Changelog

Renamed the product from UnfollowMap to Unfollio across the site

Public `/privacy-proof` page — shows the literal HTTP request the upload sends, plus 60-second DevTools verification steps

Public `/changelog` page — what you're reading

"Last shipped working" badge on the homepage, switchable to a "degraded" or "broken" state without redeploying when Instagram changes the export

In-context disclosure on the upload page: "ZIP is parsed in your browser. Only follower/following usernames are sent to our server — never the file itself."

Enabled Postgres row-level security policies on every user-data table — defense against direct-from-browser Supabase queries leaking data across users

Atomic audit-commit RPC with per-user advisory lock — concurrent uploads from the same user now serialize instead of race-corrupting state

Zod validation + array-length caps on `/api/audits` payload (max 200k followers / 50k following)

Baseline security headers (HSTS, Referrer-Policy, X-Frame-Options, Permissions-Policy)

Account deletion: a `DELETE /api/account` route + a confirm-typed-"delete" button in Settings, cascading through every table

Dashboard, Timeline, and Watchlist rewritten to read from Supabase directly (previously called a defunct API server and silently returned empty)

Marketing copy now matches what's actually built — removed "encrypted at rest" (false), "7-day free trial" (no payment system), "AI ghost scores" and "churn forecast" (not implemented)

Sign-in flow handles OAuth errors, expired magic links, and missing codes with a friendly error page instead of silently redirecting

Extended the Instagram export parser to extract three more files: `pending_follow_requests.json`, `blocked_profiles.json`, and `recently_unfollowed_accounts.json`

Upload results now include collapsible sections for: your earliest followers (with the date they followed you), pending follow requests, blocked accounts, and recently unfollowed

Most competitor apps gate these features behind a paid plan — they're free in Unfollio

Mark accounts as "viewed" while going through your unfollower list — no more re-checking the same names every time

Tab filter between All / Not viewed / Viewed with live counts

"Mark all viewed" batch action

Backed by per-user database state, so viewed status persists across uploads

Implementation uses functional state updaters with proper rollback on network errors — a similar feature in a competitor app is widely reviewed as buggy ("tabs reset, names keep coming back"); ours doesn't

When someone disappears from both your followers and following lists at the same time, we flag them as "possibly deleted" rather than counting them as a real unfollow

21 unit tests covering the heuristic edge cases (empty lists, case sensitivity, multi-account scenarios)

Watchlist: monitor specific Instagram accounts and see their status across every audit

Google OAuth + magic-link sign-in flow, both routed through a hardened `/api/auth/callback` with open-redirect protection

Middleware refreshes Supabase sessions on every request and redirects unauthenticated users to `/signin?next=...`