I HAVE
A CONTACT. OFF THE RECORD
Back to homepage

Privacy Policy

Last updated:

I Have a Contact is operated by hungryhuman in New South Wales, Australia.

This Privacy Policy explains how we collect, use, hold and disclose information when you use I Have a Contact.

The service may be accessible internationally. Depending on your location, additional privacy rights may apply.

I Have a Contact is not affiliated with, endorsed by or operated by Instagram or Meta.

We may collect the following information.

ACCOUNT INFORMATION

When you create or use an account, we may collect:

  • your Supabase user identifier
  • your email address
  • authentication-provider information where you use Google sign-in
  • whether your session is anonymous or registered
  • your account tier
  • your account creation and authentication timestamps

We do not receive your Google password.

INSTAGRAM SEARCH AND SERVICE INFORMATION

When you use the service, we may process:

  • Instagram usernames entered into the search field
  • publicly available Instagram profile information
  • search-allowance usage
  • Recent Profile history
  • temporary profile and media access records
  • information required to load publicly available stories, posts, reels, comments and replies

We do not ask for or store your Instagram password.

We do not require you to sign into Instagram.

We do not use your Instagram account to follow, like, comment on or message another account.

RECENT PROFILES

For registered accounts, we may store up to five Recent Profiles, including:

  • Instagram user identifier
  • username
  • display name
  • verification status
  • stored profile picture
  • last search time

You can remove individual Recent Profiles through the website.

Recent Profile pictures are stored privately and are available only through temporary signed access links.

BILLING INFORMATION

For paid memberships, we may store:

  • Stripe Customer identifier
  • Stripe Subscription identifier
  • Stripe Price identifier
  • membership plan
  • subscription status
  • billing-period dates
  • scheduled-cancellation status

Stripe processes payment-card and payment information.

We do not store full payment-card numbers, card security codes or complete payment credentials.

SUPPORT INFORMATION

When you contact support, we may collect:

  • your reply email
  • support category
  • message
  • account tier
  • whether the request came from an anonymous session
  • an optional safe application error code
  • support reference number
  • support status
  • notification-delivery status
  • submission and resolution times

Do not submit passwords, payment-card details, Instagram login information or other unnecessary sensitive information through the support form.

OPERATIONAL INFORMATION

We collect limited operational information to secure and improve the service, including:

  • backend endpoint used
  • operation type
  • account tier
  • request outcome
  • whether a response was served from cache
  • whether the external data provider was called
  • provider HTTP status category
  • request duration
  • safe application error code
  • event time

Operational telemetry does not intentionally store:

  • Instagram usernames
  • Instagram profile or media identifiers
  • captions
  • comments or replies
  • image or video URLs
  • access tokens
  • payment details
  • external-provider response bodies

TECHNICAL INFORMATION

Our service providers may process ordinary technical information such as:

  • IP address
  • browser and device information
  • request time
  • security and diagnostic logs
  • cookies or local-storage values required for authentication and session operation

ANALYTICS INFORMATION

With your explicit analytics consent, we use Google Analytics 4 to collect aggregate website usage information, such as:

  • page views
  • device and browser category
  • approximate location derived by the analytics provider
  • traffic source
  • safe product-interaction events
  • general engagement information

Google Analytics does not load unless you select "Accept analytics". You can decline analytics, or change your decision later, through the Analytics preferences control in the footer. Declining analytics does not affect any feature of the service.

Searched Instagram usernames and the social-media content you view are not intentionally sent to Google Analytics.

We may use information to:

  • provide and secure the service
  • authenticate users
  • manage anonymous and registered sessions
  • enforce daily search allowances and burst limits
  • provide memberships
  • process and verify subscription status
  • remember Recent Profiles
  • load publicly available Instagram-related content
  • respond to support and content-removal requests
  • prevent abuse, fraud and automated misuse
  • troubleshoot failures
  • measure cache effectiveness and provider usage
  • understand operating costs
  • comply with legal obligations
  • establish, exercise or defend legal claims

We do not sell personal information.

We do not use account information to log into Instagram.

The service retrieves publicly available Instagram-related information through a third-party data provider.

