Privacy Policy

This policy explains what WhoIsMoth collects, why, how long it is kept and what you can do about it. WhoIsMoth is operated by the operator of WhoIsMoth. WhoIsMoth is an independent service and is not affiliated with, endorsed by, or operated by Instagram or Meta.

Review needed: this policy was drafted without legal advice. Depending on where you operate and who your users are (for example the EU/UK GDPR, California CCPA/CPRA, or other national laws), you may need a named controller, a legal basis for each purpose, a representative, and specific rights wording. Have it reviewed before launch.

What WhoIsMoth processes

WhoIsMoth does process personal data. Usernames and follower counts describe real people, even when they are publicly visible. Specifically:

• The username you analyze, normalized to lowercase.
• Observations you record: usernames you saw in recommendation lists, their order, any follower counts you typed, where you saw them and when. These come from you; WhoIsMoth does not collect them from Instagram.
• Computed results: scores, rankings and explanations derived from your observations.
• An anonymous browser identifier: a random value in a cookie that ties reports to your browser. We store only a keyed hash of it.
• Payment records: the Gumroad sale ID, product, amount, currency and refund status, plus the report the purchase unlocked. We do not receive or store card numbers.
• Rate-limit counters: short-lived, keyed hashes of your IP address used to prevent abuse. Raw IP addresses are not stored by WhoIsMoth, though our hosting provider may log them.
• Administrator accounts: the verified email address of the site administrator and their sign-in sessions.

WhoIsMoth never asks for, and you should never enter, an Instagram password, session cookie, access token, or private messages.

Why it is processed

• To produce the report you asked for and show it back to you.
• To verify payment with Gumroad and unlock the right report.
• To prevent abuse, through rate limits and security logs.

We do not sell data, run advertising trackers, or use your observations to build profiles across reports.

What WhoIsMoth can and cannot establish

Results describe which accounts recurred in the recommendation lists you recorded. They cannot establish whether anyone follows anyone, when a follow happened, or the nature of any relationship. Public information can still raise privacy concerns, so please use WhoIsMoth with care and in line with our Terms.

How long data is kept

• Reports, observations and results are deleted automatically 30 days after the report is created, or sooner if you delete the report.
• Payment records are kept for bookkeeping and tax purposes. When a report is deleted, the payment record loses its link to it.
• Records of incoming payment notifications are deleted after 90 days.
• Rate-limit counters are deleted within a day.

Deleting your data

You can delete a report at any time with “Delete report” on the report page. Because reports are tied to a browser rather than an account, we may not be able to identify your data from an email alone; include the report link when you write to the contact address on our Contact page. If you appear in someone else’s observations and want that data removed, contact us with the username concerned and we will delete matching report data we can find.

Third parties that process data

• Gumroad runs checkout and processes your payment under its own privacy policy.
• Resend (if configured) delivers sign-in emails to the administrator.
• Google Fonts serves the site’s typefaces, so your browser contacts Google’s servers when pages load.
• Our hosting provider runs the servers and may keep standard access logs.

Cookies

WhoIsMoth uses two strictly necessary cookies: the anonymous report cookie described above, and a sign-in cookie for administrators. There are no analytics or advertising cookies.

Security

Reports are readable only by the browser that created them; locked results are withheld by the server, not merely hidden on screen. No system is perfectly secure, and WhoIsMoth has not been independently audited.

Contact

Questions or requests: the contact address on our Contact page.