Privacy Policy

Last updated 19 October 2026

BulkUnfollow reads your Instagram data export in your own browser. We never see your messages, photos, videos or the export file itself. We do record who you follow and who follows you, who uses the tool and what they do with it, and this page says exactly what.

What we collect

• Usage events. Visits to the site, dropping a zip, finishing the analysis, opening the hand-off, installing the Chrome extension, and starting, pausing and finishing a clean-up run. Each event has a time, and some carry simple counts.
• Your Instagram username. The username of the account that owns the export, and the account the extension sees signed in on instagram.com.
• Accounts you unfollow or remove. When the extension unfollows or removes someone for you, we record that username, what happened (done, failed or skipped) and when.
• Your follow lists. When you drop your export, we record the list of accounts you follow and the list of accounts that follow you: their usernames, the dates the follows began, and the names that appear next to them in the export. We also record the counts (how many you follow, how many follow you, how many do both).
• Your profile details. The name, email address, bio and website on your own Instagram profile, as they appear in your export, and whether the account is private.
• Technical details. The country your connection is in (from Cloudflare), your browser's user agent, and a random id stored in your browser (and in the extension) so we can tell one visitor's events from another's. We do not store your IP address with these records.
• Visit analytics. We run Umami on our own server. For each page view it records the page, where you came from, browser, device type, screen size, language and country. It sets no cookie. It receives event names and counts, never usernames.
• Google Ads click id. If you arrived from one of our Google ads, the click identifier in the link is kept, and when you drop a zip the page requests a small image from our server that carries it, so we can measure whether the ad worked. Our server log of that request is kept for 90 days.
• Messages you send us. The contact form (your message, your email address and your name if you give one, passed to Brevo to reach our inbox) and the support chat (below).
• Standard web logs. Our server keeps ordinary logs, which include IP addresses, to diagnose faults and block abuse. They are kept for 14 days.

What we never collect

• Your messages, comments, likes, photos and videos, and not the file itself. The page opens the zip in your browser and reads it there. Of everything in it, only the follow lists and profile details described above are sent to us.
• Your phone number and birthday: the ones in your export stay in your browser. From your direct messages the page takes only the date of the most recent message in each conversation, and that stays in your browser too.
• Your Instagram password. The extension never asks for it. It works inside the session you are already signed in to.

Why we collect it

To run the tool, to help you when something goes wrong, to fix and improve it, to measure whether our marketing works, and to plan paid features. We do not sell your data and we do not use it to advertise to you.

If you are in the UK or EU, our legal basis is our legitimate interests in running, securing and improving a service and in understanding how it is used. We have kept what we collect to what those purposes need. You can object at any time (see below).

How long we keep it

We keep usage events and the records of accounts you unfollowed or removed for as long as we need them to run the service, or until you ask us to delete them. Web logs are kept for 14 days, and the Google Ads drop line for 90 days. We keep emails and chat conversations as long as it takes to answer you and a reasonable while afterwards.

Who else handles it

• Our own server. Events, usernames and action records are stored on a server we run in Germany (Hetzner). Cloudflare sits in front of the site and passes traffic through.
• Support chat. Every page has a chat button that loads TicketDM, the support tool we run ourselves. It receives the page address, a random visitor id and your IP address on every page view, even if you never open it, and what you type if you do. Our team reads and answers in a Telegram group, so conversations also pass through Telegram. A reply can be emailed to you through Brevo. TicketDM's own policy is at ticketdm.com/legal/privacy. The chat cannot see your export.
• Google. If you came from a Google ad and dropped a zip, the click identifier and the time may be sent to Google so its reporting can show the ad worked. We send nothing that identifies you.
• Meta and Google again. Requesting your export and unfollowing on instagram.com involve Meta directly, and installing the extension involves the Chrome Web Store. Their own policies apply to those.

Your Chrome extension and your browser

The extension keeps your unfollow list, its progress and your settings in Chrome's local extension storage on your computer. Removing the extension, or using its clear-everything button, deletes them. It sends the usage events and action records described above to our server.

Your rights

You can ask us for a copy of what we hold about you, to correct it, or to delete it, and you can object to us using it. Email [email protected] with your Instagram username (and the date, if you wrote to us) and we will find it and act on it. If you are in the UK or EU you can also complain to your data protection authority.

Children

BulkUnfollow is not directed at children under 13 and should not be used by them.

Changes

If this policy changes, the date at the top changes with it. If we start collecting something new, we update this page before we do.

Contact

Questions about this policy: [email protected].