Privacy

Hashtag Ninja takes a sentence describing what you want to know about a hashtag and turns it into a collection plan. The planner needs no account: the brief you type is sent to a model provider (below), the plan comes back, and nothing about that request is stored against you. If you sign in, we keep your email address so the account exists, and the credit balance attached to it.

Collection, and the session you supply

A collection runs as you, against the account you control, so it needs a session for the platform being collected from. You paste one in when you start a run.

That session is not stored. It is passed to the collection service at the moment a run starts and then dropped: it is not written to our database, it is not written to a log, and it is not kept in a file. There is no column for it. A run that has already started is picked up again by the run's own reference, which is why finishing one never needs the session a second time. The practical consequence is the one worth stating plainly: a breach of our database could not disclose your platform session, because it is not in there.

What a run does keep is the result: the posts it collected, the report written from them, and the plan it ran. Those are what you paid for and what the CSV is served from. They are public posts, they are attached to your account, and they are deleted when your account is deleted.

We do not offer collection on a schedule today. A scheduled report would have to keep a session long enough to use it later, which is a different promise with a different answer, and this page changes in the same commit as the code if that ever ships.

The free measurement, which runs on our account

The free tool on the home page and the tool pages does two things. It plans a collection from your brief, which needs no account and reaches no platform at all. It may also show a small live measurement of one hashtag from that plan, and that read runs on an Instagram account we operate, never on yours. You are not asked for a session, and if you paste one anywhere on that page it is ignored.

What comes back is counts. How many posts were sampled, posts per day over the sampled window, the spread of likes, which tags were posted alongside, and which hours of the day carried the most posts. No post, no caption, no username, no image and no link to anybody's post is shown or kept. That is not because they are hard to fetch, but because a measurement of a hashtag is a fact about the hashtag, and republishing a stranger's post to an anonymous visitor is a different thing that we do not do.

The measurement is cached for about six hours under the hashtag alone, so a tag is read once however many people ask for it. That cache is keyed on nothing about you: it holds a hashtag and its counts, and there is no visitor, session or address in it. It is also bounded (a fixed number of live reads a day across everybody), which is why the panel sometimes says the measurement is unavailable while the plan still appears. That is us, not you.

Free tool

The free tool itself is different from that cache: to enforce its daily limit it keeps the IP address of the connection, as the raw address, with a count of how many times it was used that day. That record expires on its own after about a day (26 hours). Before a request is answered, the tool also runs a browser check to keep automated abuse out, and the IP address is sent with it to Cloudflare, which runs the check.

Cookies and tracking

We use no cookies to identify you and no advertising pixels. We do not build a profile of you across visits, and we do not sell or share your data.

We do measure how the product is used, so we can tell which parts of it are working. That measurement is first-party (it goes to our own servers and nowhere else), and it is scoped to a single visit: a random id is kept in your browser's sessionStorage and is discarded when you close the tab. We record which steps were taken and how long they took, the page path, and the host a visit arrived from (for example google.com), never the full link or anything you typed into a search box.

We also record three broad facts about the visit itself: the kind of device (phone, tablet, desktop, or an automated crawler), the operating system and its major version only (iOS 17, never iOS 17.4.1), and the country and region the connection came from, which Cloudflare works out at its edge so that this measurement never sees or keeps the address itself (the free tool and the support chat, below, are the places an address is stored). We do not keep the browser's User-Agent string: it is read once to work out the device and the system, and then discarded, because the full string is detailed enough to single somebody out. A visit from a hosting or mail-security network (an email provider's link scanner, not a person) is counted as a crawler too: the network is read once to decide that, and is not kept.

Each of those is counted on its own. We keep a daily total per device kind, and a separate daily total per country, and we never keep a row that combines them, so the numbers cannot be narrowed to "the one person on a tablet in Iceland". The cost of that, to us, is that we cannot ask which system a particular country's visitors run. We think that is the right way round.

