Privacy Policy
Last updated November 11, 2026
The short version: your Instagram follower and following lists are processed and stored only in your browser. We never ask for your password, and we never read, store or send your Instagram session cookie. Our server keeps only what it needs to run credits and payments. We don’t sell data, show ads or use analytics.
This policy explains how the Mutuals Chrome extension and this website (together, “Mutuals”, “we”, “us”) handle information. If you have a question, email mutuals.support@gmail.com.
1. Data that stays on your device
When you scan, Mutuals runs inside the instagram.com tab you’re already signed into and loads your followers and following the same way Instagram does when you open those lists. It then stores the following only in your browser’s extension storage:
- Your followers and following lists: usernames, display names, verified status and small profile picture thumbnails.
- Your scan history, so the next scan can show who unfollowed you and other changes.
- Files you import from Instagram’s “Download your information” tool.
- Your settings, such as theme and accounts you’ve marked as reviewed.
This data is never sent to our servers or to anyone else. You can delete it at any time in Mutuals → Settings → Your data, or by removing the extension.
2. Data we never collect
- Your Instagram password. Mutuals never asks for it.
- Your Instagram session cookie or login tokens. The extension doesn’t read, store or transmit them.
- Your browsing history. Mutuals only has access to a tab after you click its icon, and it only acts on instagram.com.
- Your messages, posts or any content other than your follower and following lists.
3. Data on our server
To make credits work across reinstalls and to process payments, our server (hosted by Supabase) stores:
| Data | Why |
|---|---|
| A random anonymous account ID created when you install Mutuals. It isn’t linked to your name, email or Instagram account. | To keep track of your credit balance. |
| Your credit balance and history: welcome credits, scans (the number of credits used) and purchases. | To charge and show credits accurately. |
| A one-way SHA-256 hash of the Instagram username you scanned. We can’t turn it back into the username. | To give free welcome credits only once per Instagram account and prevent abuse. |
| Purchase records: the Stripe checkout ID, the pack you bought, the amount and currency, and the time. | To add credits you paid for, handle refunds and keep accounting records. |
4. Payments
Payments are processed by Stripe. When you buy credits you enter your card details and email on Stripe’s checkout page, not in Mutuals. We never see or store your full card number. Stripe handles that information under its own privacy policy and may use it to prevent fraud and send your receipt.
5. How we use and share data
We use the data above only to provide Mutuals: running scans, keeping your credit balance, processing payments and preventing abuse. We share data only with the providers that run the service (Supabase for our database and Stripe for payments), or when the law requires it. We don’t sell your data, use it for advertising, or use analytics or tracking tools.
6. Chrome Web Store Limited Use
Mutuals’ use of information follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only to provide the extension’s single purpose, which is showing you who follows you, who you follow and how that changes. It is never transferred for advertising, sold, used to determine creditworthiness, or read by humans except with your permission, for security, or to comply with the law.
7. How long we keep data
- On your device: until you delete it in Settings or remove the extension. Mutuals keeps up to 30 scans per Instagram account.
- On our server: credit and purchase records are kept while your account is active, and purchase records are kept as long as tax and accounting law requires.
8. Your choices and rights
You can delete all local data from Settings at any time. To ask for a copy of your server data, or to have it deleted, email mutuals.support@gmail.com. Depending on where you live (for example in the EU, UK or California), you may have additional rights to access, correct, delete or object to processing of your data. We’ll respond within 30 days. We don’t sell or “share” personal information as defined by California law.
9. Children
Mutuals isn’t meant for children under 13, which is also Instagram’s minimum age, and we don’t knowingly collect data from them.
10. Security
Server data is protected by row-level security, so each install can only read its own records. Connections are encrypted with HTTPS. No system is perfectly secure, but keeping your follower lists on your device means there’s very little on our side to expose.
11. Changes
If we change this policy, we’ll update the date at the top of this page. If a change materially affects how your data is handled, we’ll also say so in the extension.
12. Contact
Questions or requests: mutuals.support@gmail.com.
Mutuals is not affiliated with, endorsed by or sponsored by Instagram or Meta Platforms, Inc.