Privacy Policy

This policy explains what personal data iLS ("iLS", "we", "us") holds, why, who else handles it, how long we keep it, and what rights you have. It covers the website iglastseen.com, the iLS dashboard, and the people whose activity status iLS reads.

It is written to meet Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

Contact for anything in this policy: support@iglastseen.com.

The short version

• We never store your Instagram password, and we never read your messages.
• We keep what running iLS needs: your email, an encrypted Instagram session, the contacts you add and their activity readings, and your payment records.
• We don't sell your data, share it with advertisers, or use advertising or tracking cookies.
• If someone has added you to iLS, you can ask us to stop it and delete what we hold about you — see If someone has added you.

What we collect

Your iLS account

• Your email address and your iLS password. The iLS password is stored by our authentication provider as a one-way hash, never in readable form. (This is your password for iLS — not your Instagram password.)
• Your account role and when your account was created and last updated.
• Which version of the Terms you accepted, and when — recorded at sign-up and each time you accept a new version.
• The language you use iLS in (English, Turkish, Hindi, Spanish, Portuguese, German, French, Italian, Arabic, Hebrew, Urdu, Indonesian, Japanese, Polish or Korean), so the dashboard, your alerts and our emails reach you in it.
• Whether you finished or left the dashboard's setup guide, and when, so it isn't shown to you again on another device.
• Which steps of using iLS you've reached, and when: opening the setup guide (and whether you told it you can't see someone's activity status, or chose to explore on your own instead), opening the page to connect Instagram (and whether it said your country isn't supported yet), sending your login, being asked for and entering Instagram's verification code, a connection attempt failing, connecting Instagram, adding your first contact, being shown how to install the dashboard as an app, installing it, your first reading, the first reading that showed someone's activity status, turning on alerts, starting a checkout, paying, and finishing setup. Each is recorded once, the first time it happens. When a connection attempt fails we also keep the reason as a short error code (for example, that Instagram declined the sign-in or the code never arrived), replaced by the next failure's — never your password, the code, or anything Instagram showed you.

Your Instagram connection

• Your Instagram username.
• The signed-in session created when you connect, encrypted before it's stored. It lets iLS read activity status without signing in again. It is never shown back to you.
• The language, time zone and country that session is set to, and the proxy it uses (see Who else handles your data). We record the internet address of the proxy exit iLS used for you — this is our proxy's address, not yours.
• Your Instagram password is never stored. It goes to the automated browser that signs you in, is used once, and is not written to disk or to our database.

The contacts you add

• The Instagram username of each person you add, and a link to your conversation with them.
• Every reading iLS makes: the time, and what Instagram showed ("Active now", "Active 25m ago", nothing shown, or that the read failed).
• Your tracking settings, such as whether alerts are on for that contact.

iLS reads only the activity status line. It never reads, stores or analyses message contents, photos, followers or anything else in the conversation.

Notifications

If you turn on browser alerts: the push subscription your browser creates (a delivery address and encryption keys), the browser type, and a history of the alerts sent to you.

Payments

Your Stripe customer reference, your plan and its status, the extra contacts you've bought, and a record of each payment (amount, currency, date, what it was for). Card details are entered on Stripe's page and never reach us.

Technical, security and error data

• Event logs of what happens in your account (for example, a connection, a failed read, a payment), with passwords, codes and keys removed. In these logs the contact's username is replaced by an irreversible fingerprint.
• Error reports when something breaks in the website, the dashboard or our servers, with secrets removed. These can include your user ID and details of your browser and device.
• Your approximate country, worked out from your connection by our CDN, to choose your price currency and the country of your proxy. We keep the country you last signed in from on your account — the country only, never your IP address.

We don't store your own IP address in our database. Our hosting, CDN and authentication providers process it to deliver the service, as any website's providers do.

