This Privacy Policy explains what information FYProof, based in Ohio ("FYProof", "we", "us"), collects when you use FYProof (the "Service"), what we do with it, who we share it with, how long we keep it and the choices you have. It is part of our Terms of Service.
The Service is for adults (18 and older) who live in the United States, and all of your information is stored and processed in the United States.
If we offer teams and a business uses a team or client workspace to handle other people's information (for example an agency checking its clients' videos), we handle that information for the business, as its service provider, under our Data Processing Addendum. The business's own privacy policy then explains how it uses that information.
1. What we collect
Information you give us
- Account details: your name and email address; your password (stored only as a one-way scrambled "hash", never in a form we can read); and, if you sign in with Google, your Google account ID, name and email address.
- Sign-up answers: the month and year you were born (to confirm you are 18 or older), the country you live in, and a record of which versions of our Terms, Acceptable Use Policy and Privacy Policy you accepted, when, and from which IP address and browser.
- Your content: the videos you upload, their file names, captions and hashtags, the platforms you pick, and the frames, audio and transcript we make from each video to check it. Videos can show or reveal sensitive things about the people in them (for example their health or beliefs); we use them only to make your report and keep the Service safe, never to work out anything about you or them.
- Reports: the results of each check, and PDF copies of reports you ask for.
- Teams (if offered): the teams you are in, your role, the client workspaces, a team's name, logo and colour, and the email addresses of people invited.
- Messages: what you send us when you email support.
- Reports and notices you send us: if you use our report form or email abuse@, dmca@ or legal@ (you don't need an account), your name, email address, the IP address you sent it from and what you tell us. A copyright notice or counter-notice also includes the postal address, phone number and statements the law requires.
- Waitlist: if you live outside the countries we serve and ask to hear when we open there, your email address and country. If you sign up while accounts wait for our approval, we keep your account details while you wait.
- Connected accounts (if you connect one): when you connect YouTube, Instagram or TikTok, read-only access that the platform gives us (stored encrypted, never shown to anyone), your account's name or channel name, the list of your videos with their dates, lengths and links, and their numbers over time (views, likes, comments, shares, saves, reach, watch time, as each platform offers). We don't read your messages, your followers' names, your posts' text or your videos themselves.
- Analytics files and post links (if you add them): the numbers in an analytics file you upload (we don't keep any text, caption or title columns), and the links to your posts you paste with "I posted this".
- Billing (only if we offer paid plans and you buy one; nothing is sold today): our payment provider (Stripe and its Link service) collects your card and billing details. We receive and keep your plan, payment status, the amounts, dates and what each payment was for, refunds and disputes, and your billing country. We never see or store your card number.
Information collected automatically
- Device and usage: your IP address, browser type, the times you sign in and use the Service, the sessions signed in to your account (so you can sign out other devices), and the IP address a video was uploaded from.
- Cookies: only the cookies the Service needs to work: to keep you signed in, to remember which workspace you picked, to protect sign-in and sign-up, and to remember an age answer for 24 hours. We don't use advertising or cross-site tracking cookies, or third-party analytics. If we turn on Cloudflare Turnstile to keep bots out of sign-up or the report form, Cloudflare processes your IP address and browser signals for that check.
What we don't collect. We don't use face recognition, and we don't make face templates, voiceprints or other biometric identifiers from your videos. We don't buy information about you from data brokers.
2. How we use it
- To provide the Service: create and run your account, check your videos, show your reports, run teams, and show how your posts did.
- To keep it safe: prevent fraud, abuse and multiple free accounts, enforce our Terms and Acceptable Use Policy, handle reports and copyright notices, and protect users and the public.
- Child safety: we may check uploads for known child sexual abuse material, including by comparing them with hash lists of known material, and screen captions and speech for it. The hash check runs before anything from the video is sent to our AI service providers. If we find apparent child sexual abuse material, we report it to the National Center for Missing & Exploited Children (NCMEC) as US law requires, and we keep the material and related information as the law requires.
- If we offer paid plans: to bill you and keep financial records.
- To send you service emails (such as email confirmation, password resets, payment and plan notices and "your report is ready", which you can turn off). We don't send marketing email today; if we ever do, it will include a way to unsubscribe.
- To improve the Service, using information about how it is used. We don't use your videos to train AI models. What our AI service providers may do with them is in section 4.
- To comply with the law and respond to lawful requests.
We don't make decisions about you that have legal or similarly significant effects based only on automated processing. A report is advice for you, not a decision about you.
3. Connected accounts and YouTube API Services
We use the numbers from a connected account or an analytics file only to show you how your posts did next to their reports. We never sell them, never send them to the AI service providers in section 4, and never post anything for you. If you turn on "Include my numbers in anonymous totals" on the Performance page, your numbers (without your name, links or videos) are also used in totals that help us make the checks more accurate; YouTube numbers are never included.
YouTube: the Service uses YouTube API Services, and Google's Privacy Policy applies to what Google collects. You can remove our access at any time on your Connections page or in your Google Account's security settings. When access is removed, we delete what we read from YouTube within 7 days.
Instagram and TikTok: you can remove our access on your Connections page, or in the Instagram app (Settings, Website permissions, Apps and websites) or the TikTok app (Settings and privacy, Security and permissions, Apps and services permissions). When you remove us in Instagram, Instagram tells us and we delete what we read from it at once.
4. AI service providers
To make a report, we send your video's frames and audio, its words, caption and hashtags to AI service providers (companies that run AI models and speech-to-text) as our subprocessors. They process it only to produce your report, under their API terms for business customers, which don't let them use your content to train their AI models or to improve their products. Some keep data for a short time to monitor for abuse or meet legal duties, as their own terms describe. The current list is on our Subprocessors page.
