1.Data we receive and where it comes from
You provide your email address, password and support messages directly. We store a password hash, not the readable password. Browsers and hosting services provide technical information such as IP address, request time, browser details and error information.
After you authorize TikTok, its API supplies account identifiers and username; access and refresh tokens; video identifiers, captions, thumbnail URLs, publication times and comment counts; and available comments and replies, including identifiers, text, usernames, timestamps and visibility. These comments originate from people using TikTok, who may not have a CommentCare account.
If you protect a YouTube channel on the VIP plan, you add CommentCare’s moderator account as a moderator of that channel in YouTube Studio. Through that access we read the channel’s public name, handle and picture, its videos’ titles and identifiers, and its available comments and replies, including their text, author names and handles, timestamps and moderation state. We do not receive your Google password or any access beyond the moderator role, and we do not download video or audio files. The separate YouTube API comment-review service at youtube.commentcare.app connects through Google authorization instead and has a dedicated privacy notice linked below.
If you connect an X account on the VIP plan, you sign in on X and authorize CommentCare’s X app there. X then supplies the account’s identifier, username and profile picture, access and refresh tokens, and each direct reply to the account’s posts as it is posted: the reply’s identifier, text, language and time, its author’s identifier and username, the conversation it belongs to and the text of the post it answers. These replies originate from people using X, who may not have a CommentCare account. The authorization lets CommentCare see posts and accounts that the X account can see and hide or unhide replies to its posts; it does not allow posting, liking, following or reading direct messages, and we do not receive your X password. X does not deliver replies from protected accounts or replies to other people’s replies.
If you connect an Instagram account on the Pro or VIP plan, you sign in on Instagram’s own page and approve the access there. The connection runs through SocialAPI, a provider that operates the Instagram app used for it, so Instagram’s page names that app (“Social Media Connector”) instead of CommentCare, and SocialAPI, not CommentCare, receives and keeps the Instagram access tokens. Through SocialAPI we receive the account’s identifiers, username, name and profile picture and, from then on, each comment and reply written on the account’s posts and reels: its identifier, text and time, its author’s identifier and username, the comment it answers and the post it belongs to, with that post’s caption, link and preview picture. These comments originate from people using Instagram, who may not have a CommentCare account. Your own comments and replies are not saved, and comments written before you connected are not collected. Instagram’s page can list more permissions for that app than CommentCare uses, such as publishing or messages. CommentCare uses the connection only to see your profile and posts and to read, hide and unhide comments: it never posts or publishes, never answers or deletes comments and never reads or sends messages, and we do not receive your Instagram password. Instagram offers this kind of connection to professional accounts (business or creator).
We create scan status, usage counts, protection preferences and moderation records, including AI categories, confidence scores and hide/restore outcomes. Providing account details is necessary to create an account; connecting a platform account is necessary to review that platform’s comments. You can browse public pages without connecting.
When you buy a plan, we store the plan, its status and billing period, and the payment provider’s membership and customer identifiers: Whop, or Stripe for earlier subscriptions. We do not receive full card details.
If you choose to connect an external AI chat through our optional MCP connector, we store the connection, the permissions you granted, a separate per-connection position for “new comments” checks, and any comment-hide requests and decisions. Access tokens are stored only as hashes. You can disconnect the chat in your account settings.
If you use the built-in assistant, we store your messages, its replies, the comments it showed you and any hide or restore you confirmed there, together with a daily message count. You can delete a conversation at any time from the chat history.
If you use the CommentCare iPhone app, you sign in to your existing account; the app does not create accounts. For each phone that is signed in we store the address Apple gives the app on that phone for notifications (the device token), the phone’s time zone, language setting and model, the app’s version, and when the app was first and last used there. We store which notifications you chose and, for 30 days, the notifications sent to you. The app contains no advertising or analytics software from other companies and does not access your contacts, photos or location.
For creators who use the app, CommentCare prepares a weekly and a monthly recap of the comments on their connected accounts and protected channels: figures taken from the saved moderation records and a summary written by AI, with quoted comments. We record when you first open a recap. You can switch either recap off in the app’s settings.
2.Why we process information
Account creation, authentication, requested support and delivery of the service rely on performance of a contract or requested pre-contractual steps (Article 6(1)(b) GDPR). General business enquiries and operational security rely on legitimate interests in responding to messages, preventing abuse and keeping the service reliable (Article 6(1)(f)). Applicable record-keeping obligations rely on Article 6(1)(c).
