SpamCut Privacy Policy

Effective date: October 7, 2026

SpamCut ("we", "the service") at https://killspam.filca.store helps creators moderate spam comments on their own YouTube channel and Instagram professional account. This policy explains what data we access, how we use, store, and share it, and how you can delete it.

1. YouTube API Services

SpamCut uses YouTube API Services. By using SpamCut you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

2. Data we access

When you sign in with Google, you grant SpamCut the scope https://www.googleapis.com/auth/youtube.force-ssl. With it we access only:

• Your channel ID, channel title, and the ID of your uploads playlist.
• The list of videos you uploaded (video ID, title, publish date).
• Comments and replies on your videos: comment ID, text, author display name, author channel ID, publish time, like count, and moderation status.
• OAuth access and refresh tokens issued by Google.

We do not request your email address, contacts, or any other Google data.

When you connect an Instagram professional account, you grant SpamCut the permissions instagram_business_basic and instagram_business_manage_comments through the Instagram API with Instagram Login. With them we access only:

• Your Instagram account ID and username.
• The list of your posts (media ID, caption, permalink, publish time, comment count).
• Comments and replies on your posts: comment ID, text, author username, publish time, like count, and whether the comment is hidden.
• The access token issued by Instagram.

We do not access your direct messages, followers, insights, or any other Instagram data, and we never publish content.

2-1. SpamCut browser extension and SpamCut accounts

The SpamCut browser extension works on the YouTube and Instagram pages you open in your own browser. It does not use the YouTube Data API or the Instagram API, and it does not use your Google or Instagram sign-in with SpamCut. Its rule-based check runs entirely in your browser and sends nothing to us.

The optional AI check needs a SpamCut account. If you create one, we collect and store:

• Your email address.
• Your password, only as a salted scrypt hash. We cannot read it.
• Sign-in tokens, only as SHA-256 hashes.
• How many comments you had checked today, to apply the daily limit.

When you run the AI check, the extension sends the text of the comments on the page you are checking (at most 500 characters each, without author names, IDs, or links to the page) to our server. Our server forwards those texts to our AI provider, TypeSafe (api.typesafe.ai), which returns for each comment how likely it is spam, abuse, or sexual content. We do not store or log the comment texts; they pass through our server only to produce that answer. Nothing is sent unless you are signed in, have turned the AI check on in the extension, and start a check.

The AI check is never applied to data obtained through the YouTube Data API or the Instagram API in the dashboard. Data from those APIs is not sent to TypeSafe or any other AI provider.

2-2. SpamCut for Mac

SpamCut for Mac opens YouTube and Instagram in a web view inside the app. You sign in to those sites yourself in that web view; your passwords and cookies stay in the app on your Mac and are never sent to us. Collecting, checking with rules, and deleting comments all happen on your Mac. This is what we keep.

When the app first runs it asks our server for a number. We keep, under that number: how much of the free daily allowance has been used today, the prepaid credit left and how much has been bought in total, the orders paid for it, and, for each day of the last 90 days, how many comments and how many checks were run and how many characters of free allowance and credit they used. These are counts only: no comment text, author, link or ID is kept. We do not receive your name, email address or Apple ID. If you link an email address (to use the account on another Mac), we keep that address and the account is then found by it.

The number is not tied to you personally, and accounts that have no credit, no orders and no email and are not used for 60 days are deleted. You can delete the account yourself in Settings > Account, which erases the usage counts and the credit; payment records (order number, amount, date) are kept as required by law, without any email address.

When you run the AI check, the app sends the text of the comments on the page you are checking (at most 500 characters each, without author names, IDs, or links) to our server, which forwards them to TypeSafe exactly as described in section 2-1; we do not store or log the comment texts, and nothing is sent unless you have turned the AI check on and started a check. If you buy credit, you enter your mobile phone number on the payment page; PayApp requires it, and we keep it with the order only as long as needed for the payment and refund process (section 12).

3. How we use the data

• To show you the comments on your videos that match your spam rules.
• To change the moderation status (held for review, or rejected) of YouTube comments, or to hide or delete Instagram comments, only when you have enabled the consent setting in the dashboard and clicked "Apply" for the comments you selected.
• To keep logs of the actions you took, so you can audit them.
• For SpamCut accounts: to sign you in to the browser extension, to apply the daily AI check limit, and to answer the AI checks you start.

We do not use the data for advertising, we do not sell it, we do not use it to build profiles, and we do not use it to train artificial intelligence or machine learning models. We do not combine data from different users' channels or accounts.

