What CommentCare can do, platform by platform
CommentCare asks each platform only for what comment moderation needs: to know which account it is, to read the comments, and to hide a comment or show it again.
- TikTok: see your profile name and username, list your videos, read their comments and replies, and hide or unhide comments.
- Instagram: see your profile and your posts, read the comments on them, and hide or unhide comments.
- X: read the replies to your posts and the posts they answer, and hide or unhide replies.
- YouTube: read your channel’s comments through the moderator role and remove comments, which YouTube then holds for your review.
What it never does
- It never publishes, edits or deletes your videos or posts.
- It never reads or sends direct messages.
- It never follows, likes, replies or comments for you.
- It never touches your followers, ads, payouts or account settings.
- It never deletes a comment: comments are hidden, and every one can be brought back.
- It does not scrape platforms, sell data or build rankings of creators or audiences.
The fine print of the permissions
Platforms bundle permissions, so two of them reach a little further than what CommentCare does. On TikTok and Instagram the permission for managing comments also covers replying to and deleting comments; CommentCare has no function that does either. On X the permission to read lets an app see the posts and accounts your account can see; CommentCare uses it only for the replies X delivers and the posts they answer.
No video or audio files are downloaded or sent anywhere. The AI check works with comment text, the commenter’s username and the caption of the video or post.
Everything is reversible
A hidden comment stays on the platform, out of public view, and its author is not told. The dashboard shows every decision with its reason, and on TikTok, Instagram and X you restore a comment there with one click. On YouTube a removed comment waits under “Held for review” in YouTube Studio, where you approve it again.
A platform’s own moderation or an account restriction can still keep a comment from coming back; that is outside CommentCare’s control.
How access and data are protected
The access tokens of TikTok and X accounts are encrypted at application level with AES-256-GCM, stay on the server and are never shown, exported or logged. For Instagram, CommentCare holds no access token at all: SocialAPI, a provider in the EU, keeps it and states that it stores it encrypted.
Your CommentCare password is stored only as a hash (scrypt), and sessions use hashed random tokens in HttpOnly, Secure and SameSite cookies. The website talks to a separate authenticated backend; API credentials stay on the server and are not part of browser code.
Account data is scoped to the signed-in owner. The API and the database run in the EU (Amsterdam). Contact us with questions about the measures described here.
AI assists. You stay in charge
Comments are assessed through OpenAI’s API, which returns a suggested action, a category and a confidence score. It receives the comment’s text, the commenter’s username and the context needed to judge it, such as the caption and the comment being answered; never a password or an access token. Requests are made with storage switched off, and OpenAI states that API data is not used to train its models by default.
A confidence score is a model output, not a guarantee of accuracy. Only decisions above the threshold are acted on, and uncertain comments stay. AI can be wrong, which is why every decision is visible and can be undone.
Disconnecting and reporting a concern
You can disconnect any account under Settings → Social accounts. That deletes the stored connection and its saved comments from CommentCare’s active database. You can also remove the access on the platform itself: under connected apps on TikTok, Instagram and X, and under moderators in YouTube Studio. See the deletion instructions for full account deletion, usage records and backups.
For a suspected security issue, contact the operator using the contact page. Describe the affected feature and the time of the incident. Do not send passwords, access tokens or other people’s private data.