The iPhone app, its sign-in, recaps and notifications are part of the service you ask for (Article 6(1)(b) GDPR). Notifications appear only if you allow them in iOS; you can switch each kind off in the app, or all of them in the iOS settings, at any time.
For moderation performed on behalf of a creator, we follow their instructions. The creator must identify a lawful basis and provide required information to their commenters. Connecting through OAuth is technical authorization; it is not consent from everyone who comments.
For YouTube, we use channel data only to identify the protected channel, read its available videos and comments, assess them under your settings, remove comments that match them through the moderator access and show you what was checked and removed. In the separate YouTube API service, we use authorized Google data only to read the connected channel’s videos and comments, generate review suggestions and carry out the moderation actions the owner selects; the Google permission there is broader than the actions CommentCare performs. We do not publish, edit or delete videos, captions or ratings, and we do not reply to comments.
For X, we use the authorization only to identify the connected account, receive the replies to its posts, assess them, hide replies that match and show a hidden reply again when you ask. We do not read your timeline, lists, bookmarks or messages, and we do not post, repost, like, follow, block or mute. In line with X’s rules for developers, content received from X is not used to train AI models.
For Instagram, we use the connection only to identify the connected account, receive the comments on its posts and reels, read those posts’ captions, assess the comments, hide comments that match your settings and hide or show a comment again when you ask. We do not read or send direct messages or read insights, and we do not post, publish, answer comments or delete anything.
We do not sell comment data, use it to build advertising audiences or use it to train our own AI models. On the public landing page, and only if you allow it there, Whop’s advertising pixel shows us which of the advertisements we run through Whop lead to visits and purchases (see section 6); it is never loaded in sign-up, onboarding or the dashboard and never receives comment data. We use cookie-free Vercel Web Analytics on the public landing page; login, onboarding and dashboard routes are excluded.
3.How AI moderation works
For TikTok classification, OpenAI’s API receives batches containing comment text, commenter usernames, internal comment identifiers and the related video caption and video identifier. We do not send passwords, TikTok access tokens, video files or audio to the classifier. AI output includes an action, category, confidence score and optional protection signals.
Protection of a TikTok account starts when it is connected. Its first check also analyzes up to 1,500 of the most recent available comments and replies, starting with the newest videos; high-confidence matches among them, as among new comments, can be hidden under the selected rules. False positives and missed spam are possible. Creators can inspect the activity and request restoration; commenters can request review by contacting the creator or us.
On YouTube, CommentCare reads a protected channel’s available comments and replies a few times a day, uses AI to assess them under your settings and removes comments that match through YouTube’s moderator controls. YouTube holds removed comments for review in YouTube Studio, where you can approve them again. In the separate YouTube API service, AI only suggests comments and the owner decides which to hide; a rejection there may not be reversible.
For YouTube assessment, OpenAI’s API receives the comments’ text and author names and the context needed to judge them, such as the video title and the comment being replied to. We do not send Google passwords, moderator-account credentials or OAuth tokens to OpenAI.
On X, CommentCare assesses each reply shortly after X delivers it and hides replies that match the standard protection (spam, scams, bots and impersonation) with X’s hide-reply function. A hidden reply stays on X behind “hidden replies”; you can show it again in the dashboard or on X. X allows hiding only in conversations you started and limits how many replies an account can hide in a quarter of an hour, so a wave of replies can take longer. For this assessment, OpenAI’s API receives the reply’s text, its author’s username and the text of the post it answers. We do not send X tokens to OpenAI.
On Instagram, CommentCare checks new comments at your plan’s scan interval under the standard protection against spam, scams, bots and impersonation, which on Instagram also covers coordinated waves of near-identical comments and accusation words in disguised spelling, together with the extra categories you switched on and your own rules. Comments that match are hidden on Instagram through SocialAPI, with Instagram’s own function for hiding comments. A hidden comment is not deleted: it stays on Instagram, out of public view, and you can show it again in the dashboard. Comments written before you connected are not analyzed. For this assessment, OpenAI’s API receives the comment’s text, its author’s username, an internal identifier, the caption of the post, for an answer the comment it answers, and, where earlier comments under the same post resemble it, a few of those comments with their authors’ usernames, so that a wave of near-identical comments is recognized. Instagram access tokens are never sent to OpenAI; CommentCare does not hold them.
