Privacy Policy

We never sell any data. We never sell or give your personal information to advertisers either.

followDM is not affiliated with Instagram (Meta). We never ask for your Instagram account or login.

1. What we collect

• How we collect: from Google or Apple sign-in, what you save or enter yourself, what is created automatically as you use the app and website, and app store purchase records
• Account: the email and account ID provided by Google or Apple sign-in (the name and profile photo that come with sign-in are deleted right away, not stored)
• Email sign-in accounts created by the operator: the email (the password is stored only as a value that cannot be reversed)
• Library: the links you save, topics, memos, read status and save times
• Your folders: folder names, the DMLinks in them, whether link sharing is on, and your own order in the Library
• Abuse prevention: sign-up time, a device ID (not an advertising ID), network information (an irreversible value instead of your raw IP address) and how you saved (Save via Share, save button, from the ranking, from an ad)
• Usage: taps on View DMLink, Follow, Subscribe and Instagram/YouTube/TikTok visits; ad impressions and visits; reports. For people who are not signed in, in the app or on the web, these are counted without an account, using network information changed so it cannot be reversed
• Notifications: your device's push token and notification settings
• Account settings and days of use: time zone and language (for the local midnight of the daily save limit and the language of screens and notifications), and the days you used the app or website with the device type (Android, iOS, web)
• Payments: credit purchases and use (card and payment details are handled by the store; followDM never receives them)
• Subscription: followDM Plus subscription records (product, period, whether it is a trial, expiry time, whether it renews, store transaction ID; card and payment details are handled by the store and followDM never receives them)
• Ads: the ad title, one-line text, ad link (Instagram post, YouTube video, TikTok video or DMLink) and Instagram account name entered by advertisers, and for YouTube ads the channel information taken from the video / Instagram account names entered by owners
• Your link (invite code): your invite code and, if you came through a link with an invite code, that code and the time you came in, plus Google Play install referral information (the value of the link that led to the install)
• Server error logs
• Legal basis (item — purpose — basis)
  • Account (Google/Apple email and account ID, and the email of email sign-in accounts created by the operator) — sign-in and account management — performance of the contract (Personal Information Protection Act (Korea), Article 15(1)(4))
  • Library (saved links, topics, memos, read status, save times) — providing your Library — performance of the contract
  • Your folders (folder names, DMLinks in them, sharing on/off, your own order) — providing folders, folder link sharing and sorting — performance of contract
  • Notifications (push token, notification settings) — sending notifications — performance of the contract (the push token is collected only if you allow notifications on your device)
  • Account settings and days of use (time zone, language, days of use, device type) — daily save limit, screen language and usage statistics — performance of the contract
  • Ads (ad title, one-line text, ad link, account name, channel information) — showing ads, checking ad text and providing results — performance of the contract
  • Your link (invite code) (your invite code, the code and time you came in, install referral information) — giving free credits and preventing abuse — performance of contract, legitimate interests
  • Usage records ([View DMLink], [Follow], [Subscribe], visits, ad impressions and visits) — building the ranking and ad results — performance of the contract
  • Payment records (credit purchases and use) — providing and refunding credits — performance of the contract and legal retention duties
  • Subscription records (followDM Plus) — providing followDM Plus and handling cancellations — performance of contract, legal retention duty
  • Abuse prevention (sign-up time, device ID, network information changed so it cannot be reversed, save path) — preventing ranking manipulation and abuse — legitimate interests (same paragraph, item 6)
  • Report records — handling reports — legitimate interests
  • Server error logs — fixing errors — legitimate interests

2. What we do not collect

• Instagram passwords or logins, DM contents, who you follow, contacts or location
• The body text of pages you save (we read it only to find the title, description and creator account, then discard it right away without storing it) and their thumbnail images (we neither read nor store them)
• We use no third-party ads or tracking tools.
• Cookies and browser storage
  • The website uses only these cookies: keeping you signed in (your sign-in session and a check value used briefly while you sign in) and the ranking language you chose (kept for 1 year).
  • If you come through a link with a code (a save button or app download link), that code and the time you came in are kept in a cookie for 30 days (to pass them to the app).
  • Browser storage (not cookies) holds your display mode, share card style, a verification code in progress (24 hours), your Library sort order, chosen topic and service, and whether you have seen the folder tip.
  • We use no advertising or tracking cookies and no advertising IDs.
  • You can block cookies in your browser, but then you cannot sign in on the web and your chosen ranking language is not remembered.

