Privacy policy
Revised
In one paragraph
We do not know who you are, and the site is built so that we never need to. You create no account here, which leaves us nothing about you to keep. Every page is a plain file served as it is. No record of the usernames you search is kept. There is one exception worth stating plainly: each search adds the username to the page address, as /?u=name. Like any web address, a request for that page lands in the routine logs kept by our host and by Cloudflare. That network also tallies searches from each IP address over a short window to stop anyone flooding the viewer. Apart from that and the counter of visit origins described next, no tally of visitors is kept for us here; how the site is meant to earn its keep is listed under Advertising. If any of this shifts, this page is revised before the change, with a new date.
As for the origin count, after a page has been open a couple of seconds, it passes on the host of the site that referred the visit, with no path, the page that got opened, the country and a campaign label, when the link includes one, and a daily total grows by one. No cookie is set, no identifier kept, no IP stored. Visitors with DNT or GPC switched on are skipped, and totals are not kept beyond about 13 weeks. One more small item lives on your device: a stamp with the day of your last visit, there so we can separate first-timers from regulars. The page tells us only the size of the gap in rough terms; the stamp itself stays put and identifies nobody. Remove it through your browser’s site settings. Visitors with DNT or GPC leave no stamp.
On your device, not ours
The short list of profiles you opened recently is stored by your browser itself (local storage, in technical terms). That list is never sent to us, and a different phone or computer cannot see it. Your browser also keeps an offline copy of this site’s own pages, stored by a small script called a service worker, so they still load offline. That copy holds the pages only, never the profiles you looked up. Pressing Clear beside the list wipes the list, clearing the site’s data removes both, and a private browsing window forgets it when you close the window.
What a lookup involves
Pressing View first starts a background test, which the network shielding the site runs (Cloudflare Turnstile). It weighs how your browser behaves to tell a human from a script, on every search, and normally asks nothing of you. The request then goes to imgsed.net. Our server then puts the question to a data supplier run by another company; the supplier collects that public profile, and its reply travels back through us to your page. All it learns is a username and the fact that our server wanted it. Your IP address, the site’s own name and your browser’s headers never get that far. The supplier alone decides how long it holds on to that.
As for the photos and videos, Instagram’s image and video servers deliver them. Those servers learn your IP address; that you came from imgsed.net is never mentioned to them. Our server passes along three things itself: profile photos, the round covers of highlights and each file saved to your device. If that concerns you, routing your traffic through a VPN, or picking a browser that is careful with privacy, cuts down what servers get to see of you, on this site and everywhere else.
Advertising
Imgsed hopes to cover its costs with advertising. Placement is chosen by an independent ad firm whose own terms decide how it treats data. While an ad is loading, that firm or one of its advertisers may write cookies, matching IDs or small tracking images onto your device.
- Readable by the ad firm: where your connection comes from (the IP), which browser you use and in what language, how big the window is, the page hosting the ad, and a note of an ad being shown or hit. Targeting can rely on how you behave elsewhere on the web.
- Permission: anybody connecting from the EEA, the UK or Switzerland gets a consent dialog ahead of any ad and may decline tailored advertising in it. Everywhere else, the browser’s switch against outside cookies, or a private tab, trims that tracking.
- Script on every page: the ad firm’s script is part of each page here, so it can register a visit even where no ad shows.
- Usernames: none is forwarded by Imgsed to the ad firm. A results URL does include the name (
/?u=name) though, and every script the page loads, ad code included, might see that URL.
Outside services
- Hosting: keeps the files and delivers them to your browser.
- CDN (Cloudflare): a delivery network standing between you and the site; it blocks attack traffic and runs the Turnstile test for each search, and to do that it has to glance at your IP address.
- Data supplier: retrieves public profiles on our server’s request, as explained above.
- Image hosts run by Instagram: deliver photos and videos without passing through us.
- Ad firm: supplies the ads and opens the consent window explained further up.
Beyond these, the site gives nothing to anybody, and nothing is for sale.
What you can ask of us
You can ask us what we hold about you and have it corrected or removed. Most likely you will hear that there is nothing on file about you, and our written reply will say so. Imgsed.net itself answers for anything held here, and the address for it is contact@imgsed.net. If our answer leaves you unsatisfied, you can complain to the data protection authority in your country.