Legal

Privacy Policy

Effective date: 2025-01-01

Last updated: November 2, 2026

1. Who we are

Data Controller:

Organization Number:

Address:

Contact: contact@fastsocial.co

Phone:

Website: fastsocial.co

FastSocial ("we", "us", "our") runs fastsocial.co. We sell Instagram growth services (one-time packs, subscriptions and auto-likes), offer free Instagram tools and free offers, and run the Instagram Data API. FastSocial decides how your personal data is used and is responsible for it. This policy explains what we collect, why, who we share it with, how long we keep it and what you can ask us to do. For any privacy question, email contact@fastsocial.co.

2. What we collect

When you buy

Order details: your email address, the Instagram username or post link you want the service for, what you bought, the price, and any custom comments you write for a comments order. We never ask for your Instagram password.
Checkout session: while you check out we record your email, the items in your cart, your IP address, your browser's user agent, your country, Meta's browser and click IDs if present, and where you came from. We use this to match your payment to your order and to prevent fraud. On some checkout pages your browser also asks ipapi.co for your country, which means ipapi.co sees your IP address.
Payment details: payments on fastsocial.co are taken by Finby (TrustPay). You type your card details into Finby's secure fields, so they go straight to Finby. Finby sends us the result, the last 4 digits of the card and the card type (for example, whether you paid with Apple Pay or Google Pay). We keep these so we can find your order if you ask. We never store full card numbers or security codes.
Older payments through Cardinity: some older subscriptions were paid through our previous card processor, Cardinity. For those payments our records also hold the masked card number, the card's expiry month and year, the cardholder name and the country that Cardinity returned.
Subscriptions and auto-likes: your plan, billing interval and payment history, and for auto-likes, the IDs of the new public posts we detect on your account and the likes sent to each.
Viewer credits: if you buy story viewer credits, your email address and credit balance, linked to a hash of your browser ID (see Section 18).

When you contact us or leave a review

Support: your emails to us, our replies, and notes about your case. Many first replies are written by our AI support assistant (see Section 7).
Reviews: your name, email address, rating, the text you write and the product it is about. We publish the name, rating and text. We never publish your email.

When you use the website and free tools

Usage data: IP address, browser and device type, pages viewed, and what you do on the page, collected through our own logs, cookies and the analytics tools in Section 4.
Free tool limits: your IP address, which tool you used and how many times that day (see Section 6).
Free offers: the Instagram username or post link you claim for, your IP address, and checks on your connection (see Section 6).
Public Instagram data: what our tools read about the public accounts people look up (see Section 17).
Manage page checks: what you give us to prove an order is yours (see Section 16).
Email link clicks: which email and which link you clicked (see Section 4).

If you use the Instagram Data API or its MCP server, Section 15 lists what we collect for that. Our browser extensions are covered in Section 19.

3. How we use it and our legal basis

To deliver what you bought: taking payment, delivering the service, refills, auto-likes checks, viewer credits and API plans. (Legal basis: contract)
To talk to you about your order: confirmations, receipts, delivery updates, renewal notices and support replies. (Legal basis: contract)
To email you about offers: see Section 5. (Legal basis: legitimate interests)
To measure and improve the site and our ads: see Section 4. (Legal basis: legitimate interests)
To show ads on our free tool pages: see Section 4. (Legal basis: legitimate interests)
To run our free tools, statistics pages and the Data API: see Sections 6, 15 and 17. (Legal basis: legitimate interests)
To prevent fraud and abuse: checking payments, limiting free tool use, stopping repeat free claims and blocking automated abuse of our forms. (Legal basis: legitimate interests)
To keep accounting records and handle chargebacks and legal claims. (Legal basis: legal obligation and legitimate interests)

Where we rely on legitimate interests, you can object at any time (see Section 10).

