Security

Last updated: July 2026.

Architecture choices that reduce risk

• No credentials to steal:we never collect social media passwords, so a breach can’t leak them.
• Local-first processing: your export is parsed in your browser. Raw archives are never stored.
• Minimal data model: saved snapshots contain usernames and follow flags — not messages, photos, or contact info.
• Sensitive values are reduced before they can be stored: a TikTok export’s account-access records are read in memory only. IP addresses become a distinct-address count, device model strings become a coarse family label, and the raw values are discarded when parsing ends. There is no code path that writes a raw address or device identifier to storage, sends one to a server, logs one, or places one in shared output.
• Analytics that cannot carry your data: product analytics are first-party — no external collector — and an event may only carry properties drawn from a fixed vocabulary, each restricted to a fixed set of values. There is no free-text property, so an archive value, a username, a file name, a search term or an authentication token cannot be expressed in an analytics event, let alone stored. The browser strips anything unrecognized before sending, and the server rejects it again on arrival.
• Error reports are sanitized before they leave the tab: quoted strings, email addresses, handles, long tokens, query strings and file or blob URLs are removed from the message, and a stack trace is reduced to function names plus the last two path segments. No raw exception payload is ever transmitted or stored.

Categories the parser refuses to open

Message contents, autofill identity details, payment instruments, saved addresses, wallet and coin-purchase records, and device or advertising identifiers are matched by path and refused before any value is read. Unfollo records only that the category was present and skipped. This is enforced in the parser itself, not by convention, and is covered by tests.

Technical measures

• TLS for all transport; HSTS in production.
• Upload hardening: size caps, ZIP-bomb protection (entry count, per-entry and total decompression limits), path-traversal filtering, and no execution of uploaded content.
• Strict security headers and a restrictive Content-Security-Policy.
• ORM-parameterized queries; no raw HTML rendered from imports.
• Secrets kept in environment configuration, never in the client bundle.
• Authorization checks on every account-scoped operation.
• Owner-only surfaces (/admin) and analytics endpoints are authorized on the server, served with Cache-Control: private, no-store and noindex, nofollow, and answer 404rather than confirming they exist. Every privileged read of an individual account’s analytics is written to an audit log.
• Analytics ingestion is rate limited, size capped, schema validated and deduplicated, and bot traffic is classified and excluded from business metrics rather than silently dropped.

Reporting a vulnerability

Email [email protected]with “security” in the subject. We commit to acknowledging reports within 72 hours and will credit responsible disclosure if you’d like.