Privacy Policy & User Data Disclosure

1. Single Purpose & Scope

YassTracker Pro is a privacy-first browser extension designed for creators, businesses, and everyday Instagram users. Its single purpose is to provide Instagram follower analytics, track unfollowers, identify mutual followers, and allow users to export their relationship insights to CSV and Excel files directly within their active browser session.

        Independent Software Notice: YassTracker Pro is an independent software tool developed by the YassTracker team. It is not affiliated with, authorized, maintained, sponsored, or endorsed by Instagram, Meta Platforms, Inc., or any of their affiliates.
      

2. Categories of User Data Handled & Collection Methods

We believe in strict data minimization. Below is a comprehensive breakdown of every category of data handled by YassTracker Pro:

Data Category	Specific Data Points	Where Stored	Transmitted Off-Device?
Personal Account Data (Pro Users Only)	Email address, bcrypt-hashed password, license key.	Secure Server (`dev.yass.ink`)	Yes — transmitted securely over TLS 1.3 to authenticate Pro licenses.
Device Identifier	Randomly generated anonymous installation ID (e.g. `ext-uuid`).	Local Storage & License Server	Yes — sent with auth requests to enforce multi-device limits.
Authentication & Session Cookies	Instagram session tokens (`ds_user_id`, `csrftoken`).	Browser Cookie Store	NO — accessed locally via Chrome API to authenticate in-session requests; never sent to YassTracker servers.
Follower & Relationship Graphs	Instagram usernames, User IDs, profile pictures, follower/following lists, scan history snapshots.	On-Device IndexedDB (`ig_tracker`)	NO — stored 100% locally on your computer; never uploaded or transmitted to our servers.
Extension Settings & Preferences	Protected whitelist user IDs, UI theme (dark/light), scan interval delay, daily action rate counter.	On-Device (`chrome.storage.local`)	NO — kept exclusively on your local device.

3. How We Use and Process Your Data

Data accessed or processed by YassTracker Pro is strictly used for user-facing features:

Account Authentication & Licensing: For registered Pro users, email addresses and anonymous device IDs are used solely to authenticate your account, issue cryptographic RS256 entitlement tokens, and manage active device activation limits.
Differential Follower Tracking: Follower and following lists retrieved from Instagram's web endpoints are compared locally against previous scan snapshots in your browser's IndexedDB to compute who unfollowed you, new followers, mutuals, and fans.
Data Export: When you request an export, CSV or Excel files are compiled entirely within your browser memory and saved to your computer via the Chrome Downloads API.
Account Safety & Pacing: Daily follow/unfollow action counters are tracked locally to enforce a 100-action daily safety ceiling, protecting your Instagram account from platform rate limits.

4. Chrome Extension Permissions Justification

YassTracker Pro requests only the minimal permissions required to function:

storage: Required to store user settings, theme preferences, protected whitelist accounts, and scan metadata locally on your device.
cookies: Required to read active Instagram session authentication cookies (ds_user_id, csrftoken) so you can scan your followers without entering or sharing your Instagram password.
tabs: Required to open the full-screen analytics dashboard (tabs/main.html), onboarding guides, and support pages in a new browser tab.
downloads: Required to save exported CSV and Excel follower reports directly to your computer.
scripting: Used as a fallback to execute secure fetch helpers within active Instagram tabs when background queries encounter browser CORS or session restrictions.
https://*.instagram.com/* & https://instagram.com/*: Required to fetch follower, following, and profile relationship endpoints from Instagram.
https://dev.yass.ink/*: Required for Pro license validation, account authentication, and checking application version updates.

5. Data Storage Locations & Retention Schedules

A. Local On-Device Storage

All scanned Instagram relationship data, user profiles, historical snapshots, and differential analytics are stored locally on your device using IndexedDB (ig_tracker) and chrome.storage.local. This data remains on your machine until you manually clear it using the in-dashboard "Clear Database" button or uninstall the extension.

B. Remote Server Storage

For users who register a Pro account on dev.yass.ink, account records (email, bcrypt password hash, license key, and activated device IDs) are stored in our secure, transaction-protected database. This information is retained only for the duration of your active subscription or until you submit an account deletion request.

6. Zero Data Sharing & Third-Party Disclosures

We uphold an unequivocal commitment to your privacy:

NO Sale of Data: We do NOT sell, rent, monetize, trade, or transfer personal or user data to any third parties, advertisers, or data brokers under any circumstances.
NO Advertising Trackers: We do NOT include any third-party ad networks, tracking pixels, or cross-site tracking scripts.
Payment Processors: Payment transactions for Pro licenses are processed by third-party payment gateways (e.g. NowPayments, LemonSqueezy). Payment credentials (credit card numbers, cryptocurrency keys) are submitted directly to the payment processor; YassTracker Pro never collects, sees, or stores your financial information.

Google Chrome Web Store Limited Use Disclosure:
YassTracker Pro’s use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Data Security & Cryptographic Safeguards

We implement enterprise-grade technical and organizational security measures:

Encryption in Transit: All communications with dev.yass.ink and Instagram web endpoints are strictly encrypted using TLS 1.3 / HTTPS.
Asymmetric Token Verification: Pro entitlement tokens are digitally signed on the backend with 2048-bit RSA keys (RS256) and cryptographically verified in the extension using browser-native WebCrypto (RSASSA-PKCS1-v1_5 with SHA-256).
Password Protection: Account passwords are automatically salted and hashed using bcrypt with a computational cost factor of 12. Plaintext passwords are never stored or logged.
Restricted File Permissions: Server data directories and configuration secrets are locked down with strict POSIX permissions (0700 directories, 0600 files) and atomic write-replace transactions.

8. User Rights & Data Deletion Procedures

You have full control over your personal and relationship data:

Local Data Deletion: You can instantly wipe all local snapshots, follower history, and cached profiles by clicking the "Clear Database" button in the extension dashboard or by uninstalling YassTracker Pro from Chrome.
Pro Account Deletion Request: If you registered an account and wish to permanently delete your email, license association, and device records from our servers, simply email contact@yass.ink with the subject line "Account Deletion Request". We will permanently erase your server records within 30 days.
Data Export: You can export your full follower, following, unfollower, and mutual datasets at any time in standard CSV or Excel formats.

9. Policy Updates & Contact Information

We may update this Privacy Policy from time to time. Any material changes will be reflected with an updated "Last Updated" date at the top of this page and documented in our public changelog.

If you have any questions, privacy concerns, or data requests, please contact our Data Controller:

Controller / Team: YassTracker Pro Development Team
Email: contact@yass.ink
Support Telegram: @yassthichca
Official Website: https://dev.yass.ink