4. Analytics, ads and cookies

Tools on our pages

Google Analytics 4: runs on every page and counts visits, pages viewed and purchases. On the cart, checkout and order confirmation pages it runs through Google Tag Manager.
Ahrefs Web Analytics: runs on every page and counts visits, the sites that sent them, country and device type. It sets no cookies. Ahrefs receives your IP address and browser details with each page view.
Google AdSense: shows ads on our free tool pages and our free likes, followers and views pages, including a short video ad you watch to claim a free offer. It does not run on product, cart, checkout, order confirmation or account pages. Google and its partners use cookies and similar technology to show ads, measure them, prevent ad fraud and, where allowed, personalise ads based on your visits to this and other sites. Google receives your IP address, browser details and the page you are on, and uses this data for its own purposes too, as explained in How Google uses information from sites or apps that use its services. You can turn off personalised ads in Google's My Ad Center.
Meta Pixel: only on the order confirmation page and some checkout pages. It records checkouts and purchases for Facebook and Instagram advertising. On the order confirmation page it also passes your email address to Meta, which the Pixel hashes (scrambles) in your browser before sending.
Meta Conversions API: for some checkout pages and purchases our server also sends the event straight to Meta, with your email address in hashed form, your IP address, your browser's user agent, Meta's browser and click IDs, and a checkout ID.
Microsoft Clarity: only on some checkout pages, through a tag manager. It records how the page is used, including session recordings, so we can fix checkout problems.
Our own visitor ID: a random ID in a first-party cookie (fs_vid) that lasts 90 days. We use it to count how many visitors view a product or use a free tool, and how many of them buy. It is not shared with advertisers.
Where you first came from: on your first visit your browser saves the site that sent you (for example a search engine or an AI assistant such as ChatGPT), the page you landed on and any campaign tags in the link. This is sent with your order so we know which channels bring customers. It is never used to set prices.
Email link clicks: links in our emails go through fastsocial.co/e/ first. We record which email and which link was clicked and link the click to your visitor ID, so we can see whether a purchase followed within 7 days.

Order confirmation page address: the web address of the order confirmation page currently includes your email address. The tools on that page (Google Analytics, Google Tag Manager and the Meta Pixel) receive the page address, so they receive your email address with it.

Cookies we set

fs_vid (90 days): our visitor ID, described above.
fs_mv (30 minutes), fs_mg (12 hours) and fs_mgd (180 days): the manage page lookup, your signed-in session, and "this device" access to an order (see Section 16).
__Host-fs_api (30 days) and fs_dash (30 days): your Data API account session, and a note that you have an account dashboard (see Section 15).
fs_internal and fs_ed: used only by our own team for testing and editing pages.

Other companies' tools set their own cookies, such as Google Analytics (_ga), Google AdSense (for example __gads and __gpi), Meta (_fbp and _fbc), Microsoft Clarity (_clck and _clsk) and Cloudflare (for example __cf_bm, used for security). We also save some things in your browser's local storage (see Section 18).

Your choices

We don't show a cookie banner at the moment. You can block or delete cookies in your browser settings, and blocking third-party cookies stops most ad tracking. Some parts of the site, such as the manage page, need our own cookies to work. You can also use each company's own controls:

Google ads: My Ad Center
Google Analytics: Google Analytics Opt-out Browser Add-on
Facebook and Instagram: Facebook Ad Preferences

5. Emails we send

Order emails: confirmations, receipts, delivery and renewal notices, and sign-in codes. You get these whether or not you subscribe to anything else.
Unfinished checkout reminders: if you enter your email at checkout and don't finish paying, we may send up to two reminders about that order, the first about an hour later and the last about a day later. We send these even if you have never bought from us.
Offers to customers: if you buy from us, we may email you about similar services.

Every reminder and offer email has an unsubscribe link. When you unsubscribe or ask us to delete your data, we keep your email address on a do-not-email list so we never email you again.