Website visits

The public website uses Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

The website and the dashboard also use Umami, an analytics tool we run on our own servers, so what it records stays with us and isn't shared with an analytics company. It records the pages you view; on the website, clicks through to the dashboard, the FAQ and install-guide answers you open, your use of the product demo, which sections of a page came into view, the language you choose and the platform you pick on the install guide; and in the dashboard, that an account was created or you signed in, the kind of error a sign-in or sign-up form showed (an error code, never what you typed), that a password reset was requested or completed, how far you got through the setup guide (which of its screens you saw, whether you said you could see someone's activity status, the screen you left it from, and that you finished it), the steps of connecting Instagram and how it ended (with an error code if it failed), contacts being added, paused, resumed or removed, a contact's alerts being switched and "Check again" being pressed, a checkout being started or abandoned and a purchase going through, with the plan and its price, the billing portal being opened, alerts being turned on, off, muted or tested and what your browser answered, offers to install the app being shown and accepted or dismissed, and a change of language — never who you are, and never a username or anything else you type. Each record holds the page's address and language, the site that sent you, your browser, operating system, device type, screen size and approximate location (country, region and city). To count visitors without a cookie, Umami works out a visitor ID from your IP address and browser that changes every month; it doesn't store your IP address, and the ID isn't linked to your account. In the dashboard, everything in a page's address except campaign tags is removed before anything is recorded.

We also count a few steps on the way to signing up: a visit starting on the website, a click through to the dashboard, the sign-up page being opened, and the sign-up form being sent. Each count holds the step, the page it happened on, the page's language, the campaign you came from (see below) and your country as our CDN reports it. It holds nothing that identifies you or tells one visitor from another: no IP address, no browser details, no identifier, and no link to the account you might go on to create. Your browser keeps a note in its tab storage of which steps it has already counted, so each is counted once per tab.

Where you came from

When you arrive from a link we or an advertiser tagged, your browser keeps that link's campaign tags (such as utm_source), any ad click id, and the name of the site that sent you, in its own tab storage — not a cookie. It's deleted when you close the tab. If you create an account in that tab, we store it with your account so we can tell which campaigns bring people who sign up. We never store the full address of the page that sent you.

The waitlist

Before launch, iLS had a waitlist. If you joined it, we hold your email address, your place in the list, the page and browser you signed up from, and whether we sent you the launch email.

When you write to us

Your email address and whatever you choose to tell us.

Why we use it, and on what legal basis

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

What we never do

• Sell personal data.
• Share it with advertisers or use it for advertising.
• Read, store or analyse the contents of your Instagram messages.
• Post, message, follow, like or change anything on your Instagram account.

Who else handles your data

We use these providers to run iLS. Each handles data only to provide its service to us.

Stripe also processes some payment data as an independent controller, under its own privacy policy.

We also disclose data to courts, prosecutors, police or other authorities when the law requires it or they lawfully order it, and we may use it to establish or defend legal claims.

Transfers outside Türkiye and the EU

Some of these providers are outside Türkiye, and some outside the European Economic Area. When your data is transferred, we rely on the transfer mechanisms the law provides: for GDPR, an adequacy decision or the EU standard contractual clauses; for KVKK, the safeguards set out in Article 9 of Law No. 6698.

Cookies

• iglastseen.com sets one cookie, NEXT_LOCALE, which remembers the language you chose. It's functional and holds nothing about you.
• The dashboard uses sign-in cookies from our authentication provider (Supabase) to keep you logged in. They're strictly necessary: without them you can't use your account. It also sets its own NEXT_LOCALE, which remembers the language you chose there. Once you've signed in, it also sets ils_known, which holds only the number 1 and remembers that this browser has an account, so our "Start tracking" links take you to sign in rather than sign up.
• No advertising, tracking or analytics cookies. Our analytics, on the website and in the dashboard, are cookieless.
• Tab storage, not cookies: the site and the dashboard keep where you came from, and which sign-up and setup-guide steps they've already counted, in your browser tab's own storage, deleted when the tab closes. The campaign you came from goes with each anonymous step count; the rest is sent to us only if you create an account.
• Notes in the dashboard's local storage: if you dismiss the offer to install the dashboard as an app, it remembers that for 14 days so it doesn't ask again; the installed app remembers that it has already offered to turn on alerts; and if you hide the setup reminder, it remembers which setup steps were still open, so the reminder comes back only when something new needs doing. These hold nothing about you. If you type the username of the person you want to track into the setup guide, it's kept here too, only to fill in the guide's later steps — it reaches us only if you then add that person as a contact. Everything else here stays on your device and is never sent to us.