3. How we use it

• To provide your Library and sort it by topic, build the ranking, prevent abuse, send notifications, run ads, handle reports and answer your questions
• Usage records of people who view the ranking without signing in are used only to build the ranking, measure ad results and prevent abuse.
• We use Google Gemini (AI) to sort DMLinks by topic. The AI receives the link, the beginning of the page (up to 300 characters after the title), and the topic changes you make (DMLink title and topic).
• For DMLinks in the ranking (except YouTube and TikTok) and DMLinks that are reported, the AI reads the page text to identify the creator and to judge reports. For YouTube and TikTok, the channel or account comes from the public video information they provide (oEmbed). For ads, the AI checks the ad text and the Instagram account name the advertiser entered (for YouTube ads, the channel name taken from the video). Whether a YouTube or TikTok ad's video still opens is checked with the public video information they provide (oEmbed).
• We never send your name, email or account number, or any information about the person who reported, to the AI. We do not store the page text the AI reads.
• What we send is not used to train the AI. Google keeps it for 55 days to detect misuse.
• Links you save and part of their pages are sent to the AI. If a link or page contains personal information, it may be sent too, so we recommend not saving links to private documents.

4. What is public

• Only the address, title, description and creator account (@handle or channel) of ranked DMLinks, totals such as save counts, and the title, one-line text and advertiser account of ads are public.
• Your Library, topics, memos, and who saved what are never public.
• If you turn on link sharing for one of your folders, anyone with the link can see the folder name and the titles and links of the DMLinks in it (it does not show who you are). Turning sharing off closes the link right away.
• The owner of a link (invite code) sees only how many people came in through it, never who they are.
• We do not give personal information to other companies for their own purposes. (Exception: when required by law)
• We entrust some work needed to run the service to outside companies; they and the international transfers are listed below.

5. Service providers and international transfer

• To provide the service, we entrust the processing of personal information to the overseas companies below. (Basis: Personal Information Protection Act (Korea), Article 28-8(1)(3))
• Supabase Pte. Ltd. (Singapore · privacy@supabase.com)
  • Where: stored in Seoul, Republic of Korea; may be processed in other countries for backups, logs and operational support
  • What: service data such as your account and Library
  • Why: running the servers and database
  • When and how: sent over encrypted connections while you use the service
  • Kept: until you delete your account (backups deleted after 7 days)
• Vercel Inc. (USA · privacy@vercel.com)
  • Where: web servers in Seoul, Republic of Korea; some processing and backups may take place in other countries
  • What: website access logs (request address (including the part after ?), method, response status, time, browser information, referring page, IP address)
  • Why: providing the website
  • When and how: sent over encrypted connections while you use the service
  • Kept: runtime logs are deleted after 1 day (on our current plan)
• Google LLC (USA · https://support.google.com/policies?p=privpol_privts)
  • What and why: sign-in information (email, account ID), Android push tokens and notification content — sign-in and notifications — kept until you delete your account
  • What and why: the AI input in section 3 — topic sorting and review — kept for 55 days
  • When and how: sent over encrypted connections while you use the service
• Apple Inc. (USA · https://www.apple.com/legal/privacy/contact/)
  • What and why: sign-in information, iPhone push tokens and notification content — sign-in and notifications — kept until you delete your account
  • When and how: sent over encrypted connections while you use the service
• 650 Industries, Inc. (Expo, USA · https://expo.dev/contact)
  • What and why: push tokens and notification content — delivering notifications
  • When and how: sent over encrypted connections while you use the service
  • Kept: notification content is not stored after delivery; delivery receipts are deleted after 24 hours
• RevenueCat, Inc. (USA · compliance@revenuecat.com)
  • What and why: account ID, credit purchase records (product, price, currency, country, transaction ID, time) and followDM Plus subscription records (product, period, trial, expiry time, renewal, transaction ID) — confirming app store payments, adding credits, handling refunds and checking subscription status
  • When and how: sent over encrypted connections when you buy credits or subscribe to followDM Plus
  • Kept: for the legal retention period for payment records (5 years)
• Plus Five Five, Inc. (Resend, USA · support@resend.com)
  • Items and purpose: email address and message content — sending service emails such as notices of changes to the terms, and replies to inquiries
  • When and how: sent over an encrypted connection when we send an email
  • Retention: delivery records (including message content) are deleted after 30 days (Resend's policy for our current plan)
• To refuse international transfer you must delete your account, and you will then be unable to use the service.

