Privacy Policy

14 August 2026. This is the first published version of this policy.

Follow Crab is operated by Dmitry Logachev, an individual sole trader in California, United States. For the purposes of the EU and UK General Data Protection Regulation, that is the data controller.

There is no establishment in the EU or the EEA. Where the GDPR applies to this service, it applies under Article 3(2) — because the service is offered to people in those territories — rather than through an EU establishment. That means there is no single lead supervisory authority for Follow Crab; see §12 for where to complain.

Contact for anything on this page, including privacy requests: support@followcrab.com.

When you drop your Instagram export onto followcrab.com, the ZIP is opened and read by JavaScript running inside your own browser tab. It is never uploaded, because the page is not able to upload it.

That is a mechanism, not a promise, and it is worth stating precisely. Every page on this site is served with a Content-Security-Policy that includes:

• connect-src 'none' — the browser refuses every outbound request this page's scripts could make: fetch, XMLHttpRequest, WebSocket, sendBeacon, EventSource. There is no code path that reaches a server, because the browser will not open one.
• script-src 'self' — the page runs only JavaScript served from followcrab.com itself. No CDN, no tag manager, no inline script. The one third-party library used (JSZip) is downloaded, vendored into this repository and served from our own origin, so it is covered by the same rule.
• form-action 'none' and object-src 'none' — no form can post anywhere, and no plugin can be embedded to sidestep the above.

You do not have to take this on trust. Open your browser's developer tools, go to the Network tab, and run an export through the tool: no request is made. Or read the policy yourself — it is sent as an HTTP response header on every page, and repeated in a <meta> tag in the HTML source.

The one caveat, stated plainly: "cannot transmit" describes this page's own JavaScript. If you click a buy button you are navigated to Polar's checkout on a different domain — an ordinary link, the kind the CSP does not and should not block. Your export data is not part of that, and does not travel with you. See §8.

The Follow Crab iOS app reads your export on your device. It makes no network request of any kind, with exactly one exception: StoreKit, Apple's own purchasing framework, which talks to the App Store when you buy something or restore a purchase. We never see that traffic and it never carries your Instagram data.

This is enforced mechanically rather than by review. The test suite reads the app's own source tree and fails the build if the words URLSession, URLRequest, URLProtocol, NWConnection, NWPathMonitor, CFNetwork or import Network appear anywhere in it. A second test holds every import statement against an allowlist, so an analytics or crash-reporting SDK cannot arrive quietly inside a dependency — the kind of change that usually happens by accident rather than by decision.

You can check this one too, without reading any code: turn on Airplane Mode and run an import. Everything works.

An Instagram export is very large and almost all of it is irrelevant to this tool. Rather than open the archive and take what it needs, Follow Crab works from an explicit allowlist: every entry is classified by filename alone, before a single byte is read, and anything not on the list is never opened.

Both products open these: your followers and following lists; five connection files (recently_unfollowed_profiles, blocked_profiles, recent_follow_requests, removed_suggestions, hide_story_from); and audience_insights, which is what lets the tool warn you that a date-limited export is incomplete.

The iPhone app

The app opens one file beyond that list — story_likes, for the activity summary — and nothing else.

Measured against the real 2.06 GB Instagram export this code was built against (23 July 2026, 6,968 entries), that came to 8 files opened. Everything else — 6,960 entries — was never opened at all:

• 6,443 message files, 1.3 GB
• 450 photos and videos, 549 MB
• 51 other JSON files nothing routes, 107 MB
• 9 personal-information files
• 7 login-history files

The website

The website opens more than the app does, because it does more, and saying otherwise would be the easy and dishonest simplification. The activity report and the creator media kit read these as well:

• story_likes, liked_posts, saved_posts — what you engaged with, and when
• ai/interest_categories and advertisers_using_your_activity_or_information — what Instagram has inferred about you, which is shown back to you
• past_instagram_insights/content_interactions and profiles_reached — the media kit's reach figures, present only in creator and business exports

And four activity logs plus your message files are streamed and counted, never retained: videos_watched, posts_viewed, stories_viewed, ads_viewed and messages/inbox/…/message_N.json. These are read one chunk at a time to count entries, and every chunk is discarded as it goes; nothing from them is assembled or kept. §5 describes exactly how, because for the message files it is the whole argument.