This is automated content moderation, not a system intended to decide eligibility for employment, credit, healthcare or similar significant matters. A confidence score is not a guarantee of accuracy.
The built-in assistant sends your question, the recent conversation and the saved account details, comment text, commenter names, video and post captions and counts it looks up to OpenAI’s API to write a reply. It only uses data CommentCare already stores and never fetches additional comments from TikTok or Instagram. It can suggest hiding or restoring comments, but nothing changes on TikTok or Instagram until you confirm.
For a recap, OpenAI’s API receives the period’s figures, the captions and comment counts of the most commented videos, a sample of at most 400 comments for a week or 600 for a month that were kept as genuine, without their authors’ names, and up to 40 hidden comments with the category they were hidden for. An author’s name is included only where the name itself was the reason for hiding. The figures in a recap are counted from our records and are not written by AI. A period with fewer than 20 checked comments gets a recap without AI.
Classification and recaps use the Responses API with storage of application state disabled. OpenAI states that API inputs and outputs are not used for training by default. Abuse-monitoring records may still be retained for up to 30 days, or longer where legally required.
4.Recipients, Google/YouTube data sharing, X and Instagram
Vercel hosts the website and server-side frontend. Railway hosts the API and PostgreSQL database; the deployed backend and database are in Amsterdam. OpenAI supplies AI classification. TikTok, YouTube and X supply data for their respective authorized connections and receive moderation requests only as described here; for X, that is the request to hide a reply or to show it again, identified by the reply’s identifier. Namecheap forwards domain email to the operator’s Gmail inbox, processed by Google. Resend delivers transactional account emails, including password-reset messages, and processes the recipient email, message content and delivery status.
For Instagram, SocialAPI (social-api.ai), operated by EP ENTREPRISE, a business registered in France, works for us as a processor. It operates the Instagram app you authorize, keeps the Instagram access tokens, receives the comments on your posts and reels from Instagram and passes them to us, and sends Instagram our requests to hide a comment or to show it again, identified by the comment’s identifier. SocialAPI states that it hosts its service in Germany, stores the tokens encrypted and processes this data only on its customers’ instructions. Instagram is operated by Meta, supplies the data for the connection and processes it under its own policies.
For Google user data received through the separate YouTube API service, we share data only with the following recipients to provide its authorized comment-review service: Railway hosts the API and database and processes the connected channel identifier and name, encrypted OAuth tokens, video details, comments and replies, and saved moderation records. Vercel hosts the web interface and its server-side requests, which process the account session and the channel, video, comment and review data shown to the signed-in channel owner. OpenAI receives only an internal comment identifier, comment text, the author name and any parent-comment text for AI classification; it does not receive Google credentials, OAuth tokens or video details.
In that service, Google and YouTube receive the API requests needed to read the authorized channel and its comments and, only when the channel owner selects a comment to hide, a request identifying that comment and the chosen moderation status. Authorized CommentCare personnel may access Google and YouTube data only as needed to operate the service, provide requested support or meet legal duties. We do not sell this data, disclose it for advertising, use it to train our own or third-party general-purpose AI models, or pass it to a connected external AI chat through the YouTube service. Other disclosures are limited to those required by law or described in this notice. Google and YouTube process data under their own policies.
Authorized operator access is limited to operating the service, handling support, the daily comment check on the VIP plan and meeting legal duties. Information may also be disclosed to professional advisers or authorities where necessary and legally justified. When you choose a paid plan, Whop Inc. processes your checkout, payment details, billing address and tax information and handles receipts, fraud prevention, disputes and payment support, including for its own legal obligations, as described in Whop’s privacy policy. We send Whop an internal account identifier, a checkout identifier and the chosen plan, and receive your Whop membership and user identifiers, plan, status and billing period, which we retain to manage access. If you connect a Whop account to use a plan bought on CommentCare’s Whop store page, Whop’s sign-in confirms that account’s Whop user identifier to us; we use it to find and link your CommentCare plans bought with that Whop account, now and later, and we do not keep Whop’s sign-in token. Card details are entered on Whop and are not stored by CommentCare. If you allow Whop’s advertising pixel on the public landing page, Whop also receives the data described in section 6. For subscriptions purchased earlier through Stripe, Stripe and, for Sold through Link purchases, Link continue to process payment information as described in their privacy notices. If you use Google or Apple sign-in, that provider authenticates you and supplies your account identifier and available verified email address.
