Privacy Policy

Last updated: September 20, 2026

Anonimogram ("Anonimogram," "we," "us") operates https://anonimogram.com (the "Service"), a tool for browsing publicly available Instagram content without an Instagram account. This Privacy Policy explains what information the Service actually collects, how it's used, and the choices you have.

We've written this to describe what the Service really does — not a generic template. If a section doesn't apply to something the Service does, we've said so rather than including it anyway.

What the Service does

Anonimogram lets you search a public Instagram username and view information that Instagram already makes visible to a logged-out visitor: profile details (name, bio, avatar, verified badge, category, external link, and follower/following/post counts), a recent batch of public posts and reels, public comments on those posts, and the list of a profile's Highlights (with individual Highlight content shown where Instagram itself makes it available to logged-out visitors — some Highlights require an Instagram login and are shown as unavailable rather than bypassed). Active Instagram Stories require an Instagram login to view at all; the Service does not access or display them. The Service never logs into Instagram, never uses Instagram cookies or credentials, and never accesses private accounts' content.

Information you provide directly

If you create an account or sign in (Google Sign-In or email and password, via Firebase Authentication — see "Firebase Authentication" below), we receive whatever Firebase provides for that sign-in method: typically your email address, and where available, a display name and profile photo URL. We use this only to recognize you as signed in and to show your name or email in the site header. If you use the Service without signing in, you don't provide us any personal information directly.

Firebase Authentication

Sign-in is handled entirely by Firebase Authentication, a Google Cloud service. When you sign in, Firebase issues your browser a short-lived ID token. Each time you make a request that requires being signed in, that token is sent to our server and cryptographically verified — we confirm it's genuine and extract your Firebase user ID, but we do not maintain our own account database. Anonimogram's own servers do not store your password, your email, or a permanent record of your account at all; that record lives entirely within Firebase/Google's infrastructure, governed by Google's Privacy Policy. Your Firebase ID token itself is managed by the Firebase SDK running in your browser — Anonimogram's own code never writes it to `localStorage` or any other manual storage.

The anonymous visitor identifier

If you use the Service without signing in, our server sets a single cookie (`anon_visitor_id`) — a random, opaque identifier with no meaning on its own. It is not a fingerprint, and it isn't built from your IP address, browser characteristics, or any other information about you. Its only purpose is to let our server recognize the same anonymous visitor across a few searches, so we can offer a small number of free searches before asking you to create a free account. This cookie is `HttpOnly` (invisible to page scripts) and is set to expire after about a year, matching how long we keep the associated search count.

Search quota state

For anonymous visitors, our server keeps a small counter (how many successful searches you've made) associated with the identifier above, stored in our Redis cache for the same duration as the cookie. Only a genuinely successful profile search increments this counter — a search for a username that doesn't exist, is private and inaccessible, or fails due to an upstream error never counts against it. Signed-in accounts are not subject to this limit.

Server infrastructure, caching, and logs

• Redis is used as a short-lived cache for the publicly retrieved

Instagram content shown to users (so repeated searches for the same profile don't require re-fetching it every time), for the anonymous search counter above, and for short (about one-minute) rate-limiting windows described below. It is not a general-purpose database and holds no account records.

• Rate limiting. To keep the Service stable and prevent abuse, our

server temporarily counts requests per IP address over short, repeating one-minute windows. This IP-based count is never written to a persistent log — it exists only as a short-lived counter that resets every window.

• Standard server access logs. Like most web services, our

infrastructure records standard operational logs for incoming requests — for example, the requesting IP address, the requested page or API path (which includes the username you searched), a timestamp, and the response status. These logs exist for security, debugging, and operating the Service reliably; we do not use them for advertising, profiling, or analytics, and we do not operate any separate analytics or tracking platform. We keep these operational logs only for as long as reasonably necessary for those purposes, not indefinitely.

• We do not maintain a database of who searched which Instagram

username.

Cookies and browser storage

See our Cookie Policy for the full list. In short: the only cookie the Service itself sets is `anon_visitor_id` (above); Firebase's own SDK manages whatever local session data it needs to keep you signed in, according to Firebase's own documentation; and your Search History and Favorites (if you use those features) are saved only in your own browser's local storage — never sent to or stored on our servers. We do not use any advertising or analytics cookies.

Third-party services

• Firebase / Google — authentication (see above), governed by

Google's Privacy Policy.

• Cloudflare — sits in front of our domains as a DNS and content

delivery provider, and may process standard connection information (like IP addresses) as part of routing traffic to our servers, under Cloudflare's Privacy Policy.

• WordPress (headless CMS) — powers this page and our blog/informational

content, hosted separately from the Instagram-viewing part of the Service. It does not receive any information about your searches or account.

• Instagram is the public source of the profile information

displayed. We are independent of Instagram and Meta — see our Disclaimer. Viewing a profile on Anonimogram doesn't send Instagram any information identifying you as the viewer beyond what's inherent in our server making a public, logged-out request.

Third-party links

Instagram profile pages, external links in a bio, and other content we display may link to third-party sites we don't control. We're not responsible for their privacy practices — check their own policies before providing them any information.

Security

We use industry-standard practices (like HTTPS everywhere and cryptographic verification of sign-in tokens) to protect the information described above, but no online service can guarantee absolute security. Please use a strong, unique password if you create an account.

Your choices and rights

You can use almost all of the Service without ever providing any personal information, simply by not creating an account. If you do create an account, you can sign out at any time, and clearing your browser's cookies and local storage removes the anonymous identifier, your Search History, and your Favorites from that browser. Depending on where you live, you may have rights under applicable law to request access to, correction of, or deletion of information relating to you — see our Account & Data Deletion page, or contact us at the address below.

Children's privacy

The Service is not directed at children, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this policy as the Service changes. We'll update the "Last updated" date above when we do.

Contact us

Questions about this policy or how your information is handled? Email us at anonimogramofficial@gmail.com. See also our Contact page.