We also measure how long each page was open and visible, so we can see which pages are actually read. The clock stops whenever you switch away from the tab, so a page left open in the background does not count as time spent reading.

We do not store your IP address for analytics. To count distinct visitors within a day we keep a one-way hash of it combined with the date and a secret, which cannot be reversed and cannot be matched to any other day. Individual event records are deleted after 30 days; only anonymous daily totals are kept after that.

If you are signed in, we keep one small record per account so we can tell repeat use from first-time use: your account id with the first day and the last day it was active. Two dates, and nothing else: not what you did, not which pages, not from where. It is your existing account id, not a new identifier: nothing is written to your browser to make it, and it does not exist at all for a visit you make signed out. It is deleted when your account is deleted.

A signed-in account also has a second, separate record, and it is not a pair of dates: a last-seen time, refreshed about every 30 seconds while you have the app open and once more as you close the tab. It is one row that is overwritten each time, not a history of your visits. We keep when you were last here, never a list of when you have been here. It exists for one reason: a collection can take longer than you want to wait, so when one finishes we check whether you are still on the page, and if you have gone we email you that your report is ready. You can turn that email off in the app, which stops the email; the last-seen time is still written while the app is open. Nothing about this record is used for measurement, it is never combined with the analytics above, and it is deleted when your account is deleted.

Support chat

The sections above describe measurement and the free tool. The support chat is different, because it exists to keep a conversation, and none of the measurement's properties apply to it. If you send a message in it, we store:

• the transcript: every message you send and every reply;
• who it belongs to: your account id if you are signed in, otherwise a random visitor id that the chat creates when you send your first message and keeps in your browser's localStorage, so the conversation can be reopened on a later visit;
• the IP address of the connection the conversation started from, stored with the conversation and used to limit abuse of the chat.

Each conversation is classified automatically (for example as a question, a bug report or a feature request). A short summary of a bug report or a feature request is emailed to our own feedback inbox so the team sees it.

Chat conversations are kept until they are deleted; they have no automatic expiry. A signed-in account's conversations are deleted when the account is deleted.

Who else touches your data

• Cloudflare: hosting, including delivery of the support chat's bug-report and feature-request summaries to our feedback inbox, and the free tool's browser check (Turnstile), which receives the IP address of the connection.
• A third-party large-language-model provider: the text you submit is sent to it so the product can produce a result, and so are your support chat messages, so it can write the reply and classify the conversation. The category is the disclosure: Article 13(1)(e) GDPR asks for the recipients or categories of recipients, and the provider is not named here.
• A third-party collection service: when you start a run, the hashtag, the bounds of the plan and the platform session you supplied are sent to it so it can do the collecting. It is named by category for the same reason and under the same article as the provider above.
• A third-party payment processor: paid plans and credit packs are paid for on its own site, so the card or account details you enter go to it and never reach us. It receives the plan or pack you picked and an internal id that links the payment back to your account, and it sends back the payment's and the subscription's status. The category is the disclosure here for the same reason as above: Article 13(1)(e) GDPR asks for the recipients or categories of recipients.

Deleting your account

Article 17 GDPR gives you the right to have your personal data erased, and the sentences above about data going when the account goes are what that means here. There is no delete button in the app, so the request is made by email: write to support@tiraisoft.com from the address you sign in with. That address is how the account is found and how we know the request is yours.

Deleting an account erases the analytics identity record described above first, and then every row stored against the account: your briefs, the plans and reports, the posts collected behind them, your sign-in sessions, your credit ledger and payment records, your subscription record, your product events, and your support chat conversations with their messages.

Two states hold a deletion until they are settled, because erasing under either corrupts the thing rather than ending it. A subscription that is still live at the payment processor has to be cancelled and reach the end of its paid period first, or nothing is left on our side to reconcile it against. A collection run that has not finished settles on its own (the credits it reserved go back), and deleting under it would strand the run at the collection service.

Contact

Questions about this notice, or a request about your own data: support@tiraisoft.com. Hashtag Ninja is operated by Tiraisoft, Indonesia.