Privacy Policy

1. Who we are

EyeSpy is a trading name of LUCA FROST, a sole trader established in the United Kingdom.

In this Privacy Policy, “EyeSpy”, “we”, “us” and “our” refer to LUCA FROST trading as EyeSpy.

Data controller: LUCA FROST, trading as EyeSpy

Privacy email: support@geteyespy.com

Support email: support@geteyespy.com

Website: geteyespy.com

LUCA FROST is the controller responsible for the personal information described in this Privacy Policy.

2. What this Privacy Policy covers

This Privacy Policy explains how we collect, use, store and share personal information when you:

• use the EyeSpy mobile application;
• create an EyeSpy account;
• search for or monitor a public social-media profile;
• purchase or manage an EyeSpy subscription;
• use the EyeSpy website;
• contact our support team; or
• are the owner of a public profile monitored through EyeSpy.

EyeSpy is an independent service. It is not sponsored, endorsed, administered by or affiliated with Instagram or Meta Platforms, Inc.

3. Plain-language summary

EyeSpy lets users monitor changes to publicly available social-media profiles.

Depending on the available data and the user’s subscription, EyeSpy may detect changes such as:

• new follows and unfollows;
• follower and following-count changes;
• public profile-photo or biography changes;
• new public tagged posts;
• new public posts or reels;
• changes between public and private status; and
• a summary of recent public activity.

EyeSpy does not ask for or store Instagram passwords or Instagram session cookies in the public-tracking version of the Service.

EyeSpy cannot show follow activity from before tracking began. Changes are detected by comparing information collected at different times, so the detection time may not be the exact time the underlying event occurred.

4. Information we collect from EyeSpy users

4.1 Account information

When you create an EyeSpy account, we may collect:

• your name or account display name;
• your email address;
• your EyeSpy user ID;
• your chosen authentication method;
• authentication identifiers provided by Apple, Google or another sign-in provider;
• account creation and last-login dates; and
• account status and settings.

We do not receive your Apple ID or Google account password.

4.2 Search and watchlist information

When you search for or add a profile, we may collect:

• the username you searched;
• the platform user ID associated with the profile;
• profiles added to your watchlist;
• the date tracking began;
• notification preferences;
• account-swap or watchlist activity;
• tracking status;
• the plan capacity used by each profile; and
• the types of changes you choose to monitor.

Searches and watchlists may reveal something about your interests or relationships. We treat this information as private EyeSpy account data and do not show other users who you are monitoring.

4.3 Subscription and purchase information

If you subscribe through Apple, we may receive:

• the subscription product selected;
• subscription status;
• purchase and renewal dates;
• transaction and original transaction identifiers;
• country or storefront;
• whether a purchase was restored, cancelled, refunded or expired; and
• limited receipt or entitlement information needed to provide access.

Apple processes your payment method. EyeSpy does not receive your complete card or bank details.

4.4 Device and technical information

We may collect:

• device type and operating-system version;
• app version;
• language and region;
• time zone;
• IP address;
• device or installation identifiers;
• crash reports;
• diagnostic logs;
• security events;
• request timestamps;
• notification token;
• performance information; and
• interactions with app screens and features.

We do not use this information to obtain your precise location unless a future feature explicitly requests permission and this Privacy Policy is updated first.

4.5 Communications and support information

When you contact us, we may collect:

• your contact details;
• the content of your request;
• screenshots or files you voluntarily provide;
• support history; and
• information needed to investigate a problem.

Do not send us Instagram passwords, session cookies or other account-access credentials.

4.6 Onboarding responses

EyeSpy may ask questions about why you are interested in the Service, such as whether you want to monitor a partner, ex, crush or friend.

We may use those responses to:

• personalise onboarding copy;
• display relevant feature examples;
• recommend settings;
• understand general product demand; and
• improve the Service.

We do not use onboarding responses to determine whether someone is cheating, dishonest or engaged in wrongdoing.

Where possible, we store broad response categories rather than detailed relationship information.

5. Information about monitored profiles

EyeSpy also processes information relating to people who may not have an EyeSpy account.

For a monitored public profile, we may process:

• username and stable platform user ID;
• display name;
• public profile image;
• public biography;
• public account-verification status;
• follower and following counts;
• public or private status;
• publicly visible follower or following relationships where supported;
• publicly visible posts, reels and tagged content;
• public profile links;
• the dates on which EyeSpy checked the profile;
• changes detected between checks; and
• generated event records such as “followed”, “unfollowed”, “bio changed” or “profile became private”.

We may cache limited profile images or public-content thumbnails to display the Service efficiently.

We do not intentionally collect:

• private messages;
• precise location;
• passwords;
• private posts not visible to the relevant data source;
• payment information belonging to monitored individuals; or
• content obtained by bypassing a profile’s privacy settings.

Public information is still treated as personal information

We treat identifiable public-profile information as personal information where data-protection law applies.

We limit the information collected to what is reasonably needed to provide change monitoring, apply retention limits and provide a removal and objection process for monitored individuals.

