Privacy Policy — CreatorSleuth

Last updated: July 25, 2026

1. Who we are

CreatorSleuth is a service that scans the public comments of a YouTube video to detect scam attempts (identity impersonation, fraudulent links, misleading investment promises) targeting a creator's community. Contact: contact@creatorsleuth.com.

2. Data we collect through your Google/YouTube account

• Channel identity: your channel ID (channel_id), channel name, and avatar URL, obtained via channels.list(mine=true). We do not access your email address or personal Google identity (no openid/userinfo.email scope is requested).
• OAuth tokens: the access token and refresh token issued by Google are encrypted (Fernet algorithm) before being stored, and are never displayed in plain text or shared with any third party.
• Public comments on your videos: comment text, the commenter's display name, avatar, and publish date, retrieved via the YouTube Data API (commentThreads.list) when you run a scan.

The only Google scope we request is youtube.readonly (read-only) — no moderation, deletion, or publishing action is ever performed on your channel.

3. How we use this data

This data is used exclusively to run the scam-detection pipeline and show you the results:

• Local analysis (rule-based checks and avatar comparison) to flag suspicious comments.
• For comments flagged as suspicious by this first pass, the comment text is sent to Google's Gemini API (a technical subprocessor, not a commercial third party) to confirm or rule out fraudulent intent. No other personal data is transmitted to this service.
• Results (detected scams) are shown only on your own dashboard, accessible only after signing in with the Google account that owns the connected channel.

We do not sell, rent, or share your data with any advertising or commercial third party.

4. Data retention

Data (scan history, detected comments, encrypted tokens) is kept for as long as your account stays active, so you can access your scan history. You may request full deletion of your data at any time by emailing contact@creatorsleuth.com.

5. Your rights

• Revoke the app's access to your Google account at any time from myaccount.google.com/permissions.
• Request access to, correction of, or deletion of your data by emailing us.

6. Security

OAuth tokens are encrypted at rest. Communication with Google and third-party APIs uses HTTPS. The service is currently in beta and provided as-is — see our Terms of Service.