Privacy Policy

Overview

nFollowers ("we", "the extension", "the app") is a Chrome browser extension that helps you identify Instagram accounts you follow that do not follow you back. This Privacy Policy explains what information is accessed, how it is used, and what is shared with third parties.

We are committed to full transparency. This document is written in plain language so you understand exactly what happens with your data.

What Data We Access

When you run a scan, the extension reads the following from your Instagram account using your existing browser session:

• Your Instagram username, display name, and user ID
• Your followers list — usernames, display names, profile photos, and verified status
• Your following list — usernames, display names, profile photos, and verified status
• Your CSRF token — used solely to authorise unfollow actions you explicitly request

We do not access your Instagram password, private messages, stories, posts, email address, phone number, payment information, or any data beyond what is listed above.

How and Where Data Is Stored

Scan results are held in your browser's session storage only. This data is:

• Stored only on your local device — never transmitted to any nFollowers server
• Automatically cleared when you close the browser
• Never written to permanent storage on your device

Profile images are fetched temporarily for display purposes only and are not saved anywhere.

Optional Analytics (Supabase)

The extension includes an optional feature to record a summary of each completed scan to a Supabase database. If enabled, the following is saved:

• Your Instagram username and user ID
• Your display name
• Total follower count at time of scan
• Total following count at time of scan
• Number of accounts not following you back
• Timestamp of the scan

If you have configured your own Supabase instance, you are the sole owner of that database and are solely responsible for its security and compliance with applicable data protection laws in your jurisdiction.

Third-Party Services

The extension interacts with the following third parties:

• Instagram / Meta — Follower and following data is fetched from Instagram's API using your existing logged-in session. Your use of Instagram is governed by Meta's Privacy Policy and Terms of Service.
• Google Fonts — The dashboard loads the DM Sans typeface from Google's servers. This is subject to Google's privacy policy.
• Supabase — Only if manually configured (see Section 04). Subject to Supabase's own privacy policy.

We do not integrate any advertising networks, analytics platforms, crash reporting tools, or third-party trackers of any kind.

Chrome Permissions Explained

The extension requests only the permissions it genuinely needs:

• storage — Temporarily stores scan state in session storage so your results appear in the dashboard. Cleared on browser restart.
• tabs — Opens the dashboard in a new tab when you click the extension icon, and checks if it is already open to avoid duplicates.
• scripting — Injects the dashboard interface when the extension tab is opened.
• alarms — Keeps the background service worker alive during long scans so Chrome's idle timeout does not interrupt the process.
• host_permissions (instagram.com, fbcdn.net, cdninstagram.com) — Required to fetch your follower and following data from Instagram's API, and to load profile images from Instagram's content delivery network for display in the report.

Children's Privacy

This extension is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has used this extension and data has been collected, please contact us and we will take appropriate action promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date at the top of this page will change. We encourage you to review this page periodically. Continued use of the extension after changes are posted constitutes acceptance of the updated policy.

Your Rights

Because nearly all data processed by this extension remains on your own device and is never transmitted to us, most data subject rights — access, deletion, portability — are exercised simply by uninstalling the extension or clearing your browser's session storage.

For any data in a Supabase instance you have configured yourself, you have direct database access and can delete any records at any time.