WhoLeft — Privacy Policy

1. Who We Are

This Privacy Policy explains how Followers Unfollowers Tracker System LTD ("we", "us", "our") collects, uses and protects information when you use the WhoLeft mobile application for iOS and Android, the website wholeft.com and related services (together, the "Service").

WhoLeft uses only Instagram's official method to analyse your profile: the data export that Instagram itself provides to you. We never ask for your Instagram password, never log in to your account and never scrape Instagram.

We are the data controller for the personal data described in this Policy.

Followers Unfollowers Tracker System LTD 128 City Road, London, United Kingdom, EC1V 2NX Email (including data protection requests under GDPR and LGPD): support@wholeft.com

WhoLeft is an independent service. It is not affiliated with, endorsed by or sponsored by Instagram, Meta Platforms, Inc. or Google LLC.

WhoLeft is a trademark of Followers Unfollowers Tracker System LTD in the United States, the European Union and Brazil.

2. Information We Collect

WhoLeft does not require registration. We do not ask for your name, email address or Instagram password. To use the app, you add one or more Instagram accounts by entering their username; no password is needed. Each Instagram account you add is linked to an anonymous user identifier that the app creates for your device.

Instagram data exports you provide. When you upload an Instagram data export manually, or when we retrieve it from your Google Drive in automatic mode, we store your most recent export and the current state of your follower lists needed to detect changes. It typically contains your followers and following lists: usernames, profile links and timestamps of when accounts were followed.

Google Drive data. If you enable automatic mode, you grant WhoLeft read-only access to your Google Drive. Section 3 explains exactly what we access, store and why.

Device and usage data. Our SDKs collect device model, operating system version, app version, language, country (derived from IP address), IP address, advertising identifiers (IDFA on iOS where you allow tracking, Google Advertising ID on Android), app installation identifiers and in-app events.

Purchase data. When you subscribe, Apple or Google processes the payment. We receive subscription status, product, price, currency, transaction identifiers and renewal dates. We never receive your card details.

Communications. If you contact us, we receive your email address and the content of your message.

Website. The website wholeft.com does not use analytics, advertising or tracking cookies.

3. Google Drive Access and Google User Data

Connecting Google Drive is optional. It is used only for automatic mode, where WhoLeft retrieves the Instagram data exports that you have chosen to save to your own Google Drive on a schedule. You can connect a separate Google Drive to each Instagram account you add in the app.

3.1 Permission we request

We request read-only access to Google Drive (https://www.googleapis.com/auth/drive.readonly). With this permission WhoLeft cannot create, edit, move, share or delete any file in your Drive.

Instagram exports are created in your Drive by Meta, not by WhoLeft. A narrower permission limited to files created by our app would not allow us to read them, so read-only Drive access is the minimum permission that makes automatic mode possible.

3.2 What we access and why

While your Google Drive is connected, our server checks it about once a day. These requests are made only to the folders containing Instagram data exports created by Meta, and only those export files are downloaded. We use them for one purpose: analysing your Instagram followers and showing you changes in the app, such as unfollowers, new followers and accounts that do not follow you back.

We do not request, open, read, download or store any other files or folders in your Drive, and we do not keep a list of them.

3.3 Google user data we store

• OAuth access and refresh tokens, stored encrypted, so the daily check can run without you opening the app.
• Your Google Drive account identifier and the Instagram username it is connected to, used to keep each connection's data separate.
• Identifiers and dates of the Instagram export files already processed, so the same file is not processed twice.
• Your most recent Instagram export and the current state of your follower lists.

We do not access or store your Google account password, contacts, email, calendar, photos or any other Google data.

3.4 How we protect it

Google user data is transmitted only over encrypted connections (TLS) and stored encrypted at rest on Amazon Web Services (AWS). OAuth tokens are encrypted separately. Data of users in the EEA, the UK and Switzerland stays on AWS servers in the European Union. Each user's data is isolated by Google Drive account and processed automatically. Access to production systems is limited to authorised personnel and protected by multi-factor authentication.

3.5 Sharing

We do not sell, rent or share Google user data with anyone. The only third party that handles it is our hosting provider, AWS, which stores it on our behalf under a data processing agreement. We may disclose it only if required by law, or as part of a merger or acquisition after notifying you.

3.6 Retention and deletion

We keep Google user data only while Google Drive is connected to WhoLeft. When you log out of an Instagram account in the app, we immediately delete the OAuth tokens, export data and file identifiers linked to that account, and revoke the related Google Drive access. Remaining copies in backups are deleted within 30 days.

If you revoke access in your Google Account instead, we delete your stored data within 30 days of detecting that access was removed. You can also request deletion at any time at support@wholeft.com.

3.7 How to revoke access

You can remove WhoLeft's access to your Google Drive at any time in either of two ways:

1. In the WhoLeft app, log out of the Instagram account the Drive is connected to. This deletes that account's data and revokes access.
2. In your Google Account, go to Third-party apps with account access, select WhoLeft and choose Remove access.

