CommentSafe
Privacy policy
What we collect from your Google account and your YouTube channel, what we refuse to store, and how to take our access away in one click.
The short version
This is the whole policy in six lines. Everything below it is the same thing in detail, and the detail wins if the two ever disagree.
- Beyond signing you in, we ask Google for one permission: read the comments on your channel, and change a comment’s moderation status. We never post, reply, heart, pin or upload as you.
- Comments we leave public are judged in flight and thrown away. We store the text only for comments we held, hid or rejected — the ones you need to see.
- Stored comment text, author display names and comment ids are deleted after 28 days, automatically.
- We do not sell your data, run ads against it, or use it to train general-purpose AI models.
- You can disconnect at any time. Disconnecting revokes our access token with Google in the same click.
- There is one person behind this product and one email address: [email protected].
Who we are
CommentSafe is a subscription tool that watches the comments on a connected YouTube channel and hides impersonation, phishing, spam and abuse before most of your audience sees them. It is operated by Brass Ridge LLC (“we”, “us”), and it lives at commentsafe.app.
This policy covers the CommentSafe website and the CommentSafe app. It applies to you if you sign in, start a trial, connect a channel, or use the “score a comment” demo on the home page.
For anything about your data — a question, a copy, a correction, a deletion — write to [email protected].
What we collect, and why
We collect the smallest set of things that makes moderation work. Nothing here is optional extra data we keep “just in case”.
| What | Why we have it |
|---|---|
| Your Google account | Your email address, name, profile picture and Google’s subject id for your account. Sign-in uses only the openid, email and profile scopes. We need this to know who you are and which channel is yours. |
| Billing identifiers | Your Stripe customer id and subscription id, the plan status, the trial end date and the renewal date. We use these to know whether your subscription is live, to open your billing portal, and to cancel the subscription if you delete your account. Card details are handled by Stripe and never touch our servers. |
| Your connected channel | The YouTube channel id, title, @handle, avatar URL and subscriber count, read once from your own channel record. We show it back to you so you can confirm we are moderating the right channel. |
| A YouTube refresh token | So the worker can keep checking comments while you are not signed in. Stored encrypted with AES-256-GCM and never sent to your browser. |
| Video metadata | For the uploads we watch: the video id, title, publish date and an occasionally refreshed view count. This is how we know where a comment lives and which videos are worth checking often. |
| Held, hidden and rejected comments | Only for comments we acted on: the comment text, the author display name, the author’s channel id, the comment id, any links we extracted, the four scores, the reason and the action taken. This is your review queue and your history. It expires after 28 days. |
| Daily counts | How many comments were checked, kept, held, hidden, rejected and how many authors were banned, per day. These drive the dashboard charts and our own quota accounting. They contain no comment text and no names. |
| Operational logs | Each decision logs the account id, an irreversible hash of the comment id, the model version, the scores and the action. Our logger is configured to redact comment text, author names and tokens. |
The “score a comment yourself” demo on the home page runs entirely in your browser today. The four numbers come from a small set of keyword rules shipped with the page, and the text you type is never sent anywhere — not to us, not to anyone else. When we swap in the real model, the text you paste will go to TypeSafe to be scored, behind a Cloudflare Turnstile check and a rate limit, and still without being written to our database or attached to you. This page will say so before that happens rather than after.
What we never store
This is the part most tools get wrong, so it is written as a promise rather than a footnote.
- The text or author of any comment we left public. A clean comment is scored in flight and discarded. No row is written. We could not show you your own comment history if you asked, because we do not have it.
- A copy of your comment archive. No full thread dumps, no ingest of your back catalogue, no search across your comments, no export.
- Your card number, expiry or CVC. Those go straight to Stripe.
- Your videos, your analytics, your subscriber list, or your email contacts. We do not request the access that would let us read them.
- Anything you type into the public demo. Today it never leaves your browser at all.
YouTube and Google data
CommentSafe uses YouTube API Services. By connecting your channel you are also agreeing to the YouTube Terms of Service, and Google’s own handling of your data is described in the Google Privacy Policy.
The one permission we ask for
When you connect a channel, Google asks you to grant https://www.googleapis.com/auth/youtube.force-ssl. We use it for exactly two things:
- reading the comments and replies on your channel, including your held queues; and
- setting a comment’s moderation status — hide it from the public, restore it, or reject it — and, only if you switch auto-ban on yourself, banning an author as part of a reject.
It is a broad scope because YouTube does not offer a narrower one that can moderate. We never post a comment, never reply, never heart or pin, never upload, never edit your video details, and never read your analytics. Sign-in on its own asks for none of this; the moderation permission is requested separately, after you have a subscription, and you can take it back at any time.
Google Limited Use
Authorized Data and the 30-day rule
Comment text, author display names and comment ids are Authorized Data under the YouTube API Services Developer Policies. Those policies allow us to keep Authorized Data for at most 30 calendar days before it must be deleted or refreshed. We delete at 28 days, so there is margin even if a nightly job misses a run.
