Privacy Policy — Recently Followed Browser Extension
This policy explains what the Recently Followed browser extension (the "Extension", "we", "us") accesses, stores and shares. It applies only to the Recently Followed browser extension. The Extension is operated by Oxynlabs for recently-followed.com; Oxynlabs runs its backend and billing.
In short: the Extension shows the accounts an Instagram profile followed most recently, newest first. For a public profile, our server looks this up for you, so the Extension never uses your Instagram session for it. For a private profile you already follow, the Extension reads its following list in your own browser, using your own Instagram session, and keeps it on your device. We never receive your Instagram password or cookies. We do keep records of how the Extension is used, including the usernames of the profiles you open it on, public or private; the sections below say exactly what, why and for how long.
Public profiles: looked up by our server
When you open the Extension on an Instagram profile, it sends that profile's username, together with your random device ID, to our API. If the profile is public, our server returns the accounts it followed most recently (username, display name, profile picture, verified/private flags) from publicly available Instagram data; if it is private, our server says so and the Extension uses the on-device tracking described below. Results for a username are cached on our server for a few hours and shared by everyone who looks that profile up, so the same lookup isn't repeated.
We also log every lookup: the username, your device ID, the result (for example found, private or not found), whether you're a subscriber, how long it took, and the IP address and country the request came from. We use these logs to keep a daily limit of lookups per device, prevent abuse, fix problems and improve the service. This means our records show which profiles were looked up from your device ID. We never notify the profile.
Private profiles: read on your device
For a private profile you follow, the Extension calls Instagram's own web API from your browser, authenticated by your existing Instagram session. It reads that profile's following list and keeps a snapshot on your device so later checks can spot new follows. The Extension can only see what your own Instagram account is allowed to see.
The following list never leaves your device. We never receive the accounts in it, or anything about them. What we do receive is the private profile's username, in the lookup above and in usage events: that you opened the Extension on it, that you started or stopped tracking it, and how each check (sync) went — whether it worked or why it failed, how many new follows it found (a number, not who), and how many requests to Instagram it took. See "Sent to our servers" below.
Stored on your device
- Following-list snapshots and the new-follow feed for the private profiles you track.
- The last results shown for recently opened public profiles, and which of those accounts you had already seen (to mark new ones).
- A randomly generated device ID, created when you install the Extension (it isn't derived from your name, email or Instagram account).
- Your unlock status and an access token for it; a checkout reference while you pay; your email only if you restore a purchase.
- Whether you have an open support conversation and unread replies in it.
- Your language choice.
This data stays in your browser. Uninstalling the Extension removes it.
Sent to our servers
- Username of a profile you open, with your device ID — to return a public profile's most recent follows. Each lookup is logged (see above).
- Usage events — installs, updates, popup opens, whether a list loaded or why it failed (coarse reason codes and counts), paywall and checkout steps, and the rate-us prompt. Events also include the Instagram username of the profile the event is about, for public and private profiles alike: which profile you opened the Extension on and which view it showed (live list, tracker or private-profile notice), when you start or stop tracking a profile, and the outcome of each sync (success or failure reason, how many new follows it found, how many requests it took). Each event carries your device ID, the Extension version and, once you have bought a plan, the email on your purchase; our server also records the IP address it sees, the country that address maps to, and your browser's user agent. Events never contain a private profile's following list or anything about the accounts in it.
- Your device ID — to create a checkout, check and grant your unlock, open the billing portal, and load the Extension's settings.
- Your email — only if you use "Restore purchase", to email you a secure link.
- Feedback — if you use the feedback form in the Extension, we store your rating (1–5), your message and, if you give it, your email, with your device ID. If you uninstall, Chrome opens a short, optional survey page (oxynlabs.com/recentlyfollowed/bye/); the reason you pick, what you write and any email you add are stored with your device ID. Feedback is stored with the Extension version and language, and the IP address, country and browser user agent our server sees.
- Support messages — if you use "Chat with us" in the Extension, we store what you write and, if you give it, your email, with your device ID, the Extension version and language, so our team can answer you. Replies appear in the Extension; if you left an email, we also email you when we reply.
We use this to run the Extension and process payments, prevent abuse (such as the daily lookup limit and rate limits), find and fix bugs, answer support requests, and improve the product. We do not sell it, use it for advertising, or share it except with the processors below.
Third-party services
- Stripe — payment processing. Stripe handles your card and billing email under Stripe's privacy policy. We never receive your full card number.
- Instagram data providers — our server reads public Instagram profiles through a third-party data API.
- Instagram / Meta — for private profiles you follow, the Extension uses your own Instagram session in your browser, under Instagram's terms.
Permissions and why
- instagram.com — to know which profile you're on, and to read the following list of private profiles you follow.
- Instagram image CDNs — to show profile pictures.
- Our API (unmask-api.oxynlabs.com) — profile lookups, purchase and unlock, usage events, feedback and support messages.
- Storage — the device-only data listed above.
- Alarms — to confirm your unlock after payment, re-check tracked profiles in the background, and check for replies to your support messages.
- Notifications — to tell you when your purchase unlocked and when our team replies to your message.
- Tabs / activeTab / scripting — to detect Instagram profile pages and open the checkout tab.
Retention and your choices
Device data stays until you uninstall the Extension or clear its storage. Public-profile results are kept on our server only as a short cache. Usage events and lookup logs are kept for up to 13 months, then deleted. Feedback and support conversations, including your answers on the uninstall survey, are kept until you ask us to delete them. Purchase records (device ID, email, transaction) are kept as needed to honor your access and meet legal and accounting duties.
Uninstalling removes the device ID from your browser, but what was already sent to us stays for the periods above. To ask for a copy of your data or for its deletion, email contact@oxynlabs.com; if you bought a plan or gave us an email with feedback or a support message, include it so we can find your records.
Children
The Extension is not directed to children under 13 and we do not knowingly collect their data.
Changes
We may update this policy; material changes get a new effective date on this page.
5 November 2026: first version of this policy for Recently Followed.