Checks on the free plan go to the same providers, on the same terms, as paid checks. We don't let you choose or bring your own AI provider.
5. Who can see your content
- You can see your own videos and reports. Other users can't, unless you add them to a team.
- In a team, everyone in the team can see the videos, reports and connected accounts' numbers of the team and its client workspaces, according to their role, and a client's viewers can see that client's reports. The team's owner and admins can see the names and email addresses of the people in it. When someone invites you to a team, we keep your email address with the invitation.
- Our administrators (currently the owner of FYProof) can open any user's video, frames and reports when needed to investigate abuse or safety problems, to answer a support request you made, to fix a problem with the Service or to comply with the law. Every such access is recorded in an audit log.
- Our service providers process data only on our instructions (see the Subprocessors page).
6. When we share information
We don't sell your personal information, and we don't share it for targeted advertising (so a "Global Privacy Control" signal has nothing more to stop). We share it only:
- with our service providers (subprocessors), to run the Service;
- with the people in your team, as section 5 says;
- with NCMEC and law enforcement as described in section 2;
- in copyright cases: if you send a counter-notice, we send a copy (with your name, address and phone number) to the person who sent the copyright notice, as the law requires. We don't give the person whose video was reported your name or contact details when you report it, unless the law requires it;
- when required by law, such as a valid subpoena, court order or search warrant. Unless the law, a court order or an emergency prevents it, we tell you before we hand over your information so you can object;
- to protect the rights, safety and property of our users, the public or us;
- to a company that we form or control to run the Service, or as part of a merger, acquisition or sale of the Service, in which case this policy continues to apply to your information; or
- with your consent.
7. How long we keep it
| What | How long |
|---|---|
| Uploaded videos, and the frames and audio made from them | Deleted 72 hours after the check |
| Reports, transcripts, captions and hashtags | Until you delete the report or your account |
| Account details and sign-up answers | Until you delete your account (also while it waits for our approval) |
| Free accounts with no sign-in for 24 months | Deleted, after an email warning 30 days before |
| Copies of the emails we send you (address, subject and text, with one-time links removed once sent) | 30 days, also after the account is deleted |
| Your "Download my data" file | 24 hours after it is ready |
| A PDF of a report | 24 hours after it is made |
| An account and its data we must keep for a legal reason (for example an open abuse report, a child-safety review or a legal request) | Until that is resolved, even if you asked us to delete it; then deleted |
| Database backups | Deleted data can remain in encrypted backups for up to 30 days |
| If you buy a paid plan: billing and tax records (amounts, dates, plan and country; no name, email or card details once the account is deleted) | About 7 years, as tax law requires, even after the account is deleted |
| Record of which Terms versions you accepted | Kept after the account is deleted, without your IP address, as proof of the agreement |
| Security audit log | 2 years or more; IP addresses in it are removed after 90 days; after an account is deleted its entries no longer show who it was |
| Server logs | 14 to 30 days |
| Material reported to NCMEC | As the law requires (at least 1 year), even after the account is deleted |
| Reports and copyright notices sent to us, and our records of how we handled them | As long as we need them to handle the matter and to show how we handled it (for example to count repeat infringers) |
| Waitlist email addresses | Until we write to you, then deleted |
| Access to a connected account, and the numbers read through it | Until you disconnect (then deleted at once) or the platform stops our access (then deleted within 7 days). If we can't confirm our access for 26 days, we delete it too |
| Analytics files' numbers, and your post links | Until you delete them, the report, or your account |
| If teams are offered: videos, reports and numbers in a team's workspace | Until someone in the team deletes them, or the team is deleted; they stay with the team if you leave it |
| A team invitation (the invited email address) | 90 days after it is accepted, cancelled or runs out |
8. Your choices and rights
Wherever you live in the US, you can:
- Download your data: your account details, reports, connected-account numbers and (if you bought anything) your payments, from your account page.
- Delete your account and data: from your account page. This cancels any paid plan first. We keep only what the table above says we must.
- Delete parts of it: delete any report or video, disconnect an account, or delete stored numbers, in the app.
- Correct your name or email on your account page, or ask us to.
- Turn off "report ready" emails in your account.
- Ask us what we hold about you, or to delete or correct it, or anything else about your privacy, at privacy@fyproof.com. We may need to confirm it's you, usually by replying from the email address on your account. Someone you authorize can ask for you, with your signed permission. We answer within 30 days, and we won't treat you differently for asking.
- Appeal. If we turn down a request, you can appeal by replying to our answer with "Appeal" in the subject. We answer appeals within 45 days and explain why. If you still disagree, you can contact your state attorney general.
If your information is in a team or client workspace that a business runs, we may pass your request to that business, because it decides what happens to that information.
9. Security
We protect your information with encryption in transit (HTTPS) and at rest, access controls, audit logging, encrypted storage of connected-account access, and by deleting videos soon after the check. No service can be perfectly secure. If a breach affects your personal information, we will tell you as the law requires.
10. Children
The Service is not for anyone under 18, and we don't knowingly collect information from anyone under 18. If we learn that we have, we close the account and delete the information. If you think a child has given us information, email privacy@fyproof.com. Videos you upload may show children; you are responsible for having permission to upload them, and we use them only as this policy describes.
11. Changes to this policy
Each version has a version number and effective date at the top. If we make a material change, we will tell you by email or in the app before it takes effect, and you will be asked to accept the new version the next time you use the Service.
12. Contact
Privacy questions and requests: privacy@fyproof.com. Everything else: support@fyproof.com. We handle all contact by email.