Privacy Policy
Last updated: 5 August 2026
Goose is built around one idea: you bring us a file, we read it, and we give it back to you as something readable. This page explains exactly what we hold, why, and how to make us delete it.
Draft — confirm the sub-processor list before launch. The retention periods and rights below are correct as designed. Section 6 lists the processors we expect to use; it must be checked against what is actually deployed, and a Record of Processing Activities (RoPA) should exist internally before the first real customer.
1. Who is responsible for your data
The data controller is Goose Prod sp. z o.o., ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw, Poland, NIP PL5214122803. For any privacy question or request, email support@gooseprod.com — it reaches a person, not a ticket queue.
2. What we collect
| Data | Why we have it | Legal basis |
|---|---|---|
| Email address and password hash | To create your account and let you sign back in | Performance of a contract |
| Your Instagram data export (the ZIP you upload) | To build your lists — this is the entire product | Performance of a contract |
| The derived lists (usernames from your followers and following lists, and their changes over time) | So you can compare uploads and see what changed | Performance of a contract |
| Subscription status and payment records | To give you access, and to meet Polish accounting law | Contract, and legal obligation |
| Basic technical logs (IP address, browser, timestamps) | Security, abuse prevention and debugging | Legitimate interest |
We do not ask for, receive or store your Instagram password. There is no password field for Instagram anywhere in the product, and we have no connection to your Instagram account.
We never receive your full card number. Payments are handled by Stripe, who act as an independent controller for the payment itself.
3. About the people in your lists
Your export contains usernames of other people. We process them only to produce your report. We never contact them, never notify them, never sell those usernames, and never combine them with data from any other user's upload to build a profile of anybody.
4. How long we keep it
- The uploaded file: deleted within 24 hours. Once we have extracted the followers and following lists, the original archive is removed.
- The derived lists: kept while your account exists, because comparing over time is the point of the product. You can delete them from settings at any moment.
- Your account: deleted on request, and automatically after 12 months of inactivity with no active subscription.
- Invoices and payment records: kept for 5 years, as Polish accounting law requires. This is the one category we cannot delete on request.
- Technical logs: 30 days.
5. Who else sees it
We do not sell personal data, and we do not share it for advertising. We use a small number of processors to run the service, each bound by a data processing agreement:
- a cloud hosting and storage provider, to run the application;
- Stripe, to take payments and manage subscriptions;
- an email provider, to send account and billing messages.
To be finalised before launch: name each provider explicitly here, with the country where the data is stored. Regulators and privacy-aware customers both check this, and a vague list is worse than a specific one.
6. Where your data is stored
We host inside the European Economic Area wherever possible. Where a processor transfers data outside the EEA, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.
7. Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you;
- correct anything that is wrong;
- delete your data (subject to the accounting records noted above);
- restrict or object to how we process it;
- export it in a portable format;
- withdraw consent where processing is based on consent.
Email support@gooseprod.com and we will answer within 30 days, usually much sooner. Most of it you can also do yourself from settings without asking us.
If you think we have handled your data badly, you can complain to the Polish supervisory authority, the Prezes Urzędu Ochrony Danych Osobowych (UODO), or to the authority in the EU country where you live.
8. Cookies
We use cookies that are strictly necessary to keep you signed in and to keep the service secure. These do not require consent. If we later add analytics or advertising cookies, we will ask for your consent first through a banner and list them here.
9. Children
Goose is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will delete it.
10. Security
Data is encrypted in transit and at rest, access to production is limited to the people who need it, and uploads are deleted on the schedule above rather than accumulating. No system is perfectly secure, but the shortest-lived data is the safest data, which is why we hold as little as we can.
11. Changes
If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always shows the current version.
12. Contact
support@gooseprod.com — or by post at ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw, Poland. See also our terms of service.