Privacy Policy

1. Who we are

EyeSpy is a trading name of LUCA FROST, a sole trader established in the United Kingdom.

In this Privacy Policy, “EyeSpy”, “we”, “us” and “our” refer to LUCA FROST trading as EyeSpy.

Data controller: LUCA FROST, trading as EyeSpy

Privacy email: support@geteyespy.com

Support email: support@geteyespy.com

Website: geteyespy.com

LUCA FROST is the controller responsible for the personal information described in this Privacy Policy.

2. What this Privacy Policy covers

This Privacy Policy explains how we collect, use, store and share personal information when you:

• use the EyeSpy mobile application;
• create an EyeSpy account;
• search for or monitor a supported social-media profile;
• optionally connect Instagram for a private profile you already follow or for insights about your own Instagram account;
• purchase or manage an EyeSpy subscription;
• use the EyeSpy website;
• contact our support team; or
• are the owner of a public profile monitored through EyeSpy.

EyeSpy is an independent service. It is not sponsored, endorsed, administered by or affiliated with Instagram or Meta Platforms, Inc.

3. Plain-language summary

EyeSpy supports public profiles and private profiles that the connected Instagram account is already approved to follow.

Connecting Instagram is optional and is required only for followed private profiles and insights about the user’s own account. EyeSpy cannot bypass private-profile restrictions or access profiles that the connected account cannot already view.

Instagram credentials and two-factor-authentication codes are entered directly into an Instagram-owned login page. EyeSpy does not read or collect them. The resulting Instagram session is stored locally in the iOS Keychain on that device and is not sent to EyeSpy’s backend, analytics providers or logs.

Private relationship snapshots and own-account analytics remain stored locally on the device. Disconnecting Instagram or deleting the EyeSpy account removes the locally stored Instagram connection and private-tracking data.

Connected access is read-only. EyeSpy does not follow, unfollow, like, comment, post or send messages.

Depending on the available data and the user’s subscription, EyeSpy may detect changes such as:

• new follows and unfollows;
• follower and following-count changes;
• profile-photo or biography changes;
• new visible tagged posts;
• new visible posts or reels;
• changes between public and private status; and
• a summary of recent visible activity.

Checks are periodic and not real-time. EyeSpy cannot show follow activity from before tracking began, and results may be delayed, incomplete or unavailable. Changes are detected by comparing information collected at different times, so the detection time may not be the exact time the underlying event occurred.

4. Information we collect from EyeSpy users

4.1 Account information

When you create an EyeSpy account, we may collect:

• your name or account display name;
• your email address;
• your EyeSpy user ID;
• your chosen authentication method;
• authentication identifiers provided by Apple, Google or another sign-in provider;
• account creation and last-login dates; and
• account status and settings.

We do not receive your Apple ID or Google account password.

4.2 Search and watchlist information

When you search for or add a profile, we may collect:

• the username you searched;
• the platform user ID associated with the profile;
• profiles added to your watchlist;
• the date tracking began;
• notification preferences;
• account-swap or watchlist activity;
• tracking status;
• the plan capacity used by each profile; and
• the types of changes you choose to monitor.

Searches and watchlists may reveal something about your interests or relationships. We treat this information as private EyeSpy account data and do not show other users who you are monitoring.

4.3 Instagram connection and device-only information

Connecting Instagram is optional. It is required only to check followed private profiles and to provide insights about your own Instagram account.

Your username, password and two-factor-authentication codes are entered directly into an Instagram-owned login page. EyeSpy does not read or collect them.

The resulting Instagram session, including any session cookies and related tokens, is stored locally in the iOS Keychain on the device where you connected. It is not sent to EyeSpy’s backend, analytics providers or logs.

Private relationship snapshots and own-account analytics are processed and stored locally on that device. They are not stored on EyeSpy’s backend. Disconnecting Instagram or deleting your EyeSpy account removes the locally stored Instagram session and private-tracking data from that device.

EyeSpy may receive limited, sanitized operational diagnostics about a connected check as described in section 4.5. Those diagnostics do not include the Instagram session or private relationship members.

