Privacy Policy

1. Data you give us

• Account details: your name, email address and a hashed password, or the profile details Google shares if you sign in with Google. Used to run your account and send transactional email such as confirmations and password resets.
• Billing: payments are taken by Paddle.com, our merchant of record. We never see your card number. Paddle shares with us your plan, subscription status, country and the email you paid with so we can activate your plan and show invoices.
• Things you create: saved posts, collections, notes and tracked accounts. Stored so we can show them back to you.

2. Data we collect automatically

• Usage counts: how many searches and downloads you make each month, so we can apply plan limits.
• Search history: the public accounts and hashtags you look up, so you can return to them. You can clear this from the app.
• Technical logs and error reports: IP address, browser type, pages visited and error traces, kept for security and reliability. Error reports are processed by Sentry. We do not use advertising trackers.
• Preferences stored in your browser: theme choice and whether you have seen the tour. These never leave your device.

3. Public Instagram data

When you search an account, Outlier fetches publicly visible information about that account and its posts through a third-party data provider (Apify). This includes the username, display name, bio, follower count, post captions, like and comment counts, and media URLs. We cache it for up to 48 hours so repeated searches are fast and so we fetch less from Instagram. We do not fetch private accounts, direct messages or anything behind a login.

If you are the owner of a public Instagram account and would like it excluded from Outlier, email us with the username and we will block it within five working days.

4. Why we are allowed to process this

We process account, billing and usage data to perform our contract with you. We process logs, error reports and cached public data under our legitimate interest in running a secure, reliable research tool, balanced against the fact that the content is already public and we do not use it to profile individuals. Where consent is required for anything else, we will ask.

5. Who we share data with

• Supabase (database and authentication), Vercel (hosting), Apify (public data retrieval), Paddle (payments) and Sentry (error monitoring). Each only receives what it needs to provide its service to us.
• Authorities, where the law requires it.
• A buyer, if the business is sold, under the same protections.

We do not sell personal data and we do not share it with advertisers.

6. International transfers

Our providers run in the United States and the European Union. Where data leaves your region we rely on standard contractual clauses or an equivalent safeguard.

7. How long we keep it

Account data is kept while your account is open and deleted within 30 days of closure. Usage counts are kept for 13 months for billing disputes. Cached public Instagram data expires after 48 hours. Logs are kept for 30 days, error reports for 90.

8. Your rights

Depending on where you live you can ask to access, correct, export or delete your personal data, object to or restrict processing, and complain to your local data protection authority. Email outlier@nokhaos.com and we will respond within 30 days. Deleting your account removes your collections, trackers and history.

9. Security

Data is encrypted in transit and at rest, access is limited by row-level security so one customer can never read another's data, and secrets are kept out of the browser. No system is perfect; if we ever learn of a breach affecting you we will tell you without undue delay.

10. Changes

We will email account holders about material changes before they take effect and keep the “last updated” date above current. See also our Terms of Service.