Privacy

Who we are

LastFollower operates lastfollower. This policy explains what the service reads, what it keeps, where it keeps it, and what choices you have. Questions or requests go to [email protected].

What we read

When you enter a handle, we read what that Instagram profile already shows publicly: the follower list, the following list, and recent posts along with the accounts that liked them. This is the same information anyone can see by opening the profile in a browser.

We never ask for your Instagram password and there is no Instagram login step. Nothing is posted, liked, followed or messaged on your behalf, and no action is ever taken on your account.

What we store, and where

Finding out who unfollowed you requires comparing your follower list against an earlier copy. That earlier copy is kept in your own browser's local storage, not on our servers.

Specifically, your browser holds the account id, username and display name of each follower from your last scan, plus the results of that scan.

• It never leaves your device except as the input to your own next scan, where it is used only to compute the difference and is not retained afterwards.
• Clearing your browser data, or using your browser's private mode, removes it completely.
• Scanning does not require an account, and an anonymous scan creates no record of you on our side.

If you create an account

Accounts are optional and exist only so that a Pro subscription has something to attach to. Scanning works without one.

If you do sign in, we store your email address, the sign-in codes we send you until they expire or are used, and session records that keep you signed in. If you subscribe, we also store your subscription status and the customer and subscription identifiers our payment processor gives us.

We do not store card numbers. We never see them: they go directly to our payment processor.

Third parties

Public Instagram data is retrieved through HikerAPI, a third-party service. The handle you scan is sent to that service in order to fetch the data. We do not send them anything else about you.

We count page views through Simple Analytics, which is cookieless and collects no personal data. No identifiers are set, and there is nothing that could tie a visit back to you. It is why this site shows no cookie banner: there is nothing to ask you to consent to.

Payments are processed by Stripe, who receive your email address and payment details directly and handle them under their own privacy policy. Sign-in codes are delivered by Resend, who receive your email address in order to send them. The site is hosted on Vercel, and Cloudflare Turnstile is used to tell humans from bots.

We do not run advertising trackers, we do not sell your data, and we do not share it with anyone beyond the providers listed above.

Why we are allowed to hold it

Where data protection law asks for a legal basis, ours is straightforward. We process your email address and subscription details to perform the contract you entered into when you subscribed. We process minimal, aggregate analytics on the basis of our legitimate interest in knowing whether the site works, which is why that analytics collects nothing personal.

How long we keep it

Sign-in codes expire within minutes. Sessions expire on their own and are removed when you sign out. Account and subscription records are kept while your account exists, and for a period afterwards where we are required to retain billing records for tax or accounting purposes.

Scan results and follower snapshots are held in your browser, so their lifetime is entirely in your hands.

Private accounts

A private Instagram account has no public follower list, so there is nothing for us to read and a scan cannot complete. Some people make an account public for the length of a scan and switch it back afterwards. That is a real trade-off and entirely your call. We would rather say so than pretend the limitation does not exist.

Scanning accounts that are not yours

The service reads public data, so it is technically possible to scan a handle that is not yours. Our terms ask you not to use it to harass, stalk or profile anyone, and we may block use that does.

If you believe someone is using the service against you, write to us and tell us what is happening.

Your rights and deleting your data

Everything on your device is in your hands: clear this site's data in your browser settings and your scans and snapshots are gone.

For anything held on our side, you can ask us for a copy of it, ask us to correct it, ask us to delete it, or object to how we use it. Write to us and we will act on it. Deleting your account removes your email address and session records, though we may retain billing records where the law requires it.

If you believe we hold information about you that this page does not account for, get in touch and we will look into it.

Security

Traffic is encrypted in transit. Sign-in uses single-use codes that expire rather than passwords, which means there is no password of yours for us to leak. Access to production data is limited to what running the service requires.

No service can promise perfect security, and we do not. What we can do is hold as little as possible, which is the approach this product is built around.

Children

The service is not intended for anyone under 13, and we do not knowingly collect data from them. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

We update this page when the service changes. The date at the top shows when it last changed, and material changes will be reflected here before they take effect.