6. Free tools and free offers

Daily limits: to keep the free tools free, each tool has a daily limit per person. For each tool and each day we record your IP address and how many times you used the tool. We don't record the usernames or links you looked up in these records.
How long: we delete these records once a month, removing everything older than 30 days. Before deleting, we save an archive copy, which we keep for up to 400 days in case we need to investigate abuse, and then delete.
Visitor counts: we also record which tools your visitor ID used on which days (no usernames or links) to see which tools people find useful. These records are deleted after about a year.
Free offers (free likes, followers and views): when you claim, we keep the Instagram username or post link you claimed for, your IP address, the time and the order we placed, so each account or post can claim only once. We use your IP address and approximate location to prevent abuse and decide whether free offers are available. We also check whether you are using a VPN, proxy or Tor, and limit how many attempts can come from one IP address. The username or post link is sent to our delivery partners to deliver the claim.
Text tools and account audit: what you type into our free text tools, such as the username and caption idea tools, is sent to OpenAI to write the ideas. The account audit sends public numbers about the account to OpenAI to write the report.
Story and highlight viewer: see Section 18.

Our free tools never ask for your Instagram password and never log in to your account.

7. Who we share data with

We share personal data only with the companies we need to run FastSocial, and only what each one needs:

Payments: Finby (TrustPay) for all new payments, and Cardinity for some older subscriptions. In a payment dispute we send order and delivery evidence to the processor.
Hosting and storage: DigitalOcean (our servers, in Frankfurt, Germany), Supabase (our main database, in Stockholm, Sweden) and Cloudflare (website delivery and security, the Turnstile check on our forms, hosting for the Data API, and storage for our encrypted backups).
Email: Zoho, including Zoho Mail (our mailboxes) and ZeptoMail (order and reminder emails), and an email-sending provider for offer emails.
OpenAI: our AI support assistant, our free text tools, the account audit, and writing or checking comments for comments orders. The support assistant reads your email and drafts or sends a reply. Every reply it writes says "Written by our AI support assistant, which can make mistakes." A person on our team approves any refund. We ask OpenAI to store the assistant's conversations so it can follow a support thread, and OpenAI keeps them under its API data terms.
Telegram: our team's internal alerts and approvals, for example approving a refund or a manage page payment match by hand. These messages can include an order's email address, Instagram username and amount.
Analytics and ads: Google (Analytics, Tag Manager and AdSense), Meta (Pixel and Conversions API), Microsoft (Clarity) and Ahrefs (Web Analytics), as described in Section 4. Google and Meta also use this data for their own purposes under their own privacy policies.
ipapi.co: your browser asks it for your country on some checkout pages.
Instagram data services: services that read public Instagram data for us. They receive the username or post link being looked up, never your email or payment details.
Delivery partners: they receive only the Instagram username or post link, the amount to deliver, and the comment text for comments orders. Never your email or payment details.
Instagram (Meta): photos and videos in our tools load straight from Instagram's servers, so Instagram receives your IP address, as it would if you opened the post on Instagram.
Authorities: when the law requires it, or to protect our rights or someone's safety.
A buyer of our business: if FastSocial is sold or merged, under this policy.

We do not sell your personal information for money. We don't give your data to other companies for their own marketing, apart from what Google and Meta receive through the ad tools in Section 4.

8. Where your data is stored

Our servers are in Germany and our main database is in Sweden. Some of the companies in Section 7, such as Google, Meta, Microsoft, OpenAI, Cloudflare, Ahrefs and Telegram, may process data in the United States or other countries outside the European Economic Area. When that happens we rely on the safeguards in each company's data protection terms, such as the European Commission's Standard Contractual Clauses or an adequacy decision, for example the EU-U.S. Data Privacy Framework for companies certified under it.