How long we keep things
| Data | Kept for |
|---|---|
| Comment text, author display names, comment ids | 28 days from the moment we store them, then emptied by a nightly job. A history row from before that reads “text no longer stored”. |
| The rest of a history row | The action, the reason, the four scores, the model version, the video id, the timestamp, and a SHA-256 hash of the comment id. The hash is one-way and exists so that we never act twice on the same comment, which is why it outlives the 28-day text expiry. It does not outlive the account: deleting your account removes the whole row, hash included. |
| Queue items | Until you resolve them, or 28 days, whichever comes first. An expired item stays hidden on YouTube and you can still handle it in YouTube Studio. |
| Your account, channel and settings | While your account exists. Deleting the account removes them. |
| Daily counts | While your account exists. They are aggregates — no text, no names, no comment ids — but they are counted per channel, so deleting your account deletes them. What we keep after that is a project-wide daily total of the API units CommentSafe spent, which has no account attached to it. |
| Billing records | Held by Stripe under its own retention rules. Invoices we are required to keep for tax and accounting cannot be deleted on request. |
| Backups | The database is backed up nightly to encrypted object storage. A deleted row can survive in a backup until that backup rotates out; it is never restored into the live system on its own. |
If you cancel your subscription in the billing portal, the worker stops at the end of the period you paid for. Your channel stays connected for 30 days in case you come back, and is then disconnected with the token revoked. Comment text still expires on the 28-day schedule the whole time.
Deleting your account is the short version of all of that: everything in the table above that belongs to you goes at once, and the subscription is cancelled immediately rather than at period end. Deleting your data lists what each route removes and what it costs you.
How to disconnect and revoke access
There are two levers and they do different things.
- Disconnect inside CommentSafe. Settings → Disconnect. We revoke the stored token with Google, delete it, stop every polling job for that channel, and stop listening for your new uploads.
- Remove CommentSafe at Google. Open myaccount.google.com/permissions — the same page Google links from its security settings at security.google.com/settings/security/permissions — find CommentSafe, and remove its access. This works whether or not you can sign in to us.
Nothing in either lever undoes a moderation action. A comment that was already rejected on YouTube cannot be republished by us, by you, or by YouTube support, and a banned author cannot be unbanned through the API. That is a YouTube constraint, not a choice of ours, and it is why the product hides first and rejects later wherever it can.
Who else processes your data
We use a small number of services to run CommentSafe. They are listed with what they actually see, not just their names.
| Service | What it does, and what it sees |
|---|---|
| Google (YouTube Data API, Google sign-in) | Signs you in and carries every action on your channel. Google sees your identity, your channel, and every API call we make on your behalf. |
| Stripe | Runs the subscription, the checkout and the billing portal. Stripe sees your email address, your card details directly from you, and your billing history. |
| TypeSafe | Runs Jev, the model that scores a comment. We send one comment per request: the comment text, the author display name, the video title, your channel title and handle, and the flags we computed. It is sent for scoring only and is not used to train models. |
| Resend | Sends the daily digest and transactional email. Resend sees your email address and the contents of the message, which can include the text of comments in that day’s digest. |
| Cloudflare | DNS for the domain, the tunnel that carries traffic to our server, and the object storage that holds encrypted nightly backups. Cloudflare sees your IP address and request metadata. It will also run the Turnstile check on the public demo once that demo talks to the model; today the demo runs in your browser and makes no request at all. |
| Our own server | A self-hosted machine operated by Brass Ridge LLC. It holds the database described above. It is not a shared host and no third party has an account on it. |
Security
- YouTube refresh tokens are encrypted at rest with AES-256-GCM. The key lives in the server environment, never in the browser and never in our code.
- All traffic to the site and the app is over HTTPS. API keys for Google, Stripe, Resend and TypeSafe are server-side only.
- Access to the production database is limited to the operator.
- Backups are encrypted, and carry the same data the live database carries.
No system is perfectly secure, and we will not pretend otherwise. CommentSafe has not been through a SOC 2 audit or any other certification, and this policy makes no claim of one. If you find a security problem, email [email protected] and we will take it seriously and act quickly.
Your choices and your rights
You can, at any time, without asking us:
- pause the worker, so nothing is checked or acted on until you resume;
- turn off any of the four categories, or turn off the daily digest;
- disconnect the channel and keep the account;
- delete the account entirely from Settings, which cancels the subscription in the same action.
You can also ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete all of it. Email [email protected] from the address on your account and say what you want. We respond within a reasonable time and within any period the law where you live requires, at no charge. If we cannot tell it is you, we will ask before we do anything irreversible.
Depending on where you live, local law may give you these rights formally, plus the right to object to processing or to complain to a regulator. We are a small company and we have not been certified or audited against any specific privacy regime, so we are not going to claim a badge we do not hold. What we will do is honour the requests above for everyone, wherever you are.
Children
CommentSafe is a business tool for channel owners. It is not directed at children under 13, it is not designed for them, and we do not knowingly collect their personal information. If you believe a child has created an account, email [email protected] and we will delete it.
Changes to this policy
The product will change and this page will change with it. The “Last updated” date at the top of the page always moves when the text does.
If a change is material — new data collected, a new subprocessor, a new purpose — we will also try to tell you by email or in the app. Continuing to use CommentSafe after a change is posted means you accept the new version. If you do not, disconnect and delete your account; both routes are described on Deleting your data.