Never opened, by either

Four locations are on an explicit never-open list, checked before anything else, so they are excluded by name rather than merely by not being wanted:

• personal_information/ — your email address, phone number, date of birth, devices and autofill data
• security_and_login_information/ — IP addresses, devices, login and account-creation history
• threads/personal_information.json and login_and_profile_creation/ — the same two categories in a Threads export

The bodies of your messages, comments and searches are never read by either product. Your comments and your search history are not on any list above, so they are never opened at all; your message files are counted and never read, which §5 explains.

In the iPhone app this is visible on screen rather than only stated here: after an import you can open a receipt that names every file that was opened and tallies every file that was not, and the two add up to the total number of files in your archive. You can check that total against your own copy of the ZIP.

This deserves its own section, because "we never open your DMs" is the sort of sentence anyone can write, and it is less precise than what actually happens.

Some features need to know how many messages are in a conversation. Getting that number by parsing the file would mean loading the other person's actual words into memory — so the code does not do that. It streams the file and counts how many times the timestamp key appears in the raw text, discarding each chunk as it goes. No message body is ever assembled, and the count is exact: inside JSON, quotation marks in message text are escaped, so nothing anyone could write in a message can imitate the key.

Where a conversation needs to be labelled with a name, that name is taken from the folder name in the archive's index — from the file path, never from inside the file. Reading the path costs zero bytes of the conversation.

So: messages are counted without being read. That is the accurate claim, and it is a property of the code rather than a policy we are asking you to believe.

All of the above is about the website. The iPhone app has no feature that needs a message count, so it does not open your message files at all — on the real export in §4, all 6,443 of them fell into the never-opened tally.

There is no analytics, no crash reporting, no advertising SDK and no third-party SDK of any kind in either the website or the iPhone app. No Google Analytics, no tag manager, no Meta pixel, no Sentry, no attribution or A/B-testing service.

On the website, every script the page loads is served from followcrab.com — you can confirm this by viewing the page source and reading the <script> tags, all of which point at /lib/ or /vendor/ on this domain. The script-src 'self' policy in §2 means a third-party script could not execute here even if one were added by mistake.

We set no cookies. We do not track you across sites, we do not build a profile, and there is nothing to opt out of because there is nothing running. Some data is kept in your own browser's local storage so the tool can work at all — that is §9, and it never leaves your device.

Hosting, stated for completeness. The site is served by Cloudflare. Like every web server on the internet, it necessarily handles your IP address in order to send you the page, and it may keep short-lived operational logs for security and abuse prevention. We do not run analytics over that, we do not export it, and we cannot connect it to anything you did in the tool — because the tool reports nothing back. Your Instagram data is never part of any request to the server.

Follow Crab has no account, no login and no password, on the website and in the app. We never ask for your Instagram credentials and could not use them if you offered — the tool works only from the official data export Instagram gives you.

This is also why there is no "delete my account" button: there is no account, no user record and no server-side profile to delete. What you can delete is the data on your own device, and §9 says how.

On the web, purchases are handled by Polar, which is the merchant of record. Clicking a buy button takes you to Polar's own checkout on their domain, where you enter your payment and billing details. Those details go to Polar. We never receive them and never see them — no card number, no billing address, nothing. What comes back to this site is a plain return link saying a purchase succeeded, which unlocks the feature in your browser. Polar's handling of your data is governed by their own policy: polar.sh/legal/privacy.

In the iPhone app, purchases go through Apple's In-App Purchase system. Apple processes the payment and we never see your payment details. Apple's handling of your data is governed by their own policy: apple.com/legal/privacy.

We hold no payment data of any kind, in either case.

Nothing is stored on our servers, because there is no server-side storage. Some things are stored on your own device, and here is the complete list.

