Facebook does not have the best reputation for keeping in mind users' privacy, and Cambridge Analytica that leverages the social network's third-party APIs for uncontrolled data collection has certainly not helped. Now we have found another service called Ghosty that utilizes Instagram's API to create a pursuer paradise. By collecting the data from all of their users' Instagram accounts, it allows anyone to view many private profiles.

The promise of the app is outlined from the get-go: Just share your Instagram login information with it to access many private accounts. The catch is that you need to invite at least one other person to the service to view private profiles, which is how the app manages to constantly increase the pool of accessible content ̵

1; if any of the users accidentally follow a private profile, it only accesses the account content . However, when we looked at the app, we managed to skip the invitation step and managed to see at least one private profile, so it may only be necessary at a later stage after connecting new users.

Once someone starts using the app, they shamelessly exploit their desire to access more private accounts and make them pay for packages or view ads.

Ghosty is not even a new app – it has been available on the Play Store since April of this year, and it has collected more than 500,000 downloads during that period. This should give it a pretty huge data pool to work with, and it's surprising that neither Google nor Facebook have caught it so far.

To be clear, this app almost certainly breaks more than just one element of Instagram's terms of service, and Facebook probably doesn't approve or support an app that exploits its users like this. In fact, people who enable the service by signing up for it and inviting more friends to join can have the consequences of being banned when the company turns it off. Hopefully, Facebook will respond soon and work to ensure the privacy of anyone who decided not to make their account publicly visible, even if it means getting third-party access more stringent.