Apple delivers the iPhone app’s notifications through the Apple Push Notification service. For each notification Apple receives your phone’s device token and the notification’s title and text. These are CommentCare’s own fixed sentences, some with the name of your connected account or channel; they contain no comment text. Apple also distributes the app through the App Store and TestFlight and processes installation and diagnostic information under its own privacy policy, as a controller in its own right.
Some providers process personal data outside the EEA, including in the United States. Contact hello@commentcare.app for details of the applicable transfer arrangements and copies of relevant safeguards.
An AI chat that you explicitly connect through MCP can receive the saved account details, comment text, commenter names, video context and moderation records you request through its tools. You can grant review-only hiding, which requires your confirmation on a signed-in CommentCare page, or separately opt in to direct hiding from chat without that page. The chat provider processes what it receives under its own terms and privacy notice, which you should review before connecting. CommentCare does not give it TikTok credentials or fetch additional comments for it. Disconnecting stops future access; data already sent to that provider is subject to its own retention rules.
5.Retention and removal
Settings provides a JSON export of the application data associated with your account, including protected YouTube channels and their saved comments, connected X accounts with their saved replies and the notes about authors whose replies you showed again, connected Instagram accounts with their saved posts and comments, the phones signed in to the iPhone app (without their device tokens) and your recaps. The export excludes password hashes, API tokens and session secrets. For access to data in the separate YouTube API service, contact hello@commentcare.app. Contract-version acceptance is recorded with your account ID and timestamp; IP addresses are not added to that record. A separate deletion ledger retains only the deleted internal account ID and deletion time so restored backups can be screened before use; it is retained until affected backups have expired and deletion checks are complete.
Account records are held while your CommentCare account exists. An hourly retention task removes processed comment text, commenter usernames and detailed detection signals once 90 days have passed since collection. Comments awaiting processing are excluded until their pending action is resolved. Minimal comment IDs, video references and decision metadata remain while the connection exists to prevent duplicate scanning and charging. These identifiers remain personal data; this is minimization, not anonymization. When webhook ingestion is enabled, pending comment notifications are stored for scheduled moderation. Their text is cleared after ingestion or after 90 days if not processed; minimal event identifiers and state remain until disconnection to prevent duplicate or out-of-order actions. Imported video metadata remains for monitoring until disconnection. Disconnecting deletes the connection, tokens, videos and comments from the active database. Account-level usage records can remain until full account deletion.
For YouTube channels protected through the moderator account, comment text, author names and detailed signals are removed 90 days after collection, keeping minimal decision records. Disconnecting a channel in CommentCare deletes its saved videos, comments and check records from the active database; remove CommentCare as a moderator in YouTube Studio as well. In the separate YouTube API service, saved video and comment data are refreshed or removed within 29 days, and disconnecting removes its connection, tokens, videos and comments and initiates revocation of its Google authorization; you can also revoke access in your Google Account at https://myaccount.google.com/permissions. Revocation at Google stops future access but does not itself delete data already saved in CommentCare; disconnect or contact us for that. Comments already removed or rejected on YouTube are not automatically restored. Provider backups and records required by law may have separate retention periods.
For connected X accounts, a saved reply, with its text, its author’s username and the decision, is deleted 30 days after it was received; only its count toward your allowance remains. When you show a hidden reply again, we note that author’s X identifier and the date, nothing they wrote, so that the author’s later replies are not hidden again for repeating your post. The note is deleted one year after you last showed a reply of that author again, when you hide a reply of that author yourself, and when you disconnect the X account. Disconnecting an X account in CommentCare ends X’s deliveries, asks X to revoke the authorization and deletes the account’s tokens, saved replies and these notes from the active database at once. You can also remove CommentCare on X under Settings → Security and account access → Apps and sessions → Connected apps; that stops future access but does not itself delete replies already saved, so disconnect in CommentCare as well. Replies already hidden on X stay hidden until you show them again on X.
