Last updated · October 7, 2026

Privacy Policy

The short version

Free viewing does not require an account or email address. Browsing still involves technical data: we record lookup metrics, use Google Analytics with cookies, and, when advertising is enabled, load third-party ads that may set their own cookies. Our hosting provider also keeps server logs — see below for the full picture. If you choose to subscribe to our optional Premium tier, we additionally store the account information described in the "Premium accounts" section.

Premium accounts

Premium is optional. If you subscribe, we store: your email address (used to sign you in and deliver notifications), an alternative alert-delivery email if you configure one, the list of public Instagram accounts you choose to track, and aggregate activity metadata about those public accounts (post/story counts and follower numbers, kept for 90 days). Sign-in uses a session cookie; we never store passwords because there are none. Payments are handled entirely by Stripe — we never see or store your card number. Transactional and alert emails are delivered through Resend. Cancel your subscription and stop tracking at any time from your account page; tracked-account data is removed when no subscriber tracks that account anymore.

What our servers log

Like every web host, Vercel (our infrastructure provider) records your IP address, user-agent, and the page you requested for each request. Retention depends on the hosting configuration. We use operational logs for debugging and abuse prevention.

Google Analytics

We use Google Analytics 4 to understand aggregate site traffic — which pages are popular, which countries visitors come from, and how the site performs. GA sets cookies and may collect technical information about your device and browser. You can restrict these requests using browser privacy controls or a tracker blocker. A Do Not Track setting alone does not guarantee that analytics requests will be blocked.

Advertising

When advertising is enabled, it helps support the free tier (active Premium subscribers see no ads while signed in). We may temporarily pause ads to evaluate the viewing experience. We work with third-party advertising partners — currently HilltopAds — to display ads on the site. These partners and their sub-vendors may use cookies, device identifiers, and similar technologies to serve, measure, and (where permitted) personalize the ads you see, and may collect information such as your IP address, approximate location, and browsing activity on this site. We do not sell your personal information for money. Use any available advertising preference controls and your browser's privacy settings to manage third-party requests.

What we track about Instagram lookups

We record the public username requested, content type, lookup outcome, locale, time, and interactions such as refreshing. Records may also include approximate location, browser/OS/device categories, language, referrer, bot classification, and a daily rotating hash derived from a truncated IP address for daily visitor counts. Our lookup metrics do not store the raw IP address or raw User-Agent, but these metrics should not be described as containing no visitor identifiers. We use them to understand usage, improve performance, and prevent abuse. Premium tracking additionally associates your selected public accounts with your subscriber email.

Instagram content

We fetch publicly available Instagram stories, posts, and profile data on your behalf via a third-party API provider. Images and videos may load directly from Instagram's content delivery network. Direct requests disclose your IP address and browser information to that network; omitting the Referer header does not hide your IP address. We use a server proxy as a fallback and for downloads. Profile data and proxied media may be cached temporarily. We do not use your Instagram login to register story views, but cannot promise that Instagram receives no network data.

Cookies

We use an essential anonymous cookie, ig_refresh, for up to 30 days to enforce free refresh limits. Daily usage counters and salted IP-derived abuse-prevention identifiers expire within two days. These identifiers are not used for advertising. Free refresh allowances reset at midnight UTC.

Google Analytics may set cookies (typically _ga and _ga_*). Our advertising partners (see Advertising above) may also set cookies or use similar technologies to measure and personalize ads. We use a small piece of browser local-storage to remember your dark-mode preference and your chosen language. We do not set advertising cookies of our own — any such cookies come from our third-party ad and analytics partners.

Third parties

We run Google Analytics and third-party advertising partners (see Advertising above), which receive data as described in those sections. We do not sell your personal information for money. We also use third-party infrastructure (Vercel for hosting, Upstash Redis for account and analytics storage, HikerAPI as the Instagram data source) — each of these only receives the minimum data required to deliver the service.

Your rights

Premium account information includes identifying data such as your email address. To ask about access, correction, or deletion of your account information, contact support@incognitogram.com. You can stop tracking accounts and manage your subscription from your account page. Browser privacy controls and third-party preference settings can help manage advertising and analytics data.

Changes

We may update this policy as the service evolves. The date at the top of this page reflects the last revision.