Privacy Policy

The short version

You can read every public page on this site without an account, and we will not know who you are. Sign in and we do: your email, and which pages you open, including the ones you read in that same visit before you signed in. If you sign in or buy a plan we hold your email address and what you bought. We do not sell anything about you, we do not run advertising, and we do not set tracking cookies that follow you to other sites.

1. What we collect

If you only browse: aggregate analytics. Page viewed, referrer, country, rough device type. This is collected by DataFast, which does not use cookies and does not build a cross-site profile of you. We use it to see which pages are worth writing more of.

If you sign in: your email address and the account identifier from Google, handled through Firebase Authentication. We never see your Google password. From 17 September 2026 we also record which pages on this site you open while signed in, stored against that email address, including the pages you opened earlier in the same visit, in the few hours before you signed in. We use it to see which brands the people who sign up actually care about. It is not shared, not sold, and it stops the moment you sign out.

If you buy a plan: your email address, which brands the plan covers, the plan type and price, and the dates it started and renews. Card details go directly to Stripe and never touch our servers. We could not leak a card number we have never held.

If you use the developer API: your email, your API key, and a log of request counts so we can enforce rate limits and bill correctly.

If you email us: the email, obviously, kept as long as it is useful to the conversation.

2. What we do not collect

No card numbers. No advertising or cross-site tracking identifiers. No location beyond the country your request came from. No data about private individuals. Everything the product measures is a public business account on Instagram, or a public post somebody chose to publish there.

3. Why we hold it

To run your account and the plans on it, to send the alerts you subscribed to, to take payment and stop taking it when you cancel, to keep the API fair, and to understand which parts of the site are used. That is the whole list. We do not profile you, and we have nothing to sell to a data broker.

4. Who else touches it

These are the processors we send data to, and what each one gets:

• Vercel, hosting. Serves every page and holds our stored brand logos.
• Neon, the Postgres database where accounts, subscriptions and measurements live.
• Stripe, payments. Gets your card details and billing email directly; we get back the fact that you paid.
• Google Firebase, sign-in. Gets your email and Google account ID.
• Resend, transactional and alert email. Gets your address and the message.
• DataFast, analytics. Gets page views, not identities.

We also call a small number of data providers, for public social data, for the AI-assistant visibility checks, and for brand logos. What they receive is brand handles and hashtags: public identifiers of companies, never anything about you. They are named in our processor list, which we will send to any customer who asks.

We do not sell, rent, or trade personal data. We would hand it over to a lawful legal demand, and would tell you unless legally barred from doing so.

5. Cookies

One functional cookie region: the session that keeps you signed in after you use Google sign-in. Nothing else. There is no consent banner because there is no advertising or cross-site tracking to consent to.

6. How long we keep it

Account and subscription records last as long as your account does, and for a short period afterwards for accounting and tax purposes. Analytics is aggregate and not tied to you. Brand measurements such as follower counts, mentions and AI-assistant answers are about brands rather than people, and are kept indefinitely because the entire point of the product is the trend over time.

7. Your rights

Wherever you live, you can ask us for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Deleting your account removes your email, your subscriptions and your API keys. It does not remove the public brand statistics, which are not personal data.

If you are in the EU or UK, the lawful bases we rely on are contract (running the plan you bought) and legitimate interest (aggregate analytics, keeping the API from being abused). If you are in California, we do not sell or share personal information as the CCPA defines those terms, so there is nothing for you to opt out of.

To exercise any of this, email hello@monitormentions.com from the address on the account. We aim to answer within 30 days and usually do it the same week.

8. Where the data lives

On servers in the United States. If you are outside the US, using the site means your data is processed there.

9. Children

This is a business tool and is not directed at anyone under 13. We do not knowingly collect data from children; if we learn we have, we delete it.

10. Changes

If we change how your data is handled, we will email active customers rather than quietly editing this page. The date at the top always reflects the last change.

11. Contact

hello@monitormentions.com. A real person reads it.