Why We Don't Track Which Accounts Get Looked Up

If we wanted to, we could easily log every username and profile link that gets pasted into our tools. We explicitly choose not to. Here is a detailed look at why we made that structural choice.

The Reality of Logging

What would tracking look like if we did it? It would be a simple database table recording a timestamp, an IP address, and the target username or URL. This data would actually be incredibly useful to us. It would let us see which accounts are trending, understand usage patterns across time zones, and identify power users.

Many companies collect this exact data under the guise of "improving the service." The problem is that once that data exists, it becomes a liability.

A Target and a Temptation

A database of every lookup performed on Instaustad would be a massive privacy risk. It could reveal who is looking at whom, potentially exposing sensitive investigations, journalistic research, or personal relationships. It becomes a target for hackers and a temptation for data brokers.

By deliberately choosing not to build this database, we eliminate the risk entirely. "We don't track you" isn't just a privacy policy that we could quietly update on a Friday night; it is a structural, technical reality of how our backend operates.

Anonymous Aggregation

Of course, we still need to know if the site is working. Instead of tracking specific queries, we rely on aggregate, anonymous metrics. We know that 10,000 lookups happened today, and we know our error rate is low. But we don't know what those 10,000 lookups were.

It is important to note the distinction between server logs and application databases. Our web servers temporarily retain standard access logs (which include IP addresses) for basic security and DDoS protection, as all websites do. However, these logs are ephemeral and are never correlated with specific user actions or stored long-term in an analytics database.