Follow Alerts — Privacy Policy

The short version

• You sign in on Instagram's own web page inside the App. We never see your Instagram password.
• The App keeps a login session for your Instagram account on your phone, and uses it to read Instagram on your behalf.
• Your Instagram data (profile, followers, following, changes, stories, notes) is stored on your phone only. The App does not send it to us.
• What does reach our server is small: the token of a purchase so we can verify it with Google Play, and your plan type and language to pick a message.
• The free version shows ads from Google AdMob. The App measures usage with Firebase Analytics.

1. Signing in to Instagram

You log in on Instagram's own login page, shown in a web view inside the App. The App has no username or password field of its own and does not read or capture what you type there.

After you log in, the App reads Instagram's cookies from that web view and keeps three values: your session id, your Instagram user id and a CSRF token. They are stored in the App's private storage on your phone. The App uses them only as request headers when it talks to instagram.com, so that Instagram answers as you. It does not send them to any other address. The web view also keeps Instagram's own cookies in its own cookie store on the phone.

Because the session lets the App act as you, the App can also do what you ask it to do on Instagram, such as follow or unfollow an account when you tap the button for it.

2. What the App fetches and keeps on your phone

Using your session, the App asks Instagram for: your followers and following lists, profile information, your posts and stories, who viewed a story, and who liked a post. It keeps this in a database on your phone:

• your profile: user id, username, full name, biography, profile picture, and — if Instagram returns them for your account — phone number, email, birthday, gender, country and link;
• your followers and following lists and what changed (new followers, people who unfollowed, blockers, deactivated and reactivated accounts), with the history of your counts;
• stories data, profile pictures and the history of their changes;
• your favourites and the notes you write on them;
• the App's settings (notifications, auto-refresh, tile order, whether you accepted the terms and finished onboarding).

Other accounts you choose to watch. If you use the watch feature, the App fetches the same kinds of information about those accounts (profile, followers, following and changes), through your session, and stores it on your phone too. That is information about other people. It stays on your phone and is not sent to us.

3. What we receive on our servers

Only this, sent to Google Cloud Functions that Neron runs:

• Purchase verification: the package name, the purchase token and the subscription id, so the function can ask Google Play whether the purchase is valid. It contains no Instagram information.
• A message for you: your plan type (none, bronze, silver or gold) and your language, so the App can show a fitting message. It contains no account identifier.

The App does not send your Instagram session, user id, username, followers or any Instagram data to us. The function code does not store what it receives. Google, which runs the platform, may keep standard request logs under its own terms.

4. Purchases

Subscriptions are bought and managed through Google Play Billing. Google handles your payment details; we do not get them. Your plan is held in the App's memory and rebuilt from Google Play each time the App starts or resumes; it is not written to your phone's storage.

5. Ads

The free version shows ads from Google AdMob. The App has the Android permissions that let Google's advertising SDK read your device's advertising ID. What the SDK collects and how it uses it is described in Google's privacy policy. You can reset your advertising ID or opt out of ad personalization in Android: Settings > Google > Ads. Premium users see no ads.

6. Analytics

The App uses Firebase Analytics (Google) to count how the App is used. It does not use a crash-reporting service. It sends:

• which button was tapped (the button's name);
• which page of the purchase screen was viewed, and the product and price on the purchase screen when you start or complete a purchase;
• that a purchase failed, that an error happened, that a refresh worked or failed, that data was loaded from your phone, and that you used the watch, story-viewing or story-download features.

These events carry no Instagram ids, usernames, follower counts, story links or error text; the App's own tests check this. The App sets no user id. Firebase also collects some standard device and app information automatically, as described in Firebase's privacy information.

7. Background refresh and notifications

The App can refresh in the background while it is closed. It then calls Instagram with your session and updates the database on your phone. It shows notifications on your phone about changes; for premium users a notification can include up to three usernames. Notifications are created on your phone and nothing is sent to a server for them.

8. Android permissions the App uses

Internet and network state (to reach Instagram and our functions); notifications; vibration; keeping the phone awake, foreground service, starting after reboot and exact alarms (to run the background refresh); writing to storage (to save story media and profile pictures to your gallery when you ask); Google Play Billing; advertising ID and ad-attribution access (for ads); and Google's install-referrer service. The App does not ask for camera, location, contacts, microphone or SMS.

9. How we protect it

Your data is kept on your phone inside the App's private storage, which Android keeps away from other apps. The three Instagram session values are stored there without an additional layer of encryption. Data sent to our functions and to Google, Firebase and Instagram travels over the internet to those services' HTTPS addresses. No system is perfectly secure.

10. Logging out and deleting data

• Logging out calls Instagram's logout and clears the web view's cookies. It does not delete the database on your phone, and it does not remove the three session values the App stored (session id, user id and CSRF token) from the App's storage. Instagram ends the session itself when you log out, but those values stay until you clear them as below.
• "Delete all data" in the App's Preferences empties the database tables. It does not remove the stored session values.
• To remove everything the App holds, clear its storage in Android (Settings > Apps > Follow Alerts > Storage > Clear storage) or uninstall the App.
• You can also review which apps are signed in to your Instagram account in Instagram's own settings.

11. Your choices and rights

Your Instagram data is on your phone, so you can see it in the App and delete it as described above. For anything we may hold about you — in practice the purchase verification data and the Google Cloud logs of our functions — or for any privacy request, write to support@neron.app with "Privacy" in the subject. For data held by Google, Firebase or Instagram, use their own tools and policies.

12. Changes

If this page changes, we update the date at the top.

13. Contact

Neron LLC · support@neron.app · please put "Privacy" in the subject.