6. Where information comes from

We obtain information from:

• you;
• Apple, Google or another authentication provider;
• Apple’s App Store and in-app purchase infrastructure;
• your device and the EyeSpy application;
• publicly available social-media pages and information;
• public-data providers such as RocketAPI;
• analytics, infrastructure and security providers;
• support communications; and
• other users who search for or monitor a public profile.

We do not claim that Instagram or Meta supplies or approves the data used by EyeSpy.

7. How and why we use personal information

Providing the EyeSpy Service

We use account, watchlist, tracked-profile and technical information to:

• create and manage your account;
• resolve public usernames;
• capture an initial tracking baseline;
• perform scheduled checks;
• compare profile information between checks;
• generate follow, unfollow, tag and profile-change events;
• display your EyeSpy feed;
• send requested notifications;
• enforce plan limits; and
• restore subscription access.

Lawful basis: performance of our contract with you.

For information relating to monitored public profiles, our intended lawful basis is our legitimate interest in providing users with a public-information monitoring service, subject to a balancing assessment, data minimisation, safety controls and the right to object.

Processing purchases and subscriptions

We use transaction and entitlement information to:

• activate paid features;
• check subscription status;
• restore purchases;
• manage plan capacity;
• investigate purchase errors; and
• maintain required financial records.

Lawful basis: performance of our contract and compliance with legal obligations.

Security, fraud prevention and service integrity

We use technical, account and usage information to:

• prevent account abuse;
• detect fraudulent purchases;
• investigate suspicious activity;
• secure user accounts;
• prevent excessive automated searches;
• identify false or incomplete profile snapshots;
• avoid sending inaccurate mass-change alerts; and
• protect our systems and users.

Lawful basis: our legitimate interests in operating a safe and reliable service and, where applicable, compliance with legal obligations.

Service analytics and improvement

We may use app-event, diagnostic and aggregated usage information to:

• understand which features are used;
• measure onboarding and paywall performance;
• fix crashes and bugs;
• improve reliability;
• evaluate plan capacity and provider costs; and
• develop new features.

Where required, we ask for consent before using non-essential analytics or device-level tracking.

We do not sell your watchlist or use the identity of the profiles you monitor to target third-party advertising at you.

Lawful basis: legitimate interests or consent, depending on the technology and applicable law.

Customer communications

We use your contact details to send:

• service and security notices;
• purchase or account information;
• requested support replies;
• tracking-status messages; and
• important changes to the Service or policies.

We send promotional marketing only where permitted and provide an unsubscribe method.

Lawful basis: performance of our contract, legitimate interests or consent, as applicable.

Legal obligations and claims

We may use or disclose information to:

• comply with law, court orders or lawful regulatory requests;
• respond to data-protection requests;
• establish, exercise or defend legal claims;
• maintain accounting and tax records; and
• investigate misuse of the Service.

Lawful basis: legal obligation or legitimate interests.

8. Our legitimate interests in public-profile monitoring

Where we rely on legitimate interests for monitored-profile information, the interests we pursue include:

• allowing users to organise and monitor changes to publicly available profiles;
• providing notifications instead of requiring repetitive manual checks;
• maintaining reliable historical comparisons from the date tracking begins; and
• protecting and improving the Service.

Before launch, we assess:

• whether the processing is necessary;
• whether a less intrusive method is available;
• what monitored individuals are likely to expect;
• the possible effect on monitored individuals;
• whether children or vulnerable people may be affected;
• the type and quantity of data retained;
• safeguards such as public-only collection, short raw-data retention and opt-out; and
• whether our interests are overridden by the rights and freedoms of the monitored individual.

9. Your right to object to public-profile monitoring

You have the right to object to our processing of your personal information where we rely on legitimate interests.

If a profile belongs to you and you do not want it monitored through EyeSpy, contact support@geteyespy.com or use https://geteyespy.com/privacy/opt-out.

We may ask for reasonable information to verify that you control the profile.

Where we accept a request, we may:

• stop future tracking;
• remove the profile from active watchlists;
• delete associated event history where required;
• prevent the profile from being re-added; and
• retain a minimal suppression record, such as a platform user ID, solely to honour the opt-out.

We will normally respond within one month, subject to any lawful extension.

10. Activity scores and automated analysis

EyeSpy may display an “activity score” or similar summary based on observable events, such as:

• changes in following count;
• detected follows or unfollows;
• public profile changes;
• posts, reels or tags; and
• the frequency of detected changes.

An activity score:

• is not a measure of character, honesty or relationship status;
• does not establish cheating or misconduct;
• may be affected by incomplete or delayed public information;
• is provided as a convenience and entertainment-oriented summary; and
• is not used by EyeSpy to make decisions producing legal or similarly significant effects about an individual.

We do not intentionally infer health, sexual orientation, ethnicity, religion or other special-category information from public-profile activity.

11. Who we share information with

We may share information with the following categories of recipient.

Hosting and database providers

Providers that host the EyeSpy application, databases, backups and server infrastructure.

Current provider: Supabase

Public-data providers

Providers that resolve usernames and supply publicly available profile information.