9. How long we keep it

Orders and payments: kept for accounting and tax, and to handle refunds, refills and chargebacks. We don't delete these on a fixed schedule. A deletion request anonymises them as described in Section 10.
Checkout sessions: deleted about a day after your order is created. If a checkout didn't lead to an order, we keep the record so we can find a payment that went through without one.
Checkout step logs (which can include the email and username you typed): about 90 days, except purchase events, which we keep with the order.
Our own visitor records (visitor ID, where you came from, tools used, email link clicks): about a year.
Free tool limit records: 30 days in our database, plus an archive copy for up to 400 days (Section 6).
Free offer claims: kept so each account or post can claim only once. We don't delete these on a schedule.
Rate limits and sign-in lockouts: between 1 hour and 2 days.
Hashed checkout signals for the manage page: 180 days (Section 12).
Support emails: kept in our mailbox, with notes on your case, until we no longer need them for support, refunds or disputes.
Reviews: until you ask us to remove them.
Do-not-email list: kept for as long as we send email, so we never email you again.
Google Analytics: at most 14 months, the longest Google Analytics allows on our plan. Other companies keep data under their own policies.
Server logs: our web server's access logs record the IP address, time, the address requested (which can contain a username or post link) and browser user agent, and are kept for 14 days. Our system log is kept for 30 days. A few background job logs, such as order delivery and email jobs, are cleared by size rather than by date, so their age varies. They can include an order's email address or Instagram username.
Backups: once a day we back up our databases into encrypted files stored with Cloudflare. We keep the last 30 daily backups and one backup a month for 12 months. This means data that we delete, or that you ask us to delete, can stay in our backups for up to about a year, until the backups holding it are deleted in turn. We use backups only to recover from a failure.

Our clean-ups run once a month, so a record can last up to a month past the limits above.

10. Your rights

Wherever you live, you can ask us to:

Access: give you a copy of the personal data we hold about you.
Correct: fix data that is wrong or incomplete, such as the email or username on an order.
Delete: delete or anonymise your data. We may keep what we must for accounting or to handle a dispute.
Object: stop using your data where we rely on legitimate interests, including emails about offers.
Portability: give you your data in a common, machine-readable format.
Restrict: pause using your data while we look into a complaint about it.

Email contact@fastsocial.co, ideally from the email address on your order. We may ask you to confirm the request from that address. We reply within 30 days. If you are in the European Economic Area, the UK or Switzerland, you can also complain to your local data protection authority.

Delete my data page: you can also use the Delete my data page. We email a confirmation link to the address you enter. When you open it and press the button, we:

switch off any Data API keys on your account, which also disconnects any connected apps;
cancel any active subscription, auto-likes plan or Data API plan under that email, and stop any one-time order we haven't sent for delivery yet. A slow-delivery order stops where it is. If this stops an order you paid for, email us and we will look at a refund;
remove your email address, Instagram usernames, IP address, browser and ad click details, names, card digits and expiry date, billing country and custom comment texts from our order, payment, subscription, checkout and analytics records. We keep the order number, amount, date, status and payment reference, because we need them for accounting and disputes;
remove your email address from checkout reminders, referral records, viewer credits (unused credits are lost) and the records of proving an order is yours on the manage page (Section 16);
delete your Data API account, sign-in sessions, login codes, usage history and tracked accounts, and remove your email address and IP address from your Data API plan and payment records;
replace your name with "Anonymous" and remove your email address on any review you left;
delete the public Instagram data we hold for the usernames on your orders, stop storing them (Section 17), and remove those usernames and your IP address from our free offer records;
add your email address to our do-not-email list. This is the only place we keep it, so that we never email you again.

Anonymisation can't be undone, so afterwards we can't look up your past orders, refill them or move them to you. Emails you sent to support stay in our mailbox, and server logs and backups are deleted on their normal schedule (Section 9). Email us if you want anything else removed.

11. California residents

The data we collect is listed in Section 2. In the last 12 months that included identifiers (such as email address, IP address and cookie IDs), purchase records, internet activity on our site and approximate location. We use it for the purposes in Section 3 and share it as described in Section 7.

Selling: we do not sell personal information for money.
Sharing for ads: Google AdSense on our free tool and free offer pages, and the Meta Pixel and Conversions API on checkout pages, may count as "sharing" personal information for cross-context behavioral advertising under California law. The data involved is cookie IDs, IP address, browsing activity on our site and, for Meta, your hashed email.
How to opt out: block third-party cookies in your browser, turn off personalised ads in Google's My Ad Center and in Facebook Ad Preferences, or email contact@fastsocial.co with "Do not sell or share" in the subject.
Your rights: you can ask to know, delete or correct your personal information, as in Section 10. You can use an authorised agent. We won't treat you differently for using these rights.
We don't use sensitive personal information to infer things about you, and we don't knowingly sell or share the personal information of anyone under 16.