4.4 Subscription and purchase information

If you subscribe through Apple, we may receive:

• the subscription product selected;
• subscription status;
• purchase and renewal dates;
• transaction and original transaction identifiers;
• country or storefront;
• whether a purchase was restored, cancelled, refunded or expired; and
• limited receipt or entitlement information needed to provide access.

Apple processes your payment method. EyeSpy does not receive your complete card or bank details.

4.5 Device and technical information

We may collect:

• device type and operating-system version;
• app version;
• language and region;
• time zone;
• IP address;
• device or installation identifiers;
• crash reports;
• diagnostic logs;
• security events;
• request timestamps;
• notification token;
• performance information; and
• interactions with app screens and features.

Sanitized operational diagnostics

For reliability, security and support, the app may send sanitized diagnostics such as the app and operating-system version, the type and stage of a check, status and timing information, safe error codes, aggregate page or list counts, entitlement or App Attest results, and pseudonymous run, installation or target references.

Sanitized diagnostics must never contain usernames, passwords, two-factor-authentication codes, cookies, Instagram sessions, CSRF tokens, request headers, raw errors or relationship-member identifiers.

We do not use this information to obtain your precise location unless a future feature explicitly requests permission and this Privacy Policy is updated first.

4.6 Communications and support information

When you contact us, we may collect:

• your contact details;
• the content of your request;
• screenshots or files you voluntarily provide;
• support history; and
• information needed to investigate a problem.

Support screenshots submitted through the website are encrypted by EyeSpy before they are uploaded to a private Railway storage bucket. Access requires authorised production credentials. EyeSpy runs a daily deletion job for screenshots more than 24 months old.

Do not send us Instagram passwords, two-factor-authentication codes, session cookies or other account-access credentials.

4.7 Onboarding responses

EyeSpy may ask questions about why you are interested in the Service, such as whether you want to monitor a partner, ex, crush or friend.

We may use those responses to:

• personalise onboarding copy;
• display relevant feature examples;
• recommend settings;
• understand general product demand; and
• improve the Service.

We do not use onboarding responses to determine whether someone is cheating, dishonest or engaged in wrongdoing.

Where possible, we store broad response categories rather than detailed relationship information.

5. Information about monitored profiles

EyeSpy also processes information relating to people who may not have an EyeSpy account.

Public-profile data stored on EyeSpy’s backend

For a monitored public profile, we may process:

• username and stable platform user ID;
• display name;
• public profile image;
• public biography;
• public account-verification status;
• follower and following counts;
• public or private status;
• publicly visible follower or following relationships where supported;
• publicly visible posts, reels and tagged content;
• public profile links;
• the dates on which EyeSpy checked the profile;
• changes detected between checks; and
• generated event records such as “followed”, “unfollowed”, “bio changed” or “profile became private”.

We may cache limited profile images or public-content thumbnails to display the Service efficiently.

Public-profile usernames, platform user IDs, profile metadata, public relationship snapshots, check dates and detected events may be stored in EyeSpy’s Supabase Postgres database and processed by EyeSpy’s Railway-hosted backend. The retention periods in section 13 apply.

We do not intentionally collect:

• private messages;
• precise location;
• passwords;
• private posts not visible to the relevant data source;
• payment information belonging to monitored individuals; or
• content obtained by bypassing a profile’s privacy settings.

Followed private profiles and own-account insights stay on the device

Information from a followed private profile and insights about the connected user’s own account are processed only on the device. This includes private relationship snapshots, detected private-profile changes and own-account analytics. EyeSpy’s backend does not store those snapshots or analytics.

The connected account must already be approved to follow the private profile. EyeSpy cannot bypass a private profile’s controls or view anything the connected account cannot already access.

Public information is still treated as personal information

We treat identifiable public-profile information as personal information where data-protection law applies.

We limit the information collected to what is reasonably needed to provide change monitoring, apply retention limits and provide a removal and objection process for monitored individuals.

