Legal
Privacy Policy
Last updated
On this page
This policy explains what personal data iLS ("iLS", "we", "us") holds, why, who else handles it, how long we keep it, and what rights you have. It covers the website iglastseen.com, the iLS dashboard, and the people whose activity status iLS reads.
It is written to meet Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
Contact for anything in this policy: [email protected].
The short version
- We never store your Instagram password, and we never read your messages.
- We keep what running iLS needs: your email, an encrypted Instagram session, the contacts you add and their activity readings, and your payment records.
- We don't sell your data, share it with advertisers, or use advertising or tracking cookies.
- If someone has added you to iLS, you can ask us to stop it and delete what we hold about you — see If someone has added you.
What we collect
Your iLS account
- Your email address and your iLS password. The iLS password is stored by our authentication provider as a one-way hash, never in readable form. (This is your password for iLS — not your Instagram password.)
- Your account role and when your account was created and last updated.
- Which version of the Terms you accepted, and when — recorded at sign-up and each time you accept a new version.
Your Instagram connection
- Your Instagram username.
- The signed-in session created when you connect, encrypted before it's stored. It lets iLS read activity status without signing in again. It is never shown back to you.
- The language, time zone and country that session is set to, and the proxy it uses (see Who else handles your data). We record the internet address of the proxy exit iLS used for you — this is our proxy's address, not yours.
- Your Instagram password is never stored. It goes to the automated browser that signs you in, is used once, and is not written to disk or to our database.
The contacts you add
- The Instagram username of each person you add, and a link to your conversation with them.
- Every reading iLS makes: the time, and what Instagram showed ("Active now", "Active 25m ago", nothing shown, or that the read failed).
- Your tracking settings, such as whether alerts are on for that contact.
iLS reads only the activity status line. It never reads, stores or analyses message contents, photos, followers or anything else in the conversation.
Notifications
If you turn on browser alerts: the push subscription your browser creates (a delivery address and encryption keys), the browser type, and a history of the alerts sent to you.
Payments
Your Stripe customer reference, your plan and its status, the extra contacts you've bought, and a record of each payment (amount, currency, date, what it was for). Card details are entered on Stripe's page and never reach us.
Technical, security and error data
- Event logs of what happens in your account (for example, a connection, a failed read, a payment), with passwords, codes and keys removed. In these logs the contact's username is replaced by an irreversible fingerprint.
- Error reports when something breaks in the website, the dashboard or our servers, with secrets removed. These can include your user ID and details of your browser and device.
- Your approximate country, worked out from your connection by our CDN, to choose your price currency and the country of your proxy.
We don't store your own IP address in our database. Our hosting, CDN and authentication providers process it to deliver the service, as any website's providers do.
Website visits
The public website uses Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
The waitlist
Before launch, iLS had a waitlist. If you joined it, we hold your email address, your place in the list, the page and browser you signed up from, and whether we sent you the launch email.
When you write to us
Your email address and whatever you choose to tell us.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR / KVKK) |
|---|---|---|
| Creating and running your account | Account data | Performance of our contract with you — GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c) |
| Signing in to Instagram and reading activity status for you | Instagram connection, contacts, readings | Performance of our contract — GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c) |
| Sending the alerts you turned on | Push subscription, alert history | Performance of our contract — GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c) |
| Taking payment and keeping payment records | Payment data | Contract, and our legal obligations under tax and commercial law — GDPR Art. 6(1)(b), (c) / KVKK Art. 5(2)(c), (ç) |
| Keeping iLS secure, fixing faults, preventing misuse | Logs, error reports, proxy data | Our legitimate interest in a secure, working service — GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f) |
| Choosing your price currency and proxy country | Approximate country | Contract and legitimate interest — GDPR Art. 6(1)(b), (f) / KVKK Art. 5(2)(c), (f) |
| Counting website visits | Cookieless analytics | Legitimate interest — GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f) |
| Telling the waitlist that iLS launched | Waitlist data | You asked us to, when you signed up — GDPR Art. 6(1)(a) / KVKK Art. 5(1) |
| Handling abuse reports, disputes and legal claims | What's relevant to the matter | Legitimate interest and establishing or defending legal claims — GDPR Art. 6(1)(f) / KVKK Art. 5(2)(e), (f) |
| Readings about a person you've added | Their username and readings | See If someone has added you |
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
What we never do
- Sell personal data.
- Share it with advertisers or use it for advertising.
- Read, store or analyse the contents of your Instagram messages.
- Post, message, follow, like or change anything on your Instagram account.
Who else handles your data
We use these providers to run iLS. Each handles data only to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and account sign-in | EU (Frankfurt) |
| Decodo — a residential proxy provider | Routes iLS's Instagram traffic for your account through a consistent residential connection in your country, so your account isn't signed in from a data centre | Lithuania (EU), with exit points in your country |
| Stripe | Payments and billing portal | USA and EU |
| Resend | Account emails such as password reset | USA |
| Cloudflare | Content delivery, security and cookieless website analytics | Worldwide network |
| Sentry | Error reports, with secrets removed | USA |
| Browser push services — Google, Apple or Mozilla, depending on your browser | Delivering the alerts you turned on. The alert's content is encrypted so the push service can't read it | Depends on the service |
| Our server hosting provider | Runs the servers iLS operates on | — |
Stripe also processes some payment data as an independent controller, under its own privacy policy.
