Privacy Policy

It covers the XPECT web application and the official XPECT Instagram account used for Instagram username verification. XPECT is an independent product and is not affiliated with, endorsed by, or sponsored by Instagram or Meta.

XPECT is operated by Hidden Signal, Inc., a New York corporation (“we”, “us”). Privacy questions may be sent to manager@xpectapp.com.

• Your email address, used for passwordless sign-in (a one-time code) and for service messages about your account.
• The Instagram username you claim as your own, stored both exactly as you typed it and in a normalized form.
• The Instagram usernames you enter as private choices, stored both exactly as typed and normalized, with the time they were added, deactivated or removed.
• Your plan record: plan code, choice limit, start and expiry dates, and status.
• For paid plans, the minimum transaction records needed to fulfil and reconcile your purchase: Stripe customer, checkout and payment identifiers, plan, amount, currency, payment status and timestamps.
• The verification status of your claimed Instagram username, and the time it was claimed or verified.

Standard and Premium are fixed-term, one-time purchases, not auto-renewing subscriptions. Payments are processed by Stripe, which collects your payment details directly. XPECT does not receive or store full card numbers.

We do not collect your Instagram password. XPECT never asks for it and never has access to your Instagram account.

Verification works in one direction only: you send a message from your own Instagram account to the official XPECT account. XPECT never messages anyone.

When you send that message, Meta delivers a signed event to our server containing:

• the time of the message event;
• your Instagram-scoped sender ID (an identifier issued by Meta that is specific to this app).

We then call Meta’s official API to resolve that sender ID to your Instagram username, for the single purpose of confirming that you control the username you claimed. Every event is cryptographically verified before it is accepted; unsigned or incorrectly signed requests are rejected.

The content of your message is not stored. Access credentials for Meta’s API are held only on the server and are never included in any page, response or log.

• To sign you in and keep you signed in.
• To store your private choices so only you can see them.
• To detect when two people have privately chosen each other.
• To confirm that you control the Instagram username you claimed.
• To apply the limits of the plan you selected.
• To fulfil, reconcile and support paid purchases, and to prevent fraud and resolve disputes.

• We do not notify, message, tag or hint to anyone about a one-sided choice. Notifications require mutual selection; identities remain hidden until both people verify.
• XPECT never sends Instagram messages to anyone; verification messages are only ever sent by you, to the official XPECT account.
• We never disclose a one-sided choice to anyone, including the person chosen.
• We do not sell your data and do not use it to build advertising profiles.

A choice you make is visible only to you. If the person you chose has also chosen you, that reciprocal pair creates a potential match. The other person’s username is withheld by the server until the match is confirmed; the underlying match records cannot be read directly by any signed-in user.

Confirmation requires both people to verify control of the Instagram username they claimed, through the official XPECT Instagram account and Meta’s signed webhook and API flow described above.

Data is processed on our behalf by:

• Supabase — authentication and database storage.
• Lovable — application hosting, server logs and error reporting.
• Meta / Instagram — delivery of the verification message event and resolution of the sender ID to a username.
• Stripe — payment processing for Standard and Premium purchases.

We do not sell your data or share it with anyone else, except where required by law. Service providers may process data in the locations where they operate, subject to their own safeguards and applicable law.

Our server logs may record request diagnostics. For verification events, the logs may record whether an event was received, its timestamp, the Meta sender ID and the resolved Instagram username. Message content, access tokens, request signatures and authorization headers are never logged.

If the app encounters an error in your browser, the error message, technical stack trace and the page path may be reported to our hosting provider so the fault can be fixed.

We retain logs and other records only as long as reasonably necessary for operating the service, security, dispute prevention, legal and accounting obligations, or as required by applicable law.

XPECT stores your sign-in session in your browser (in local storage and an equivalent cookie) so you stay signed in. It also stores your in-progress setup details and your account view locally so the app works smoothly between pages.

XPECT uses no advertising cookies, no tracking pixels and no third-party analytics tooling. Clearing your browser storage signs you out and removes the locally stored copy of your data; the records held in our database are unaffected.

• You can remove any private choice at any time from your dashboard. A removed choice is marked as removed and stops taking part in match detection; the underlying record is retained.
• You can sign out at any time, which ends your session and clears the copy of your data held in your browser.
• You are never required to verify your Instagram username in order to create an account.

There is no self-service account deletion in the app today. To request deletion of your account and personal data, email manager@xpectapp.com from the address you sign in with. We may retain limited records where needed for security, fraud prevention, transactions, tax, accounting, disputes or other legal obligations.

XPECT is intended for users who are at least 18 years old. It is not directed at children, and we do not knowingly collect personal information from children.

If this policy changes, the updated version will be published on this page. Material changes will be dated here so you can see when they took effect.

Hidden Signal, Inc. is responsible for this policy. Privacy questions, data access requests and deletion requests may be sent to manager@xpectapp.com.