In your browser, on the web

The tool uses your browser's local storage. Five keys, all prefixed fc_:

• fc_snapshot_instagram — your follower list from your last upload. This is the one that matters: an Instagram export is a snapshot of today, not a history, so unfollowers can only be found by comparing two uploads over time. Without this saved list there is nothing to compare against.
• fc_lastreport_instagram — the most recent result, so returning to the page does not lose it.
• fc_ent and fc_unlocked — which features you have purchased.
• fc_lang — your chosen interface language.

This data stays in your browser on this device. It is not sent anywhere — it cannot be, per §2. Clearing your browsing data for followcrab.com deletes all of it, including the record of your purchase, so keep your receipt email.

On your iPhone, in the app

Snapshots are stored in the app's own container on the device — the private storage area iOS gives each app, which no other app can read. They are protected by iOS file encryption whenever your phone is locked.

You are in control of them: in Settings you can delete any individual snapshot, or delete everything at once. Deleting the app removes all of it.

This data is included in your own device backup (iCloud or encrypted local backup), and that is deliberate: your snapshot history is the record that makes future comparisons possible, and it would be unrecoverable if a phone were lost and the data had been excluded from backups. That backup is yours, held under your Apple account — we have no access to it. If you would rather it were not backed up, iOS lets you turn off iCloud Backup for individual apps in Settings → [your name] → iCloud.

Follow Crab is not directed at children, and Instagram itself requires users to be at least 13. Since we collect no personal data from anyone, we hold none from children either.

We share nothing, because we hold nothing. There is no advertising partner, no data broker, no analytics processor and no affiliate receiving anything about you. The only third parties in the picture at all are Polar and Apple, and only for payments, as described in §8.

If Follow Crab were ever sold or transferred, there would be no user data in the transaction — there is none to transfer.

If you are in the EU, the EEA or the UK, the GDPR gives you rights over your personal data: access, rectification, erasure, restriction, portability and objection.

We have nothing to act on. That is not a refusal, it is the honest position: we hold no personal data about you, so there is no record to produce in response to an access request, nothing to correct, and nothing to erase. Your data is on your own device, where you can already inspect it, export it and delete it at any time — §9 says how, and it is faster than any request to us would be.

You are still welcome to write to support@followcrab.com, and we will answer. If your question is about a payment, the merchant of record holds that record: Polar for web purchases, Apple for in-app purchases.

Because Follow Crab has no establishment in the EU or EEA (§1), there is no lead supervisory authority. If you wish to complain, you may do so with the data protection authority in your own country — the EDPB maintains the list of national authorities, and in the UK it is the Information Commissioner's Office.

Follow Crab is operated from California, so this section is stated rather than skipped.

Follow Crab is not a "business" as the CCPA defines one. The statute applies to a business that meets at least one of three thresholds: annual gross revenue over 25 million dollars; buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or deriving 50% or more of its revenue from selling or sharing personal information. Follow Crab meets none of them, and is not close to any of them.

That is the legal position, but it is not the reason your data is safe, so here is the substantive answer as well:

• We do not collect personal information. There is no account, no profile and no server-side record.
• We do not sell personal information, and never have.
• We do not share personal information for cross-context behavioural advertising. We run no advertising at all.

This is why you will not find a "Do Not Sell or Share My Personal Information" link on this site. The requirement attaches to businesses that sell or share personal information; there is nothing here to opt out of. Rather than omit that quietly and leave you wondering, we would rather say it and let you check the rest of this page against the code.

If this policy changes, the date at the top changes with it. Because the claims here describe how the software works, a change to this page means the software changed — not that the lawyering did.

This policy is published in English only. The tool's interface is available in ten languages; this page is not, deliberately — one correct version is worth more than ten approximate ones on a document where precision is the entire point. If anything here is unclear in your language, write to us and we will explain it.

Dmitry Logachev — California, United States
support@followcrab.com

Privacy questions, data requests, refunds and everything else go to the same address, and a person reads it.