Privacy Policy

1. Data controller

The data controller for ByeBud is ByeBud (byebud.com). You can reach us for privacy questions via our Contact page.

If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection supervisory authority.

2. What ByeBud does

ByeBud is a web-based tool that helps you analyse your Instagram followers and unfollowers using Instagram's official data export feature. We do not request your Instagram password and we do not log in to your Instagram account on your behalf.

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18.

3. Information we collect and why

We process the following categories of information on the legal bases listed below.

3.1 Instagram export data you provide

When you upload your Instagram data export file (for example the JSON or ZIP you download from Instagram), we process it to calculate followers, unfollowers, and "not following back" lists.

How we handle it: Your Instagram export is processed 100% in your browser. It is never uploaded to our servers, never stored by us, and never leaves your device. We cannot access, recover, or delete the file because we never receive it.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR). You voluntarily provide the file to the browser-based tool to receive your unfollower results.

3.2 Usage analytics and cookieless baseline counting

We collect anonymised page-view data to understand how the Service is used. This is handled in two ways:

• When you accept analytics cookies: we may collect pages visited, session identifiers, approximate country or city via IP geolocation, and general device characteristics via analytics tools.
• When you reject analytics cookies or do not interact with the banner: we still collect a cookieless, anonymous "page view" count. We do not store a session identifier, do not store your IP address, and do not use cookies or device identifiers for this purpose. The result is an aggregated number of total page loads with no personal identifiers.

Legal basis: For consent-based analytics, consent (Article 6(1)(a) GDPR), which you can withdraw or update at any time via the cookie preference link in the footer. For the cookieless baseline count, our legitimate interest in measuring site usage without identifying individuals (Article 6(1)(f) GDPR).

3.3 Contact information (optional)

If you contact us through the contact form or email, we may collect your name, email address, and any details you choose to provide. We use this information only to respond to your message.

Legal basis: Our legitimate interest in communicating with users and, where applicable, performance of any contract resulting from your request (Article 6(1)(b) or (f) GDPR).

3.4 Payment data

Payments are processed by Stripe. We do not collect or store full payment card numbers. Stripe may provide us with transaction identifiers, payment status, and billing country so we can fulfil your purchase.

Legal basis: Performance of the contract with you (Article 6(1)(b) GDPR) and compliance with accounting and tax obligations (Article 6(1)(c) GDPR).

4. Who processes your data

ByeBud uses the following processors and service providers. Each only receives the data needed to provide its service:

• Supabase — cloud hosting, database, and authentication infrastructure.
• Stripe — payment processing and checkout sessions.
• Resend — transactional and contact-form email delivery.
• Cloudflare — security, CDN, and edge hosting.
• Endorsely — affiliate tracking (only when you click an affiliate link and consent to the relevant cookies).
• ipapi.co — approximate IP geolocation used only for analytics events.

We do not sell your personal data.

5. Data retention

• Instagram export data: Not retained at all, because it is processed in your browser and never reaches our servers.
• Consent-based analytics: Retained for 14 months from collection, then deleted or anonymised.
• Cookieless baseline page-view counts: Retained as aggregated statistics indefinitely. No personal identifiers are stored.
• Contact form submissions: Retained for 24 months from the date of submission, then deleted, unless a longer period is required for legal claims.
• Payment records: Retained for 7 years to comply with tax and accounting laws.

6. International transfers

Our Service is hosted by providers that may process data outside your country. By using ByeBud, you acknowledge that your data may be transferred to those locations, subject to appropriate safeguards such as Standard Contractual Clauses where required by law.

7. Your rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Data portability for data processed on the basis of contract or consent.
• Lodge a complaint with a data protection supervisory authority.

To exercise these rights, please use our Contact page. Because Instagram export data is processed locally in your browser and never sent to us, we cannot delete a file we never received.

8. Cookies and consent

We use a cookie consent banner to let you choose whether to accept analytics and affiliate cookies. You can change your preference at any time using the link in the footer. Essential cookies that are strictly necessary for the Service to function may be set without consent.

9. Security

We use reasonable technical and organisational measures to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Third-party links

ByeBud may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review their policies separately.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will show when the latest changes were made. Your continued use of the Service after changes become effective means you accept the updated Policy.

12. Contact us

For privacy questions or data requests, please use our Contact page.