Public information may include:

  • profile details
  • profile pictures
  • biographies
  • follower and following counts
  • post counts
  • active stories
  • posts
  • reels
  • public comments
  • public replies

Private-profile content is not accessed.

A private profile may still expose limited public profile details.

Information displayed by the service may be incomplete, delayed, unavailable or inaccurate because it depends on third-party services and publicly available source information.

We use third-party services to operate I Have a Contact.

These may include:

Supabase:

  • authentication
  • database storage
  • private file storage
  • Edge Functions
  • operational infrastructure

Stripe:

  • subscription billing
  • Checkout
  • Customer Portal
  • payment processing
  • subscription status

HikerAPI:

  • publicly available Instagram-related data

Resend:

  • private support-request email notifications

Google:

  • optional account authentication
  • website analytics (Google Analytics 4), only after analytics consent

Lovable:

  • website-development and hosting-related infrastructure

These providers may process information in accordance with their own terms and privacy practices.

Information may be processed or stored outside Australia.

We may disclose information:

  • to service providers that help operate the service
  • where required by law, court order or lawful authority
  • to protect the security or integrity of the service
  • to investigate fraud, abuse or unlawful conduct
  • to enforce our Terms
  • in connection with a business transfer, restructure or sale
  • with your consent or at your direction

We do not disclose support messages or account history publicly.

We use the following general retention periods:

API cache:

  • approximately five minutes

Profile and media access grants:

  • approximately 30 minutes

Rate-limit counters:

  • operational windows are removed after they are no longer required

Operational telemetry:

  • approximately 90 days

Completed Stripe webhook-processing records:

  • approximately 180 days

Support requests:

  • retained while open or in progress
  • resolved or closed requests are retained for up to 24 months

Recent Profiles and stored pictures:

  • retained until removed by the user or until account deletion

Account and subscription records:

  • retained while the account exists
  • some transaction, security, dispute or legal records may be retained where reasonably required

Retention periods may be extended where reasonably necessary for:

  • legal obligations
  • billing disputes
  • fraud prevention
  • security investigations
  • legal claims
  • regulatory requests

We use measures intended to protect information, including:

  • authenticated server-side functions
  • restricted service-role operations
  • row-level security
  • private Storage
  • temporary signed file URLs
  • server-side payment and provider credentials
  • rate limiting
  • access grants
  • limited operational telemetry
  • scheduled deletion of expired operational records

No internet service can guarantee absolute security.

Registered users can delete their account through Account Overview.

For a paid user, account deletion is designed to:

  • immediately cancel the active subscription
  • delete the Stripe Customer where appropriate
  • remove stored Recent Profile pictures
  • permanently delete the Supabase authentication account
  • remove associated user-owned application records

Account deletion does not automatically refund unused subscription time.

Mandatory consumer rights remain unaffected.

Some limited records may be retained where required for legal, billing, security, fraud-prevention or dispute-resolution purposes.

You may use the form to request:

  • access to personal information we hold about you
  • correction of inaccurate information
  • deletion where available
  • information about how your data is handled

We may need to verify your identity before completing a request.

The service may be accessible globally.

Your information may be processed in countries other than your own.

Depending on your location, you may have additional rights concerning:

  • access
  • correction
  • deletion
  • restriction
  • objection
  • portability
  • complaints to a local regulator

Use to submit a privacy-rights request.

We may restrict availability in a country or region where reasonably necessary.

I Have a Contact is intended only for people aged 18 or older.

We do not intentionally provide the service to children.

Do not submit information about children through the support form unless it is necessary for a lawful content-removal or safety concern.

If you believe information has been mishandled:

  1. Submit a request using .
  2. Choose the most relevant category.
  3. Explain the concern and include the support reference in later correspondence.

We will assess the complaint and may request information needed to verify the account or investigate the issue.

You may also have the right to complain to an applicable privacy regulator.

We may update this Privacy Policy when the service, providers, legal requirements or information-handling practices change.

The current version and last-updated date will appear on this page.

Use the in-app form for:

  • privacy requests
  • account or information access
  • corrections
  • deletion enquiries
  • complaints
  • security concerns
Back to homepage