6. How long we keep it and how we delete it

• Account, Library and notifications: deleted right away when you delete your account
• Account settings and days of use (time zone, language, days of use, device type): deleted right away when you delete your account
• Abuse-prevention records (sign-up time, device ID, network information, save path): deleted right away when you delete your account
• Report records: deleted right away when you delete your account
• Your link (invite code) and records of people who came in through it: deleted right away when you delete your account. Free credit grants and use are deleted with the credit history when you delete your account (payment records for credit purchases are kept for 5 years, as below)
• Usage records: view, visit and verification-request records are unlinked from your account when you delete it and kept for the ranking (network information stays in a form that cannot be reversed). Ad impression and visit records are unlinked from your account when you delete it and kept for ad results.
• Usage records of people who are not signed in: not linked to any account. Network information (an irreversible value) is used only to avoid double counting, apply daily limits (ad impressions and record counts) and estimate ad reach, and is deleted after 8 days; the counts stay for the ranking and ad results
• Server error logs: deleted automatically after 90 days (may contain an account ID)
• Backups: deleted automatically after 7 days
• Information the law requires us to keep: stored separately, only for the period the law requires, and then deleted
• Payment records (credit purchases and refunds): kept for 5 years as required by Korean e-commerce law (Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, Article 6), separately from your account even after you delete it, and then deleted
• Subscription records (followDM Plus): kept for 5 years as required by Korean e-commerce law (Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, Article 6), stored separately from the account after deletion and then deleted
• Links, titles, descriptions and totals needed for the ranking of DMLinks saved by many people may remain for other users, but their link to the deleted account is removed.

7. Your rights

• You can download your data and delete your account in Me in the app, and also delete your account on the web (followdm.app).
• You can turn off notifications in Me → Notifications in the app.
• To access, correct, delete or stop processing your data, or to withdraw consent, email support@followdm.app. (Someone acting for you must attach a letter of authorization.)
• If we cannot do what you ask, we will tell you why and how to object.

8. Under 18

• followDM is not for anyone under 18.

9. Security

• All connections are encrypted (HTTPS).
• The database is locked so that no one but you can read your Library.
• We never store your raw IP address, only an irreversible value.
• Admin functions can be used only by designated operator accounts.

10. Privacy officer

• Privacy officer: Kim Pumjoon (Representative) · support@followdm.app, +82-10-4166-3515

11. Changes

• We announce changes to this Privacy Policy in the app and on the web 7 days before they take effect. Changes that matter for your rights are announced 30 days before, and we also tell you by email or app notification.

12. Where to get help

• If you need advice or help with a privacy problem, you can contact these organizations (Korea).
• Personal Information Dispute Mediation Committee (Korea): 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center (Korea): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office (Korea): 1301 (www.spo.go.kr)
• Korean National Police Agency Cyber Bureau (Korea): 182 (ecrm.police.go.kr)

13. Business information

• The business that runs followDM is as follows.
• Business name: followDM (팔로우디엠)
• Representative: Kim Pumjoon
• Address: #1501, 409-dong, 7 Yeonseo-ro 44-gil, Eunpyeong-gu, Seoul 03309, Republic of Korea
• Phone: +82-10-4166-3515
• Email: support@followdm.app
• Business registration no.: 527-13-03138
• Mail-order business report no.: 2026-서울은평-1142
• Hosting: Vercel Inc.