12. Security

Data travels over encrypted connections (TLS). Our main database provider encrypts stored data, and our backups are encrypted before they leave our server.
Card details go straight to our payment processor. We never store full card numbers or security codes.
Sign-in codes, API keys, session tokens and manage page phrases are stored only as hashes. Wrong codes and repeated attempts are limited and locked out.
Access to our servers and database is limited to the people who run FastSocial.
To protect your orders and help you recover one, we keep hashed signals from the device used at checkout (such as network, time zone and browser type), never the raw values, for 180 days.

No system is completely secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

13. Children

Our services are not meant for anyone under 18. We don't knowingly collect personal data from children. If you think a child has given us personal data, email us and we will delete it.

14. Changes and contact

We update this policy when our services or the law change. The date at the top shows the latest version. If a change matters for how we use your data, we will email customers or show a notice on the site.

For privacy questions, to use your rights or to report a security problem, contact us:

Email: contact@fastsocial.co
Phone:
Address:

15. Instagram Data API and MCP server

This section covers the Instagram Data API at data.fastsocial.co, its MCP server (the remote server at data.fastsocial.co/mcp and the instagram-data-mcp package), and the API account pages on fastsocial.co. The rest of this policy applies too. The instagram-data-mcp package runs on your own computer and sends each request to the API with your key, so everything below applies to it in the same way.

When you sign up or sign in

Email address: used to send your sign-in codes, your API key, and emails about your plan and billing.
Sign-in codes: we store a keyed hash of each code, never the code itself. A code works once and expires after 10 minutes. A wrong guess cuts what is left to 3 minutes, and 3 wrong guesses cancel it, so you need a new code. Every 3rd wrong code also blocks sign-in for that email and that IP address for a while, starting at 1 minute and doubling up to a day.
Sessions: signing in sets a cookie. We store a hash of the cookie value, never the value itself, together with your IP address and your browser's user agent. A session ends when you log out, after 7 days without use, or after 30 days.
API keys: we store a SHA-256 hash of each key and its first few characters so you can tell your keys apart. We never store the full key. It is shown to you once, and the first key for each new plan is also emailed to you. We can't recover a lost key, but you can make a new one.
Paid plans: your plan, its billing status, the payment records our payment processor sends back, and the IP address used at checkout. Card details are handled by the payment processor, as described in Section 2.
Usage: for each key, the number of calls and credits used in each calendar month, and for each day the number of calls, credits and errors per endpoint. These counts don't include which Instagram accounts you looked up.
Dashboard activity: when you use a tool in your account dashboard we keep a row with the tool, the credits it cost, the time and whether it worked, so you can see your recent activity. It doesn't include which Instagram account you looked up.
Tracked accounts: if you add Instagram accounts to track, we keep those usernames with your account so we can refresh them and send your weekly report, until you remove them.
Highlight charges: a highlight is charged once per Instagram account every 15 minutes. To do that we keep a keyed one-way hash of your account and the highlight's owner, which can't be turned back into the username, and delete it when the 15 minutes end.

Free keys

When you create a free key we also store your IP address (on IPv6, the network it belongs to), a random device ID that the page saves in your browser's local storage, and a one-way hash of your browser's settings. We use these only to prevent abuse of free keys, so that one person can't create many of them.

When you connect an app

App registrations: when an app such as an AI assistant registers to connect, we store the name it gives, the redirect addresses it gives, and the IP address it registered from.
Sign-in requests and authorization codes: a sign-in request expires after 10 minutes. An authorization code is stored only as a hash, works once, and expires after 5 minutes.
Access and refresh tokens: stored only as hashes. An access token lasts 1 hour. A refresh token lasts 30 days and is replaced with a new one every time it is used. If an old refresh token is used again, every token from that sign-in is cancelled.
Tokens follow your key: every token is tied to one of your API keys and is checked against it on each request. Pressing "New key" on your account page switches the old key off, and every app connected through it stops working straight away. Connect the app again and it will use your new key. When a plan ends, its key and the apps connected through it stop working in the same way.

