Privacy Policy

1. What this policy covers

This policy explains how CommentFinder collects, uses, stores, and shares information when you visit commentfinder.app, sign in, search public comments, purchase credits, or contact support. It does not govern YouTube, TikTok, Instagram, or other third parties, which have their own policies.

2. Information we process

• Account data: when you use Google Sign-In, we receive an account identifier, name, email address, and avatar when available. We use this information to authenticate you, operate your account, grant credits, and provide support.
• Search data: the public video URL or ID, platform, retrieval provider, limits, status, timestamps, returned result counts, and credits used. Search results are returned to your browser; the credit ledger does not store fetched comment bodies as part of your search history.
• Premium workspace data: saved-search names and settings, recent search metadata, export preferences, and structured AI analyses you request. Comment text submitted for an AI analysis is sent to OpenAI for that request. CommentFinder stores the structured analysis and evidence identifiers for reuse, but not the full submitted comment bodies in the analysis cache.
• Billing data: purchase amount, credit pack, currency, Stripe identifiers, transaction status, and—if auto top-up is enabled—the saved payment-method reference, brand, and last four digits. CommentFinder does not store full card numbers or security codes.
• Technical and analytics data: device, browser, page, approximate location derived from network information, security events, and aggregated product usage needed to operate and improve the service.
• Communications: messages and details you provide when requesting support.

3. How information is used

We use information to provide comment search, authenticate users, maintain balances, settle exact credit usage, process payments, run optional auto top-ups, prevent fraud and abuse, save searches, create optional AI analyses, troubleshoot failures, communicate about the service, comply with legal obligations, and improve reliability. Google user data is used only for these user-facing account features; it is not sold or used for targeted advertising.

4. Service providers and sharing

We disclose information to service providers only as needed to run CommentFinder, follow your instructions, protect the service, or meet legal requirements. Current providers include:

• Supabase — authentication, account records, and the credit ledger.
• Stripe — checkout, payment processing, receipts, and saved payment methods.
• Google — Google Sign-In and the YouTube Data API.
• Apify — retrieval of public TikTok and Instagram comment data.
• OpenAI — optional premium summaries, themes, sentiment, and evidence selection.
• Vercel and Cloudflare — hosting, delivery, reliability, and security.
• Plausible — privacy-focused website analytics.

We may also disclose information when required by law, to respond to valid legal process, or to protect users, the service, or others. We do not sell personal information.

5. Retention and security

Account, ledger, billing, and security records are retained for as long as reasonably needed to provide the service, maintain transaction records, resolve disputes, prevent abuse, and meet legal obligations. Provider logs may follow each provider’s retention schedule. We use access controls, encrypted connections, scoped credentials, and managed infrastructure, but no online service can guarantee absolute security.

6. Your choices and rights

You can sign out, disable auto top-up, and manage billing from your account. Depending on where you live, you may request access, correction, deletion, restriction, or portability of personal information, or object to certain processing. Contact us to make a request. We may need to verify your identity and retain records that law or legitimate security and accounting needs require.

7. Children, international processing, and changes

CommentFinder is not directed to children under 13, and we do not knowingly collect their personal information. Providers may process information in countries other than your own. We may update this policy as the service changes; the effective date above will be revised and material changes may also be communicated in-product or by email.