Processed in your browser
Scans, selections, reports, backups and your license key are kept on your device. Fantomas reads Instagram pages in your own session to act on the items you choose.
FantomasDownload ExtensionWhat stays with you. What we keep.
Fantomas works in your browser, with no account. Its servers only hold what your pass and your counters need.
Pre-release version. The publisher details are completed before launch.
Little on our servers
An anonymous identity, a random key and a label for each browser, the state of your pass, your counters and a pseudonymous key for each Instagram profile. No account and no email.
No message content
Fantomas does not send the text of your messages or comments, your media, your Instagram cookies or your password to its servers.
Your call
Export what our servers hold, or delete it, from “My pass”. What stays on your device is yours to delete: reports in the extension, backups where you saved them, everything by removing the extension.
In your browser
Fantomas runs as a Chrome extension on instagram.com, in the Instagram session you already opened. To list and remove the items you choose, it reads what Instagram shows you and sends Instagram’s own requests with your session. Those requests go to Instagram only. The processing happens on your device.
- Scans and selections stay in the extension’s storage, with the conversation names and usernames needed to show your lists. For comments, the text Instagram displays is kept locally so your “Comment text” filter can work.
- Scan memory keeps identifiers, dates and counters, never message text, so a later check can tell what is new.
- Reports (PDF) are stored in the extension. Backups are ZIP files saved where you choose, not encrypted.
- Your license key is kept in the extension’s storage on this browser.
- Your Instagram cookies are read in the browser to know which profile is signed in, and are only ever sent to Instagram.
On our servers
Fantomas uses a server for your pass and your counters. There is no Fantomas account: the server holds no name, email or password. It holds the following, and nothing about the content of your Instagram activity.
| Data | What it is | Why |
|---|---|---|
| Anonymous identity | Created for you, with no form, the first time you open Fantomas on a signed-in Instagram profile. No name, email or password. | Link this browser to your counters and your pass. |
| Browser installation | A random installation key created by the extension, a label such as “Chrome · Windows” and dates. | Know which of your browsers uses your pass. There is no limit on their number. |
| Linked Instagram profiles | The profile's numeric identifier, sent over an encrypted connection and stored only as a keyed hash (HMAC-SHA-256), with dates and status. Your username is never sent. | Count the removals of each profile, and the profiles a pass covers: 1, up to 3 or up to 5. |
| Pass | A SHA-256 hash of your license key, never the key itself; the Lemon Squeezy license, order, product variant and activation identifiers; the type of pass, its status and its dates; for each browser using it, its label. | Check your pass and when it ends, and handle refunds. |
| Counters | For each profile, the removals used this week on Free or today with a pass and, during a run, a random task identifier with counts. | Apply the free weekly removals and the daily limit of a pass. |
| Anti-abuse register | The same pseudonymous profile key and its usage. | Keep counters per profile, so a reinstall does not reset them. |
| Security log | A log of changes to your pass, your profiles and the browsers that use them. | Protect passes and look into problems. |
| Connection data | Like any online service, our database provider receives technical data such as your IP address. | Deliver the service and limit abuse. |
A keyed hash is a pseudonym: it does not show your identifier, but it is still treated as personal data.
When you activate your license key, it goes through our server to Lemon Squeezy, which confirms it. The label of your browser, such as “Chrome · Windows”, goes with it as the name of that activation. Our server stores only the hash of your key and the details listed above, nothing else from your order.
Payments are handled by Lemon Squeezy, the merchant of record: it processes your payment and invoices, and keeps the email you give at checkout under its own privacy policy. Fantomas never sees your card number and keeps no email address.
Never sent to Fantomas servers
The text of your messages, comments or story replies, your photos and videos, conversation names, usernames, the lists of items you scan or select, your reports and backups, your Instagram cookies and your password.
Why we can process it
- To provide the service you asked for (the contract): your anonymous identity, browser installations, profile links, pass and counters.
- Our legitimate interest in preventing abuse and protecting passes: the anti-abuse register, which keeps counters per profile, and the security log. You can object by writing to support; we then check whether a stronger reason applies.
- Legal obligations: the records that accounting and tax rules require.
Service providers
- Supabase: database and server functions; the database is hosted in the European Union (Paris region).
- Lemon Squeezy: checkout, payment, taxes, invoices, license keys and refunds, as merchant of record.
- Cloudflare: hosting of this website and its domain name. Like any host, it receives technical data such as your IP address when you visit.
Some of these companies are based in the United States. Transfers rely on the EU-US Data Privacy Framework for certified companies, or on the European Commission’s standard contractual clauses.
Retention
- Anonymous identity, browser installations and profile links: until you delete your Fantomas data.
- Pass records (the hash of your key, its Lemon Squeezy identifiers, its type, status and dates, and the labels of the browsers that used it): until the pass ends, then as long as accounting rules require. Deleting your data does not remove them, so your key can activate the pass again.
- Anti-abuse register: kept for 12 months after a profile was last linked, even if your data is deleted, so counters stay per profile.
- Emails to support: as long as needed to handle your request and any refund.
- Local data, your license key included: until you remove the extension. Before that, you can delete reports in the extension and backup files where you saved them. Freeing this browser or deleting your Fantomas data also removes the saved key.
Your rights and choices
- Export everything our servers hold about you, from “My pass” in the extension.
- Delete your data at any time with “Delete my data on Fantomas”, in “My pass”, by typing DELETE to confirm. This removes your identity, its browser installation and its profile links, and this browser stops using your pass. Your pass is not lost: your key activates it again. Instagram, your reports and your backups stay as they are.
- Delete local data yourself: reports one by one or several at once in “Reports”, backup ZIP files where you saved them, and everything Fantomas keeps in this browser by removing the extension.
Deleting your server data and deleting local data are separate actions.
You can also ask to access, correct, delete or receive your data, limit its use or object to it, by writing to support@fantomas-app.com. If you think your rights are not respected, you can complain to the CNIL, the French data protection authority (cnil.fr (opens in a new tab)).
Measurement
The website and the extension use no advertising trackers and no session recording. If audience measurement is added, it will be described here before it is enabled.
Contact
The publisher of Fantomas is responsible for this processing; its details are on the legal notice. Write to support@fantomas-app.com for any question about your data.