For connected Instagram accounts, a saved comment, with its text, its author’s username and the decision, is deleted 90 days after it was received; only its count toward your allowance remains. The saved details of a post are deleted once they are 90 days old and no saved comment belongs to the post. Disconnecting an Instagram account in CommentCare ends the connection at SocialAPI and deletes the account and its saved posts and comments from the active database at once; SocialAPI states that it then revokes the Instagram authorization and deletes the data it holds for the account within 30 days. You can also remove the app (“Social Media Connector”) in Instagram’s settings under Website permissions → Apps and websites; that stops future access but does not itself delete comments already saved, so disconnect in CommentCare as well. Comments already hidden on Instagram stay hidden until you show them again on Instagram.
Browser sessions expire after at most 30 days and are invalidated by logout. A session of the iPhone app lasts up to 180 days from its last use; signing out in the app ends it and removes that phone’s device record. Temporary authorization and password-reset records have short expiry times and are cleaned up at least hourly, independently of the scanning worker. Provider operational logs and backup copies have separate retention arrangements. Contact us for details relevant to your data.
A phone’s device record is also removed when Apple reports its token as no longer valid, and with your account. Notifications sent to you are deleted after 30 days; a notice about a problem goes earlier, once the problem is solved. A recap is deleted 90 days after the period it covers, like the text of the comments it quotes, and the content of your saved recaps is deleted when you disconnect an account or channel. The one-time code that hands a Google or Apple sign-in to the app is stored only as a hash and expires after two minutes.
MCP access tokens expire after one hour; refresh tokens expire after 30 days and are rotated when used. Disconnecting a chat revokes its active access. Authorization codes and hide previews expire after ten minutes, and expired records are deleted by the retention task.
Built-in assistant messages and the suggestions shown in them are deleted by the retention task 30 days after they were written. Daily message counts are deleted after a week.
For support correspondence, we assess continued need by the unresolved enquiry, evidence needed for a dispute and applicable statutory obligations. In response to a verified deletion request, we identify the affected active records, backup copies and provider records and explain any lawful exceptions or remaining retention.
7.Your rights and how to exercise them
Where the relevant conditions apply, you may request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests on grounds relating to your situation. If processing relies on consent, you can withdraw it without affecting earlier lawful processing. We do not currently use your data for direct marketing.
Email hello@commentcare.app. We may request only proportionate information to verify identity and locate records. Requests are generally free and answered without undue delay, normally within one month. For a permitted extension of up to two additional months, we explain the reason within the first month. Refusals must also be explained, including the available remedies.
Commenters can contact the creator directly or send us the creator username, video link and identifying comment details. You do not need a CommentCare account. When the creator is controller, we assist them with the request.
8.Google/YouTube data security, age and updates
CommentCare accounts are intended for adults. Comments can nevertheless include information about minors. Do not deliberately submit sensitive information unrelated to moderation. Contact us if information about a child needs review.
Connections between your browser and our web interface, and requests from our services to Google and OpenAI, use HTTPS/TLS. In the separate YouTube API service, Google OAuth access and refresh tokens are kept on the server, encrypted before database storage with AES-256-GCM and never sent to the browser or OpenAI. The same holds for the access and refresh tokens of a connected X account: they stay on the server, encrypted, are used only for requests to X and are never shown, exported or logged. For Instagram, CommentCare holds no access tokens: SocialAPI keeps them and states that it stores them encrypted with AES-256-GCM, and CommentCare’s keys for SocialAPI stay on the server. Comment and channel records are held in the application database; signed-in sessions and account-ownership checks restrict access to the connected channel owner. Session tokens are stored as hashes, and production session cookies are HttpOnly, Secure and SameSite=Lax. OAuth authorization uses a short-lived state and PKCE. Access by service personnel is limited to operational, support and legal needs.
Passwords are hashed. These measures reduce the risk of unauthorized access but do not guarantee absolute security. Report suspected incidents through our contact page without sending credentials.
The date above identifies this notice version. We will communicate material changes through the service and, where appropriate, directly to account holders before new processing begins.
9.Who is responsible
Theodor Conrad Borth operates CommentCare from Zehenthofgasse 37, 1190 Wien, Austria. Contact: hello@commentcare.app. CommentCare is the new name of Stillkind and is not a separate legal entity. Our TikTok integration continues to appear as Stillkind.
We act as controller for our website, account administration, security and support. When we process a connected creator’s TikTok, Instagram or YouTube comments or the replies to their X posts on their documented instructions, the creator determines the moderation purpose and is the controller; CommentCare acts as processor. Our separate Data Processing Agreement covers that relationship. This notice does not replace that agreement.