Instagram data and requests

We don't keep a record of which Instagram accounts you look up, other than the accounts you choose to track. Our server logs can include IP addresses and the usernames or links in a request, and are kept as described in Section 9.
API responses with follower, like or view counts are cached for at most 5 minutes so repeat requests are fast, then dropped. The cache is not linked to who asked. The public numbers themselves also go into our shared Instagram data store, as described in Section 17.
The store records what data was read and the result, but never who asked for it.
Engagement insights lookups add anonymous counts to our benchmark statistics: a follower range, whether the account is a business account, and an engagement range. The data that could link a count to an account is deleted every day.
We never ask for your Instagram password, and the API never posts anything or acts on your account.
If you own an Instagram account and want it excluded from the API, email us. We keep your username on an exclusion list, and the API refuses requests for that account.

How long we keep it

Expired codes, sessions and tokens stop working, but we don't currently delete these records on a schedule. Your account, key, usage and free-key records stay until you ask us to delete them. Payment records are kept as described in Section 9.

Deleting your API account

Email contact@fastsocial.co from the address on your account and ask us to delete it. We will switch off your keys, which also disconnects any connected apps, and delete or anonymise the records in this section, except payment records we have to keep for accounting. You can also use the Delete my data page (Section 10).

16. Proving an order is yours (the manage page)

The manage page shows nothing about any order or plan until you prove it is yours. Typing an email or username never tells anyone whether orders exist. You can prove it in one of these ways:

Email code: we send a 6-digit code to the email used at checkout. It works once and expires after 10 minutes. A wrong guess cuts what is left to 3 minutes, 3 wrong guesses cancel it, and repeated wrong codes block sign-in for a while. We store only a keyed hash of the code.
Bio phrase: we give you a short phrase to add to your Instagram bio, then read the public profile once to check it. We don't store or log your bio. The phrase is stored only as a keyed hash and expires after 20 minutes.
This device: after you pay, the order confirmation page saves a random device token in your browser. It lets that browser open that order for 180 days.
Payment match: if neither your email nor your username works, you can tell us the amount, currency and date of the payment and the last 4 digits of the card, plus anything else you remember. We compare this with our own payment records. You first confirm the correct Instagram username with a bio phrase and a new email address with a code. If exactly one payment clearly matches, the order is moved to you automatically. Otherwise your request goes to our team, who approve or deny it by hand through Telegram. We never show payment details back to the person asking. A request expires after 3 days.

Once you are verified, you get a sign-in session in a secure cookie that lasts 12 hours and is tied to that browser. We store a hash of the session, never the session value itself.

17. Public Instagram data and Instagram account owners

This section is for anyone whose public Instagram account shows up in our tools, statistics pages or Data API.

What our tools show

When someone enters a username or link, our free tools show what that account has made public on Instagram: profile details such as name, bio, profile photo and follower counts, and public posts, reels, stories and highlights, plus figures we work out from them, such as engagement rate. For a private account we show only what Instagram shows to anyone, such as the name and counts, never posts or stories. We never log in to the account, never ask anyone for an Instagram password, and the account owner is never notified. Viewers don't appear in the owner's story viewer list.

Where it comes from

Only from public Instagram accounts. Our own reader reads Instagram's public pages without logging in. For some data, such as stories and highlights, we use outside data services that provide public Instagram data. We use this data because running the tools, our statistics and the Data API is our legitimate interest, and you can object to it (see "Removal" below).

Photos and videos

We don't keep a library of Instagram photos or videos. Photos and videos load straight from Instagram's servers. If one can't load directly, it passes through our servers, and our network provider (Cloudflare) may keep a temporary copy until Instagram's own link for that file expires, and never more than 7 days. Lookup results are held in memory for up to 10 minutes so repeat requests are fast.

What we keep: our shared data store

Our free tools, checkout, delivery checks, auto-likes checks and Instagram Data API all read public Instagram data. The numbers they read go into one shared store, which we use for our Instagram Top Charts and statistics pages, and to avoid looking up the same account twice.

