Privacy policy
Last updated 30 September 2026
Substat turns the public comments under a YouTube video into a report. This page says what data that involves, where it comes from, how long we keep it and how to have it removed.
- Who we are
- The data controller is Stanisław Królikiewicz, trading as StanByte Stanisław Królikiewicz, ul. Neseberska 4/103, 02-758 Warsaw, Poland, NIP 1231224958, REGON 527269263. Substat is this team's early product. For anything about your data, write to hello[at]substat.app or through the contact form on the homepage; we answer the same business day.
- YouTube API Services
- Substat uses YouTube API Services to read the public comments and metadata of the video whose link you paste. We do not ask for access to your Google or YouTube account and we do not use OAuth: everything we read is public to anyone. Google's handling of data is described in the Google Privacy Policy.Google Privacy Policy ↗
- What we take from YouTube, and for how long
- Video, channel and comment identifiers stay as technical references. Comment text, author names, like counts and timestamps, together with the video's title, description and public statistics, are cached to build and show the report and are refreshed or removed within 30 days, as the YouTube API Services Terms require. The classifications, themes, counts and leads in a report are generated by Substat from that data; they are not metrics provided by YouTube.
- What you give us
- The video link you submit. Your e-mail address, used to send you the link to the finished report and, only if you tick that option in the form, to tell you about our plans for the product. A keyed hash of your IP address (SHA-256 with a secret salt), used only to limit free analyses per network. Without the key it does not reveal the address, but we treat it as personal data and delete it after 30 days. Any feedback or comments you type into the report. When you open a report, we record when and how many times it was opened and which parts were viewed, to know whether it was useful.
- If we wrote to you first
- We write to some creators ourselves, with an analysis of one of their videos. In that case we take the name and e-mail address from the public information about the channel, not from you. We record: the name, the e-mail address, the channel and the video, the analysis we prepared, the messages we sent and whether the report was opened. If the e-mail carried a free-analysis link, we also record whether and when it was used and which video that analysis was for. We do this in our legitimate interest (Art. 6(1)(f) GDPR): to show you Substat and to learn whether this way of reaching creators works. This data is for us only and we do not sell it. You can object at any time: reply to the e-mail or write to hello[at]substat.app, and we will delete your data and not write again. We keep it only as long as these purposes need it.
- Why we use it, and on what basis
- We run the analysis you ask for and send you its link because that is the service you order (Art. 6(1)(b) GDPR). Limiting free analyses, preventing abuse, measuring usage, improving the product, and establishing, pursuing or defending legal claims are our legitimate interest (Art. 6(1)(f)). We tell you about our plans for the product only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
- How long we keep it
- Data from YouTube is refreshed or deleted within 30 days. The IP hash is deleted after 30 days. A request with its e-mail address, the report and feedback are kept while the report is available, or until you ask us to delete them. Data about creators we wrote to first is kept as long as we need it to stay in touch with them and to judge this way of reaching creators, or until they object. Data needed to establish, pursue or defend legal claims may be kept longer, until the limitation period ends.
- Who processes it for us
- Vercel hosts the site: every request passes through its servers, with the IP address and whatever a form carries, and it provides cookie-less usage analytics. Convex stores requests, reports, feedback and the details of creators we write to. Resend delivers our e-mails. The YouTube comments are stored by a storage provider and analysed by language-model providers. Google provides the YouTube API. Each acts on our instructions under its own terms; data may be processed in the EU and the US. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses or on the EU-US Data Privacy Framework.
- Cookies and local storage
- We set no tracking or advertising cookies. We set one technical cookie, s_ft: if you come to us through a free-analysis link, we keep its code, so that the analysis can start without us approving it by hand. No script on the page can read it, and clearing your cookies removes it. A code from a link we sent by e-mail is tied to its recipient (see “If we wrote to you first”). Your browser's local storage remembers a few preferences — the layout you chose, a pane's height, whether you answered a question — and never leaves your device. Session storage holds a random tab identifier we count visits by; it is gone when the tab closes.
- Your rights
- You have the right to access your data, to have it corrected or deleted, to restrict its processing, and to data portability. You can object at any time to processing based on our legitimate interest. You can also withdraw consent; the withdrawal applies from then on and does not undo what we did on the basis of that consent before. If your comment ended up in a report, tell us the video and your YouTube channel name, and we will remove your comments from the report. We carry out deletion requests within 24 hours of a message to hello[at]substat.app or through the contact form. If you believe we process your data unlawfully, you can complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or to the authority in your own country.