4. Data protection and security

We protect the data we obtain from Google (YouTube API Services) and Meta (Instagram API), including sensitive data such as OAuth tokens and the comment data of your channel, with the following mechanisms:

• Encryption in transit: all traffic between your browser and SpamCut, and between SpamCut and the Google and Meta APIs, uses HTTPS (TLS). Plain HTTP requests are redirected to HTTPS and HSTS is enabled.
• Encryption at rest: Google OAuth refresh tokens and Instagram access tokens are encrypted with AES-256-GCM before they are stored. The encryption key is kept separately from the data, in a server configuration file that only the service can read.
• Access control in the service: you can only see and act on the data of the account you signed in with. Sessions use a signed, HttpOnly, Secure cookie, and the sign-in flow is protected against request forgery with a signed state value.
• Server access: data is stored on a single server in South Korea (Naver Cloud Platform). The application runs under a dedicated unprivileged account, listens only on the local interface behind the HTTPS proxy, and the stored data is not reachable from the web except through the signed-in service. Administrative access to the server is limited to the operator; no other person or third party has access.
• Data minimization: we request only one Google scope, store only the data listed in section 2, and never store your Google password or email address.
• Limited retention and deletion: data is deleted automatically after at most 30 days, and immediately when you disconnect (sections 5 and 7).
• Passwords and sign-in tokens of SpamCut accounts are stored only as hashes (salted scrypt and SHA-256), never in readable form.

If we become aware of unauthorized access to your data, we will revoke the affected tokens and inform the affected users through the service without undue delay.

5. Retention

• Scan results, comment data, and action logs are kept for at most 30 days and then automatically deleted.
• If Google reports that your authorization is no longer valid (for example you revoked it in your Google Account), we delete all of your data at the next daily check, and in any case within 30 days.
• The same applies to Instagram: if the Instagram token expires or is rejected, or Meta notifies us that you removed SpamCut, we delete your Instagram data.
• SpamCut account data (email, password hash, sign-in token hashes, today's usage count) is kept until you delete the account. Comment texts sent for the AI check are not kept at all.
• Website-download accounts: the usage counts per day are kept for 90 days; the account (number, credit, orders) is kept until you delete it or, if it has no credit, orders or email, until it has gone unused for 60 days.

6. Sharing

We do not sell your data or share it for advertising. Data is sent only to Google (YouTube Data API) and Meta (Instagram API) to perform the actions you request, and, when you run the AI check in the browser extension or in SpamCut for Mac, the comment texts you chose to check are sent to TypeSafe as described in section 2-1. Your email address and account data are never sent to TypeSafe. We may disclose data if required by law.

7. Your choices and deletion

• Disconnect in SpamCut: the "Disconnect and delete my data" button in the dashboard revokes our Google authorization and immediately deletes all your data (tokens, scans, logs).
• Revoke in Google: you can revoke SpamCut's access at any time at https://security.google.com/settings/security/permissions.
• Disconnect Instagram in SpamCut: the "Disconnect Instagram and delete its data" button deletes the stored Instagram token and all your Instagram data (scans, logs) immediately.
• Remove in Instagram: you can remove SpamCut under "Apps and websites" in your Instagram settings. Meta then notifies us and we delete your Instagram data.
• Delete your SpamCut account: in the extension's toolbar menu, open "Account" and choose "Delete account". The account and everything stored for it are deleted immediately. Signing out removes the sign-in token from your browser.
• Turn the AI check off: the extension's settings have an AI check switch. While it is off, no comment text leaves your browser.
• Email request: write to 3kbrotherteam@gmail.com and we will delete your data within 7 days.

8. Google API Services User Data Policy

SpamCut's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Cookies

We use one session cookie to keep you signed in and one short-lived cookie to protect the sign-in flow. No tracking or advertising cookies. The browser extension uses no cookies; it keeps your settings and sign-in token in the extension's own storage in your browser.

10. Children

SpamCut is not directed to children under 14.

11. Changes

We will post changes to this page and update the effective date.

12. Payments

Credit bought for the website-download version of SpamCut for Mac is paid through PayApp (UDID Inc., 주식회사 유디아이디) on its own payment page. PayApp collects and processes your mobile phone number and payment details under its own privacy policy. SpamCut never receives or stores your card details; we receive only the order number, the amount, the payment status and receipt link, and the mobile phone number you entered, which we keep with the order for the payment and refund process. YouTube and Instagram data is never shared with PayApp.

13. Contact

SpamCut is operated by Public Filca Inc. (퍼블릭필카 주식회사), CEO Cheol Kim, Business registration no. 406-88-02242, Mail-order business registration 2026-용인수지-3131, A-511, 338 Gwanggyojungang-ro, Suji-gu, Yongin-si, Gyeonggi-do 16942, Republic of Korea. Questions about privacy: 3kbrotherteam@gmail.com. The Instagram (Meta) integration runs on the Meta developer app registered to Bros Factory's verified Meta business account, administered by Cheol Kim.