What it holds: public profile numbers (username, Instagram ID, followers, following, post count, display name, category, and whether the account is private or verified) and, for public accounts, public post numbers (post ID, date, format, likes, comments and views).
What it never holds: captions, images, bios, links, emails, phone numbers, or any customer or payment data. For a private account it holds only the profile numbers and the fact that it is private, never posts.
Who asked: we never store who made a lookup: no API key, account, IP address, browser or visitor ID. We record only which part of our service the data came from (for example "checkout"), and times are rounded to 5 minutes so they can't be matched to a request. Our server logs (Section 9) are the only place a request and a username can appear together.
How long: every profile snapshot is kept for 30 days. After that we keep one snapshot a day, for up to 400 days, only for accounts with at least 100,000 followers. Post numbers are dropped once a post hasn't been seen for 120 days.
Checkout account checks: when a username is entered at checkout, we also keep the result of checking it (for example, whether the account exists and is public) so we don't check it again too soon.
What gets published: nothing in the store is published as it is. Our Top Charts pages and their downloads show only the accounts on their published lists, and our benchmark figures are published only as group totals, so a small account someone looked up never appears anywhere.

Removal

To have an account removed from the Top Charts, the statistics pages and their downloads, excluded from the Data API, or deleted from our data store, or for anything else, email contact@fastsocial.co. A removed username is kept on a block list so we don't store it again.
Our free tools read Instagram live each time someone asks. Making your account private stops them showing your posts, reels and stories.
The Delete my data page also removes the usernames on your subscriptions and payments from the store.

18. Information kept on your device

Some things are saved only in your browser's local storage and stay on your device:

Emails used at checkout: up to 10 email addresses used at checkout in that browser, so you can pick the one you used before or find an order on the manage page if you mistyped it. This list is not sent to us.
Where you first came from: see Section 4.
Manage page device token: see Section 16.

You can remove all of these at any time by clearing this site's data in your browser settings.

Story and highlight viewer: to count free views per day, we store a hash of your browser ID, a hash of your network, and a hash of your network together with your browser settings, never your raw IP address. We delete these after the following day (UTC), so they are kept for at most 48 hours. The daily free tool limit in Section 6 also applies. If you buy viewer credits, a hash of your browser ID is kept with your email and credit balance so that browser can use it.

18A. Follower and unfollow trackers

If you subscribe: we keep your email, the Instagram account you track, your plan and a sign-in key for your dashboard, so we can run the tracking, send your reports and let you cancel.
Saved lists: we save the public following and followers lists of the tracked account (usernames, display names and profile pictures of the accounts on them) and the changes we find. Accounts on those lists can ask us to remove them: see Section 10.
Your data download: if you upload your own Instagram data download, we read the follower and following lists from it. A raw copy is kept in private storage and deleted after 30 days.
Estimates: girls and guys figures are estimated from names. Instagram doesn't tell us anyone's gender.

19. Browser extensions

This section covers our Chrome extensions: FastSocial Story Saver, FastSocial Photo Downloader, FastSocial Reels Downloader, FastSocial Profile Viewer and FastSocial for Instagram: All-in-One. They add a button on www.instagram.com that opens our free tools.

What they read: only the address of the Instagram page you are on, to pick the matching tool. They don't read the page's content, your Instagram account, your messages or your cookies, and they don't keep a history of the pages you visit.
What they store in your browser: whether the button shows on Instagram. If you sign in with FastSocial, also your sign-in tokens, the extension's app ID from our sign-in server and a copy of our credit prices. Nothing else.
What they send: nothing until you use a feature. A tool link opens fastsocial.co with the username or post link in the address and a tag that says the visit came from the extension. If you are signed in and run a lookup in the extension, it sends the username or link you chose to our Data API at data.fastsocial.co with your token, and the lookup uses your plan's credits.
Signing in: you sign in on fastsocial.co with an email code and press Allow. The extension never sees your email address or the code. It gets an access token and a refresh token tied to your API key, which we handle as described in Section 15 under "When you connect an app".
No tracking: the extensions have no analytics, ads or tracking of their own. We don't sell what they send us or use it for advertising.
Signing out and removing: "Sign out" in the extension deletes the tokens from your browser and cancels them on our side. Removing the extension deletes everything it saved in your browser. Pressing "New key" on your account page also disconnects every extension signed in with that key.