6. Where information comes from

We obtain information from:

• you;
• Apple, Google or another authentication provider;
• Apple’s App Store and in-app purchase infrastructure;
• your device and the EyeSpy application;
• publicly available social-media pages and information;
• public-data providers such as RocketAPI and HikerAPI;
• Instagram-owned pages used for the optional connection, which communicate directly with your device;
• analytics, infrastructure and security providers;
• support communications; and
• other users who search for or monitor a public profile.

We do not claim that Instagram or Meta supplies or approves the data used by EyeSpy.

7. How and why we use personal information

Providing the EyeSpy Service

We use account, watchlist, tracked-profile and technical information to:

• create and manage your account;
• resolve supported usernames;
• capture an initial tracking baseline;
• perform scheduled checks;
• compare profile information between checks;
• generate follow, unfollow, tag and profile-change events;
• display your EyeSpy feed;
• send requested notifications;
• enforce plan limits; and
• restore subscription access.

Lawful basis: performance of our contract with you.

For information relating to monitored public profiles stored on our backend, our intended lawful basis is our legitimate interest in providing users with a public-information monitoring service, subject to a balancing assessment, data minimisation, safety controls and the right to object. Device-only processing for followed private profiles and own-account insights is used to perform our contract with the connected user and is limited to information that user is already authorised to view.

Processing purchases and subscriptions

We use transaction and entitlement information to:

• activate paid features;
• check subscription status;
• restore purchases;
• manage plan capacity;
• investigate purchase errors; and
• maintain required financial records.

Lawful basis: performance of our contract and compliance with legal obligations.

Security, fraud prevention and service integrity

We use technical, account and usage information to:

• prevent account abuse;
• detect fraudulent purchases;
• investigate suspicious activity;
• secure user accounts;
• prevent excessive automated searches;
• identify false or incomplete profile snapshots;
• avoid sending inaccurate mass-change alerts; and
• protect our systems and users.

Lawful basis: our legitimate interests in operating a safe and reliable service and, where applicable, compliance with legal obligations.

Service analytics and improvement

We may use app-event, diagnostic and aggregated usage information to:

• understand which features are used;
• measure onboarding and paywall performance;
• fix crashes and bugs;
• improve reliability;
• evaluate plan capacity and provider costs; and
• develop new features.

Where required, we ask for consent before using non-essential analytics or device-level tracking.

We do not sell your watchlist or use the identity of the profiles you monitor to target third-party advertising at you.

Lawful basis: legitimate interests or consent, depending on the technology and applicable law.

Customer communications

We use your contact details to send:

• service and security notices;
• purchase or account information;
• requested support replies;
• tracking-status messages; and
• important changes to the Service or policies.

We send promotional marketing only where permitted and provide an unsubscribe method.

Lawful basis: performance of our contract, legitimate interests or consent, as applicable.

Legal obligations and claims

We may use or disclose information to:

• comply with law, court orders or lawful regulatory requests;
• respond to data-protection requests;
• establish, exercise or defend legal claims;
• maintain accounting and tax records; and
• investigate misuse of the Service.

Lawful basis: legal obligation or legitimate interests.

8. Our legitimate interests in public-profile monitoring

Where we rely on legitimate interests for monitored-profile information, the interests we pursue include:

• allowing users to organise and monitor changes to publicly available profiles;
• providing notifications instead of requiring repetitive manual checks;
• maintaining reliable historical comparisons from the date tracking begins; and
• protecting and improving the Service.

Before launch, we assess:

• whether the processing is necessary;
• whether a less intrusive method is available;
• what monitored individuals are likely to expect;
• the possible effect on monitored individuals;
• whether children or vulnerable people may be affected;
• the type and quantity of data retained;
• safeguards such as limiting backend profile collection to public information, keeping followed-private-profile relationships on the device, short raw-data retention and opt-out; and
• whether our interests are overridden by the rights and freedoms of the monitored individual.

9. Your right to object to public-profile monitoring

You have the right to object to our processing of your personal information where we rely on legitimate interests.

If a profile belongs to you and you do not want it monitored through EyeSpy, contact support@geteyespy.com or use https://geteyespy.com/privacy/opt-out.