Current provider: RocketAPI

Search usernames and public platform identifiers may be sent to these providers.

Authentication providers

Apple, Google or other providers used to authenticate users.

Subscription infrastructure

Apple and, if used, subscription-management providers such as:

RevenueCat

Analytics and crash-reporting providers

Posthog

We configure these services to minimise the personal information collected where reasonably possible.

Notification providers

Apple Push Notification service

Professional advisers

Lawyers, accountants, insurers, auditors and security advisers where reasonably necessary.

Authorities and legal recipients

Regulators, courts, law-enforcement agencies and other recipients where disclosure is legally required or reasonably necessary to protect legal rights.

Corporate transactions

A potential buyer, investor or successor if EyeSpy is involved in a merger, financing, restructuring or sale. Appropriate confidentiality and data-protection safeguards will apply.

We do not sell personal information.

We do not share personal information for cross-context behavioural advertising unless we first update this Privacy Policy and provide any legally required choice.

12. International transfers

Some service providers may process information outside the United Kingdom.

Where UK data-protection transfer rules apply, we use an appropriate safeguard, which may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another legally permitted transfer mechanism.

You may request further information about applicable transfer safeguards by contacting lucafrost123@gmail.com.

13. How long we keep information

Our intended production retention periods are:

We may retain information longer where necessary to:

• comply with law;
• resolve disputes;
• enforce agreements;
• prevent fraud or abuse; or
• establish or defend legal claims.

We may retain anonymised or aggregated information that no longer identifies an individual.

14. Security

We use technical and organisational safeguards designed to protect personal information, including where appropriate:

• encryption in transit;
• encryption at rest;
• access controls;
• separation of production and development environments;
• secrets-management systems;
• logging and monitoring;
• restricted administrative access;
• backup controls;
• vulnerability management;
• incident-response procedures; and
• service-provider reviews.

No service is completely secure. You are responsible for maintaining the security of your EyeSpy login and device.

EyeSpy’s public-tracking service does not require or store Instagram passwords or session cookies.

15. Your data-protection rights

Depending on where you live and the circumstances, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• object to direct marketing; and
• complain to a data-protection authority.

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise a right, contact lucafrost123@gmail.com.

We may request information needed to verify your identity or authority.

United Kingdom complaints

You may complain to the UK Information Commissioner’s Office. We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the regulator.

EEA complaints

If you are in the European Economic Area, you may also complain to the supervisory authority in the country where you live, work or believe an infringement occurred.

United States state rights

Where applicable, residents of certain US states may have rights to:

• confirm whether we process their information;
• access, correct or delete information;
• obtain a portable copy;
• opt out of sale, targeted advertising or certain profiling; and
• appeal a refusal of a privacy request.

EyeSpy does not currently sell personal information or use it for cross-context behavioural advertising.

16. Children and younger users

EyeSpy is intended only for users aged 16 or over.

We do not knowingly allow children under 16 to create an account. If we learn that a user is under 16, we may close the account and delete associated information.

Because 16- and 17-year-olds may use EyeSpy, we apply privacy-protective defaults, including:

• no behavioural advertising based on watchlist activity;
• no public display of a user’s watchlist;
• minimisation of onboarding information;
• clear explanations of tracking limitations;
• controls to report misuse; and
• restrictions on harassment, intimidation and abusive monitoring.

If you believe a child’s information has been processed inappropriately, contact lucafrost123@gmail.com.

17. Misuse, harassment and safety

EyeSpy is intended to organise publicly available profile changes. It must not be used to:

• threaten, intimidate or harass another person;
• facilitate stalking or coercive control;
• publish or expose someone’s private information;
• discriminate against someone;
• make employment, housing, insurance, credit or similar consequential decisions;
• target or exploit a child;
• bypass a private account’s access controls; or
• falsely accuse someone of cheating, criminality or other misconduct.

We may suspend users, remove profiles from tracking or cooperate with lawful investigations where the Service is misused.

18. Website cookies and similar technologies

Our website may use:

Essential technologies

These are required for security, account access, load balancing and core functionality.

Optional analytics technologies

These help us understand website use and improve performance.

Where legally required, optional cookies or similar technologies will not be enabled until you consent.

Our current website providers are:

• No non-essential website cookies or analytics providers are currently enabled
• You can change your choices through not applicable while optional website analytics remain disabled.

19. Third-party links and services

EyeSpy may link to Instagram, Apple, Google or other third-party services.

Their privacy practices are governed by their own policies. We are not responsible for the privacy or security practices of independent third parties.

20. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to the Service;
• new providers or features;
• legal or regulatory developments;
• security improvements; or
• changes to how information is processed.

If a change materially affects your rights or how we use personal information, we will provide reasonable notice through the app, website or email where appropriate.

The date at the top shows when the policy was last updated.

21. Contact us

For privacy questions, opt-outs or data-rights requests:

• LUCA FROST
• Email: support@geteyespy.com
• Opt-out: https://geteyespy.com/privacy/opt-out