Privacy & data

RIGtracker is an independent research application. It is not affiliated with Meta or Instagram. This notice describes this local MVP; the operator must provide their contact details and applicable retention policy before offering a hosted service.

What this application stores

Your RIGtracker email and name, a securely hashed RIGtracker password, your saved accounts and notes, authorized profile observations, available media metrics, tracking events, and notifications. Demo accounts and all demo metrics are fictional. Each signed-in user has a separate workspace.

Instagram authorization

You authenticate directly with Meta. RIGtracker never asks for or stores your Instagram password, browser session cookies, recovery details, or hidden contact information. If connected, an access token is encrypted on the server alongside the granted scopes, account ID, and expiry.

Your controls

Settings lets you export your workspace, disconnect a locally stored connection, or permanently delete your local account and associated records. Disconnecting removes the local token and pauses live tracking; you can revoke the grant itself in Instagram’s connected-app settings. Deletion does not delete Instagram content. Operators must also apply deletion to their backups according to their published retention policy.

Cookies, media and telemetry

Two first-party cookies support sign-in and request verification. There are no advertising cookies. Media files are not downloaded or archived; where allowed, provider-hosted image URLs may be displayed. Loading a remote image sends an ordinary browser request to that host. Request logs contain route, status, timing and a random request ID, never authentication secrets.

Retention

Workspace observations are retained until you delete them or the operator applies a documented retention policy. The worker removes expired sessions and OAuth states, old telemetry after 30 days, and temporary demo workspaces after 7 days. Production backups need a separate operator-managed retention policy.

Unsupported access

RIGtracker does not access private accounts without authorization, collect Instagram credentials, identify hidden contacts or link sharers, or bypass platform access controls.