We may ask for reasonable information to verify that you control the profile.

Where we accept a request, we may:

• stop future tracking;
• remove the profile from active watchlists;
• delete associated event history where required;
• prevent the profile from being re-added; and
• retain a minimal suppression record, such as a platform user ID, solely to honour the opt-out.

We will normally respond within one month, subject to any lawful extension.

10. Activity scores and automated analysis

EyeSpy may display an “activity score” or similar summary based on observable events, such as:

• changes in following count;
• detected follows or unfollows;
• visible profile changes;
• posts, reels or tags; and
• the frequency of detected changes.

An activity score:

• is not a measure of character, honesty or relationship status;
• does not establish cheating or misconduct;
• may be affected by incomplete or delayed information;
• is provided as a convenience and entertainment-oriented summary; and
• is not used by EyeSpy to make decisions producing legal or similarly significant effects about an individual.

We do not intentionally infer health, sexual orientation, ethnicity, religion or other special-category information from profile activity.

11. Who we share information with

We may share information with the following categories of recipient.

Hosting and database providers

Providers that host the EyeSpy application, databases, backups and server infrastructure.

Current providers: Supabase and Railway

Supabase provides authentication and the Postgres database used for EyeSpy accounts, public-profile data, watchlists, entitlements and operational records. Railway hosts EyeSpy’s backend and website infrastructure. Neither receives Instagram credentials, the device-only Instagram session, private relationship snapshots or own-account analytics.

Public-data providers

Providers that resolve usernames and supply publicly available profile information.

Current providers: RocketAPI and HikerAPI

Search usernames and public platform identifiers may be sent to these providers.

They do not receive Instagram credentials or the device-only Instagram session.

Authentication providers

Apple, Google and Supabase are used to authenticate EyeSpy users. This authentication is separate from the optional Instagram connection.

Subscription infrastructure

Apple’s StoreKit and App Store infrastructure process purchases and billing. RevenueCat manages subscription entitlement and purchase-event information used to unlock EyeSpy features.

Analytics and crash-reporting providers

Current provider: PostHog

Where consent or another lawful basis is required, PostHog receives allowlisted product analytics configured to minimise personal information. It does not receive Instagram credentials, the device-only Instagram session or private relationship members.

Email delivery providers

Current provider: Resend

Where EyeSpy sends transactional email, Resend may process the recipient email address and message-delivery details. It does not receive Instagram credentials or the device-only Instagram session.

Notification providers

Apple Push Notification service (APNs) processes device push tokens and notification-delivery information needed to send alerts. Notification content is minimised where reasonably possible.

Security and integrity providers

Apple App Attest provides app-integrity proof used to protect eligible EyeSpy requests. It does not receive Instagram credentials or the device-only Instagram session from EyeSpy.

Professional advisers

Lawyers, accountants, insurers, auditors and security advisers where reasonably necessary.

Authorities and legal recipients

Regulators, courts, law-enforcement agencies and other recipients where disclosure is legally required or reasonably necessary to protect legal rights.

Corporate transactions

A potential buyer, investor or successor if EyeSpy is involved in a merger, financing, restructuring or sale. Appropriate confidentiality and data-protection safeguards will apply.

No third party receives Instagram credentials, two-factor-authentication codes or the device-only Instagram session from EyeSpy. Public-data providers may separately receive search usernames and public platform identifiers as described above.

We do not sell personal information.

We do not share personal information for cross-context behavioural advertising unless we first update this Privacy Policy and provide any legally required choice.

12. International transfers

Some service providers may process information outside the United Kingdom.

Where UK data-protection transfer rules apply, we use an appropriate safeguard, which may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another legally permitted transfer mechanism.

You may request further information about applicable transfer safeguards by contacting support@geteyespy.com.

13. How long we keep information

Our intended production retention periods are:

We may retain information longer where necessary to:

• comply with law;
• resolve disputes;
• enforce agreements;
• prevent fraud or abuse; or
• establish or defend legal claims.