We also disclose data to courts, prosecutors, police or other authorities when the law requires it or they lawfully order it, and we may use it to establish or defend legal claims.
Transfers outside Türkiye and the EU
Some of these providers are outside Türkiye, and some outside the European Economic Area. When your data is transferred, we rely on the transfer mechanisms the law provides: for GDPR, an adequacy decision or the EU standard contractual clauses; for KVKK, the safeguards set out in Article 9 of Law No. 6698.
Cookies
- iglastseen.com sets one cookie,
NEXT_LOCALE, which remembers the language you chose. It's functional and holds nothing about you. - The dashboard uses sign-in cookies from our authentication provider (Supabase) to keep you logged in. They're strictly necessary: without them you can't use your account.
- No advertising, tracking or analytics cookies. Our website analytics are cookieless.
Because every cookie we use is necessary for something you asked for, we don't show a cookie banner.
How long we keep it
We don't delete data on a fixed timer yet. Here is exactly what happens today:
- Account data, contacts and readings are kept while your account exists. You can ask us to delete them, or your whole account, by writing to [email protected]; we handle the request within 30 days.
- Your Instagram session is deleted the moment you disconnect Instagram.
- Stopping a contact stops new readings. Earlier readings stay on your account until you ask us to delete them.
- Payment records are kept for as long as tax and commercial law require, even after your account is deleted.
- Logs and error reports are kept to keep iLS secure and working, and are deleted with your account where they identify you.
- Waitlist entries are kept until you ask us to remove them.
If we introduce automatic deletion periods, we'll update this section.
Your rights
Under KVKK Article 11 you have the right to:
- learn whether we process your personal data, and request information about it;
- learn why it's processed and whether it's used for that purpose;
- know who, in Türkiye or abroad, it's transferred to;
- ask for incomplete or inaccurate data to be corrected;
- ask for it to be deleted or destroyed, under the conditions in Article 7;
- ask that a correction or deletion be passed on to those it was transferred to;
- object to a result against you that arises solely from automated analysis;
- claim compensation if unlawful processing causes you harm.
Under GDPR Articles 15–22 you have the right to access, rectification, erasure, restriction, data portability, to object — including to processing based on our legitimate interests — and not to be subject to solely automated decisions. Where we rely on your consent, you can withdraw it at any time.
How to use them
Email [email protected] from the email address on your account (or, if you don't have an account, tell us which data your request is about). We may ask you to confirm your identity. We handle every request, including deletion, free of charge and within 30 days (KVKK Article 13; for GDPR, one month). There is no self-service deletion in the dashboard yet, so email is the way to ask.
If you're not satisfied, you can complain to the Personal Data Protection Authority (KVKK Kurumu) in Türkiye, or to the data protection authority in the EU country where you live or work.
If someone has added you
If you're reading this because someone may be using iLS to see when you're online, this section is for you.
What we hold. If an iLS user added your Instagram username, we hold that username, a link to their conversation with you, and each reading iLS made: the time and what Instagram showed about your activity status. We never access your account, and we never read your messages.
Why. We process this because the user asked us to, as part of the service. We rely on legitimate interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)). We know you didn't choose this, so we honour an objection from you without asking you to justify it.
What you can ask for. You have all the rights above. In practice, you can ask us to:
- tell you whether your username is being read through iLS;
- stop it;
- delete every reading about you.
Write to [email protected] with the subject "Abuse report" or "Data request". We handle it within 30 days. To make sure the request comes from you, we may ask you to show that you control the Instagram account — for example by adding a short code to your bio for a few minutes. We don't tell you who the user is unless the law requires us to or a court or prosecutor orders it.
Stopping it yourself. Turning off your activity status on Instagram, or blocking the person, stops iLS from reading it.
Our Acceptable Use Policy forbids users to keep reading anyone who has asked them to stop, blocked them or cut contact with them, and explains how we act on reports.
Children
iLS is only for people aged 18 and over. If we learn that an account belongs to someone under 18, we close it and delete its data.
A user may only add someone under 18 if it's their own child or a child in their legal care. If you're a parent and think your child has been added by someone else, contact us as described above.
Security
- Your Instagram session is encrypted before it's stored, and your Instagram password is never stored.
- Everything travels over encrypted connections.
- Passwords, codes and keys are removed from our logs and error reports.
- Only the people who operate iLS can reach the data, and only to run and support the service.
No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the relevant authorities as the law requires.
Changes to this policy
We'll update this policy when what we do changes. If a change matters, we'll email account holders before it takes effect. The date at the top always shows the current version.