your mobile phone number and OTP verification status.

Instagram account connection: to run a scan, you connect an Instagram Professional (Business or Creator) account through Facebook Login; we receive and store your connected Instagram username and an encrypted access token, which we use to call Meta's Instagram Business Discovery API on your behalf, plus the handles or accounts you submit for analysis.

Early-access and waitlist data: if you opt in to upcoming features (such as audience demographics), the identifiers you submit for that waitlist.

Support communications: information you provide when you contact us.

Usage data collected automatically: analyses run, credit balances, feature interactions, rate-limit activity, and timestamps.

Device and technical data: device type, operating system, app version, language, approximate location derived from IP address, and diagnostic/crash data.

Identifiers: IP address and app-instance or device identifiers used for security, rate-limiting, and abuse prevention.

Public Instagram data via Meta's Business Discovery API: using the access granted by the Instagram Professional account you connect, we obtain publicly available profile and engagement information about the accounts you analyze through Meta's official Instagram Business Discovery API — for example, follower and engagement figures, recent public posts, public comment text from publicly available Instagram posts and comment threads when you request Comment Analysis, and derived signals.

App store data: Apple or Google provide us with purchase and subscription status, but not your full card number.

We do not access private Instagram accounts, passwords, direct messages, private comments, private (non-public) account content, or posting controls, and we never ask you to log into Instagram through the Service.

3. Children and sensitive information

The Service is intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it.

We do not intentionally collect sensitive categories of personal information — such as government IDs, precise geolocation, health, biometric, or financial account credentials — beyond what is described in this Policy.

4. How we use information

We use information to provide, operate, and maintain the Service, including generating scan results; to authenticate users via phone number and OTP and secure accounts; to enforce free-tier limits, credit balances, Comment Analysis allowances, Focused Fix Plan actions, and rate limits, and to prevent fraud, SMS/OTP abuse, and other misuse. Scan data may also be processed by artificial-intelligence systems to generate the plain-English summaries and recommendations shown in your results.

When you request Comment Analysis, we process public comment text to classify comment quality and generate Comment Analysis insights, including useful intent, emotional reactions, generic praise, spam or promotional asks, repeated wording, and brand-risk categories.

We also use information to process and manage purchases and subscriptions; provide customer support; improve and develop the Service, including analytics and quality assurance; send service-related communications; and comply with legal obligations and enforce our Terms.

Where required by law, we process personal information on the bases of: performance of our contract with you; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and your consent where required, which you may withdraw.

5. How we disclose information

We do not sell your personal information for money. We disclose information to service providers and processors — hosting and app infrastructure such as Firebase/Google Cloud, one-time-code SMS delivery, analytics, crash reporting, app-store billing, and AI language-model providers that generate scan summaries, recommendations, and Comment Analysis insights — who process information on our behalf under contract and only to the extent needed to provide the Service. These providers may not use your data for their own purposes. Separately, when you connect an Instagram Professional account, you authorize us to interact with Meta/Facebook to complete that connection and to call Meta's Instagram Business Discovery API using the access you grant; Meta processes that activity under its own privacy policy and terms, which we do not control.

We also disclose information to app stores and payment platforms (Apple and Google) in connection with purchases; for legal and safety reasons, to comply with law, respond to lawful requests, enforce our Terms, and protect the rights, safety, and property of users, the public, or us; in connection with a business transfer such as a merger, acquisition, financing, or sale of assets; and with your direction or consent, for example when you share a scan result link.

We do not share your personal information for cross-context behavioral advertising.

6. Data retention

We retain personal information for as long as needed to provide the Service and for the purposes described in this Policy, and thereafter as necessary to comply with legal obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements.

Usage counters and abuse-prevention records may be retained for a reasonable period even after account deletion. Your completed or partial Comment Analysis data, including generated analysis, summaries, post references, comment examples, and job status, may be stored as needed for app history, saved reports, downloads, and support. When you delete your account, we remove this data from active account features unless we need to retain limited records for legal compliance, fraud prevention, abuse prevention, dispute resolution, or enforcement. When information is no longer needed, we delete or de-identify it.

7. Your rights & choices

You can delete your account and associated personal data from within the App by opening Settings and tapping Delete account near the bottom of the screen, or by emailing privacy@profile-spy.com. Account deletion removes your sign-in profile, scan history, watchlist, saved reports, connected Instagram account, and profile data from active account features. Upon a verified request, we will delete or de-identify your personal information, except information we are permitted or required to retain — for example, for legal compliance, fraud prevention, abuse prevention, dispute resolution, or enforcement.

Depending on where you live, you may have rights to know or access the personal information we hold, delete it, correct it, obtain a portable copy, and opt out of sale or targeted-advertising "sharing." You also have the right not to receive discriminatory treatment for exercising these rights.

To exercise these rights, contact us at privacy@profile-spy.com or use in-App controls. We will verify your request using the phone number associated with your account and respond within the timeframes required by applicable law (generally within 45 days, extendable as permitted). You may use an authorized agent where the law allows.

We do not disclose personal information to third parties for their own direct-marketing purposes. Where required by law, we treat opt-out preference signals (such as Global Privacy Control) as valid opt-out requests.

8. Information about accounts you analyze

When you analyze an Instagram account, we process publicly available information about that account to generate a result. If you analyze an account you do not own, that account holder may have rights regarding their information under applicable law.

If you are an account holder and believe your public information has been processed in a way that violates your rights, contact us at privacy@profile-spy.com and we will review the request. We do not create results from private or login-restricted content.

9. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including rate-limiting and abuse controls on authentication endpoints. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining control of the phone number and device associated with your account.

10. International users and data transfers

We operate in the United States. If you access the Service from outside the United States, your information may be processed in the United States and other countries that may have different data-protection laws than your jurisdiction. Where required, we implement appropriate safeguards for cross-border transfers.

11. Tracking technologies

The Site may use cookies or similar technologies for basic functionality and analytics. The App uses device identifiers and analytics SDKs for the purposes described above. You can control certain identifiers through your device settings. Because there is no common industry standard, we do not respond to browser "Do Not Track" signals other than as required by law.

12. Changes to this policy

We may update this Policy from time to time. If we make material changes, we will provide notice by reasonable means — for example, in-App notice or updating the "Last updated" date above. Your continued use of the Service after changes become effective constitutes acceptance.

13. Contact us

If you have questions or requests regarding this Policy or your personal information, email us at privacy@profile-spy.com. ProfileSpy is an independent tool and is not affiliated with Instagram or Meta.