We may retain anonymised or aggregated information that no longer identifies an individual.

14. Security

We use technical and organisational safeguards designed to protect personal information, including where appropriate:

• encryption in transit;
• encryption at rest;
• access controls;
• separation of production and development environments;
• secrets-management systems;
• logging and monitoring;
• restricted administrative access;
• backup controls;
• vulnerability management;
• incident-response procedures; and
• service-provider reviews.

No service is completely secure. You are responsible for maintaining the security of your EyeSpy login, Instagram account and device.

Instagram credentials and two-factor-authentication codes are entered on an Instagram-owned page and are not read or collected by EyeSpy. The resulting session is protected in the iOS Keychain on that device and is removed, together with device-only private-tracking data, when you disconnect Instagram or delete the EyeSpy account.

15. Your data-protection rights

Depending on where you live and the circumstances, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• object to direct marketing; and
• complain to a data-protection authority.

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise a right, contact support@geteyespy.com.

We may request information needed to verify your identity or authority.

United Kingdom complaints

You may complain to the UK Information Commissioner’s Office. We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the regulator.

EEA complaints

If you are in the European Economic Area, you may also complain to the supervisory authority in the country where you live, work or believe an infringement occurred.

United States state rights

Where applicable, residents of certain US states may have rights to:

• confirm whether we process their information;
• access, correct or delete information;
• obtain a portable copy;
• opt out of sale, targeted advertising or certain profiling; and
• appeal a refusal of a privacy request.

EyeSpy does not currently sell personal information or use it for cross-context behavioural advertising.

16. Children and younger users

EyeSpy is intended for users aged 13 and over.

If applicable local law requires a parent or guardian to consent to a user’s use of EyeSpy or the processing of that user’s personal information, that consent must be obtained before the user creates or uses an account. We do not knowingly allow children under 13 to create an account. If we learn that a user is under 13, or is using EyeSpy without consent required by applicable local law, we may close the account and delete associated information.

Because users aged 13 to 17 may use EyeSpy, we apply privacy-protective defaults, including:

• no behavioural advertising based on watchlist activity;
• no public display of a user’s watchlist;
• minimisation of onboarding information;
• clear explanations of tracking limitations;
• controls to report misuse; and
• restrictions on harassment, intimidation and abusive monitoring.

If you believe a child’s information has been processed inappropriately, contact support@geteyespy.com.

17. Misuse, harassment and safety

EyeSpy is intended to organise profile changes that a user is legally authorised to view. It must not be used to:

• threaten, intimidate or harass another person;
• facilitate stalking or coercive control;
• publish or expose someone’s private information;
• discriminate against someone;
• make employment, housing, insurance, credit or similar consequential decisions;
• target or exploit a child;
• bypass a private account’s access controls, gain unauthorised access or monitor information the user is not legally authorised to view; or
• falsely accuse someone of cheating, criminality or other misconduct.

We may suspend users, remove profiles from tracking or cooperate with lawful investigations where the Service is misused.

18. Website cookies and similar technologies

Our website may use:

Essential technologies

These are required for security, account access, load balancing and core functionality.

Optional analytics technologies

These help us understand website use and improve performance.

Where legally required, optional cookies or similar technologies will not be enabled until you consent.

Our current website providers are:

• No non-essential website cookies or analytics providers are currently enabled
• You can change your choices through not applicable while optional website analytics remain disabled.

19. Third-party links and services

EyeSpy may link to Instagram, Apple, Google or other third-party services.

Their privacy practices are governed by their own policies. We are not responsible for the privacy or security practices of independent third parties.

20. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to the Service;
• new providers or features;
• legal or regulatory developments;
• security improvements; or
• changes to how information is processed.

If a change materially affects your rights or how we use personal information, we will provide reasonable notice through the app, website or email where appropriate.

The date at the top shows when the policy was last updated.

21. Contact us

For privacy questions, opt-outs or data-rights requests:

• LUCA FROST
• Email: support@geteyespy.com
• Opt-out: https://geteyespy.com/privacy/opt-out