3.8 Limited Use

WhoLeft's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing feature described above.
• We do not transfer it to third parties, except as needed to provide that feature, to comply with law, or as part of a merger or acquisition with your notice.
• We do not use or transfer it for advertising, including retargeting, personalised or interest-based ads.
• We do not sell it, or use it to determine creditworthiness or for lending purposes.
• We do not use it to develop, improve or train generalised artificial intelligence or machine learning models.
• No person at our company reads it, unless you give explicit consent for specific data, it is needed for security purposes such as investigating abuse, or it is required by law.

4. How We Use Information

We do not use your Instagram export data or Google user data for advertising or for profiling unrelated to the analysis you requested.

5. Third-Party Services

We use the following service providers. They process data on our behalf or under their own privacy policies. Our servers are hosted by Amazon Web Services (AWS), which stores data on our behalf under a data processing agreement (AWS privacy notice). Apart from AWS, none of the providers below receive your Instagram export contents or Google user data.

On iOS, advertising identifiers are collected only if you allow tracking in Apple's App Tracking Transparency prompt. On Android, you can reset or limit your advertising ID in device settings.

6. Sharing and Disclosure

We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising except through the advertising SDKs described in Section 5, which you can opt out of.

We disclose personal data only:

• to the service providers listed in Section 5 and to our hosting provider, AWS, under contracts that limit their use of the data;
• when required by law, court order or a valid request from a public authority;
• to protect the rights, safety and security of our users, the public or us;
• to a buyer or successor in a merger, acquisition or sale of assets, subject to this Policy. We will notify you before your data becomes subject to a different policy.

7. Information About Other Instagram Users

Your Instagram export contains public usernames and profile links of accounts that follow you or that you follow. We store this information only as part of your most recent export and current follower lists, solely to show you changes in your own account.

We do not contact these people, build profiles about them, combine their data across different users, or use it for any other purpose. Our legal basis is legitimate interests: providing you with an analysis of your own account's connections, with minimal impact on the people listed.

If you believe your data appears in our systems through another user's export and want it removed, write to support@wholeft.com.

8. Storage, Security and International Transfers

Our servers and database are hosted on Amazon Web Services (AWS). Data of users in the European Economic Area, the United Kingdom and Switzerland is stored and processed on AWS servers located in the European Union. Data of users in other regions is stored on AWS servers outside the EU, including in the United States. The storage region is determined by your IP address at the moment you connect Google Drive. Data is strictly separated per Instagram account and Google Drive connection: each user's data is stored and processed in isolation and is never mixed with another user's data.

We protect data with encryption in transit (TLS), encryption at rest, access controls limited to systems that need the data, and encrypted storage of Google tokens. No method of storage or transmission is completely secure, but we work to protect your data against unauthorised access, loss and misuse.

Instagram export data of users in the EEA, the UK and Switzerland stays on EU servers. The analytics and attribution providers listed in Section 5 may process device and usage data in the United States and other countries. When data leaves the UK or EEA, we rely on adequacy decisions or on safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

9. Retention and Deletion

We keep only your most recent export and the current state of your follower lists; earlier exports are deleted once processed. We keep this data and your Google tokens only while the Instagram account remains added in the app.

Log out to delete your data. When you log out of an Instagram account in the app, we permanently delete all its export data and analysis results from our servers and revoke the related Google Drive access. If you log out of all accounts, we delete all data linked to your app user identifier, except subscription records we must keep by law. Deletion from backups completes within 30 days.

Other data. Subscription records are kept as long as required by tax and accounting law. Analytics and attribution data is kept by the providers in Section 5 under their retention settings, typically no longer than 26 months.

Deleting your data does not cancel your subscription. Cancel it in your App Store or Google Play account settings.

10. Your Rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent at any time. Because we do not require registration, we may ask you to verify a request from within the app so we can find your data.

To exercise your rights, email support@wholeft.com. We respond within 30 days, or sooner where local law requires.

UK and EEA. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

California and other US states. You have the right to know, delete and correct personal information and to opt out of its sale or sharing for targeted advertising. We do not sell personal information. To opt out of sharing through advertising SDKs, deny tracking on iOS, limit ad tracking on Android, or email us. We will not discriminate against you for exercising your rights.

Brazil (LGPD). You have the rights set out in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing. Our data protection contact (encarregado) is available at support@wholeft.com.

Other countries. We honour equivalent rights granted by local law.

11. Children

The app's store age rating reflects its content only. The Service is not directed to children under 13, and Instagram itself requires users to be at least 13. We do not knowingly collect personal data from children under 13, or under 16 in countries where a higher age applies, without parental consent. If you believe a child has provided us data, contact support@wholeft.com and we will delete it.

12. Creator Program

If you apply to the WhoLeft Creator Program on wholeft.com, we collect what you submit in the form: name, email, social media handles, links to your content, audience and view statistics, country and your message. If you are accepted, we also collect payout details and the tax information required to pay you.

We use this data to review applications, verify views, manage the partnership, make payments and meet legal obligations. Our legal bases are steps before entering a contract, performance of contract and legal obligation. We keep application data for up to 12 months if you are not accepted, and partner records as long as required by tax and accounting law.

13. Changes and Contact

We may update this Policy. We will post the new version on wholeft.com and in the app with a new "Last updated" date, and notify you in the app of material changes.

Questions or requests: support@wholeft.com Followers Unfollowers Tracker System LTD, 128 City Road, London, United Kingdom, EC1V 2NX