Because every cookie we use is necessary for something you asked for, we don't show a cookie banner.

How long we keep it

We don't delete data on a fixed timer yet. Here is exactly what happens today:

• Account data, contacts and readings are kept while your account exists. You can ask us to delete them, or your whole account, by writing to support@iglastseen.com; we handle the request within 30 days.
• Your Instagram session is deleted the moment you disconnect Instagram.
• Stopping a contact stops new readings. Earlier readings stay on your account until you ask us to delete them.
• Payment records are kept for as long as tax and commercial law require, even after your account is deleted.
• Logs and error reports are kept to keep iLS secure and working, and are deleted with your account where they identify you.
• Waitlist entries are kept until you ask us to remove them.
• Anonymous sign-up step counts identify no one, so they are kept as statistics. The steps of using iLS you've reached are account data, kept while your account exists and deleted with it.

If we introduce automatic deletion periods, we'll update this section.

Your rights

Under KVKK Article 11 you have the right to:

• learn whether we process your personal data, and request information about it;
• learn why it's processed and whether it's used for that purpose;
• know who, in Türkiye or abroad, it's transferred to;
• ask for incomplete or inaccurate data to be corrected;
• ask for it to be deleted or destroyed, under the conditions in Article 7;
• ask that a correction or deletion be passed on to those it was transferred to;
• object to a result against you that arises solely from automated analysis;
• claim compensation if unlawful processing causes you harm.

Under GDPR Articles 15–22 you have the right to access, rectification, erasure, restriction, data portability, to object — including to processing based on our legitimate interests — and not to be subject to solely automated decisions. Where we rely on your consent, you can withdraw it at any time.

How to use them

Email support@iglastseen.com from the email address on your account (or, if you don't have an account, tell us which data your request is about). We may ask you to confirm your identity. We handle every request, including deletion, free of charge and within 30 days (KVKK Article 13; for GDPR, one month). There is no self-service deletion in the dashboard yet, so email is the way to ask.

If you're not satisfied, you can complain to the Personal Data Protection Authority (KVKK Kurumu) in Türkiye, or to the data protection authority in the EU country where you live or work.

If someone has added you

If you're reading this because someone may be using iLS to see when you're online, this section is for you.

What we hold. If an iLS user added your Instagram username, we hold that username, a link to their conversation with you, and each reading iLS made: the time and what Instagram showed about your activity status. We never access your account, and we never read your messages.

Why. We process this because the user asked us to, as part of the service. We rely on legitimate interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)). We know you didn't choose this, so we honour an objection from you without asking you to justify it.

What you can ask for. You have all the rights above. In practice, you can ask us to:

• tell you whether your username is being read through iLS;
• stop it;
• delete every reading about you.

Write to support@iglastseen.com with the subject "Abuse report" or "Data request". We handle it within 30 days. To make sure the request comes from you, we may ask you to show that you control the Instagram account — for example by adding a short code to your bio for a few minutes. We don't tell you who the user is unless the law requires us to or a court or prosecutor orders it.

Stopping it yourself. Turning off your activity status on Instagram, or blocking the person, stops iLS from reading it.

Our Acceptable Use Policy forbids users to keep reading anyone who has asked them to stop, blocked them or cut contact with them, and explains how we act on reports.

Children

iLS is only for people aged 18 and over. If we learn that an account belongs to someone under 18, we close it and delete its data.

A user may only add someone under 18 if it's their own child or a child in their legal care. If you're a parent and think your child has been added by someone else, contact us as described above.

Security

• Your Instagram session is encrypted before it's stored, and your Instagram password is never stored.
• Everything travels over encrypted connections.
• Passwords, codes and keys are removed from our logs and error reports.
• Only the people who operate iLS can reach the data, and only to run and support the service.

No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the relevant authorities as the law requires.

Changes to this policy

We'll update this policy when what we do changes. If a change matters, we'll email account holders before it takes effect. The date at the top always shows the current version.