KillSpam Privacy Policy

Effective date: October 7, 2026

KillSpam ("we", "the service") at https://killspam.filca.store helps creators moderate spam comments on their own YouTube channel and Instagram professional account. This policy explains what data we access, how we use, store, and share it, and how you can delete it.

1. YouTube API Services

KillSpam uses YouTube API Services. By using KillSpam you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

2. Data we access

When you sign in with Google, you grant KillSpam the scope https://www.googleapis.com/auth/youtube.force-ssl. With it we access only:

• Your channel ID, channel title, and the ID of your uploads playlist.
• The list of videos you uploaded (video ID, title, publish date).
• Comments and replies on your videos: comment ID, text, author display name, author channel ID, publish time, like count, and moderation status.
• OAuth access and refresh tokens issued by Google.

We do not request your email address, contacts, or any other Google data.

When you connect an Instagram professional account, you grant KillSpam the permissions instagram_business_basic and instagram_business_manage_comments through the Instagram API with Instagram Login. With them we access only:

• Your Instagram account ID and username.
• The list of your posts (media ID, caption, permalink, publish time, comment count).
• Comments and replies on your posts: comment ID, text, author username, publish time, like count, and whether the comment is hidden.
• The access token issued by Instagram.

We do not access your direct messages, followers, insights, or any other Instagram data, and we never publish content.

2-1. KillSpam browser extension and KillSpam accounts

The KillSpam browser extension works on the YouTube and Instagram pages you open in your own browser. It does not use the YouTube Data API or the Instagram API, and it does not use your Google or Instagram sign-in with KillSpam. Its rule-based check runs entirely in your browser and sends nothing to us.

The optional AI check needs a KillSpam account. If you create one, we collect and store:

• Your email address.
• Your password, only as a salted scrypt hash. We cannot read it.
• Sign-in tokens, only as SHA-256 hashes.
• How many comments you had checked today, to apply the daily limit.

When you run the AI check, the extension sends the text of the comments on the page you are checking (at most 500 characters each, without author names, IDs, or links to the page) to our server. Our server forwards those texts to our AI provider, TypeSafe (api.typesafe.ai), which returns for each comment how likely it is spam, abuse, or sexual content. We do not store or log the comment texts; they pass through our server only to produce that answer. Nothing is sent unless you are signed in, have turned the AI check on in the extension, and start a check.

The AI check is never applied to data obtained through the YouTube Data API or the Instagram API in the dashboard. Data from those APIs is not sent to TypeSafe or any other AI provider.

2-2. KillSpam for Mac (Mac App Store)

KillSpam for Mac opens YouTube and Instagram in a web view inside the app. You sign in to those sites yourself in that web view; your passwords and cookies stay in the app on your Mac and are never sent to us. Collecting, checking with rules, and deleting comments all happen on your Mac.

The optional AI check requires an auto-renewable subscription bought through Apple. There is no KillSpam account in the Mac App Store version and we do not receive your name, email address, Apple ID, or payment details. To prove the subscription, the app sends our server the transaction Apple signed for it. From that transaction we store only the subscription's identifier assigned by Apple (the original transaction ID), the product, its expiry date, whether it was refunded or revoked, and how many comments it has had checked today. This is deleted 30 days after the subscription ends.

When you run the AI check, the app sends the text of the comments on the page you are checking (at most 500 characters each, without author names, IDs, or links) to our server, which forwards them to TypeSafe exactly as described in section 2-1. We do not store or log the comment texts. Nothing is sent unless you have subscribed, turned the AI check on, and started a check.

Apple notifies our server when a subscription is renewed, refunded, or revoked, so that a refunded subscription stops working. To cancel, use your Apple account's subscription settings.

3. How we use the data

• To show you the comments on your videos that match your spam rules.
• To change the moderation status (held for review, or rejected) of YouTube comments, or to hide or delete Instagram comments, only when you have enabled the consent setting in the dashboard and clicked "Apply" for the comments you selected.
• To keep logs of the actions you took, so you can audit them.
• For KillSpam accounts: to sign you in to the browser extension, to apply the daily AI check limit, and to answer the AI checks you start.

We do not use the data for advertising, we do not sell it, we do not use it to build profiles, and we do not use it to train artificial intelligence or machine learning models. We do not combine data from different users' channels or accounts.

4. Data protection and security

We protect the data we obtain from Google (YouTube API Services) and Meta (Instagram API), including sensitive data such as OAuth tokens and the comment data of your channel, with the following mechanisms:

• Encryption in transit: all traffic between your browser and KillSpam, and between KillSpam and the Google and Meta APIs, uses HTTPS (TLS). Plain HTTP requests are redirected to HTTPS and HSTS is enabled.
• Encryption at rest: Google OAuth refresh tokens and Instagram access tokens are encrypted with AES-256-GCM before they are stored. The encryption key is kept separately from the data, in a server configuration file that only the service can read.
• Access control in the service: you can only see and act on the data of the account you signed in with. Sessions use a signed, HttpOnly, Secure cookie, and the sign-in flow is protected against request forgery with a signed state value.
• Server access: data is stored on a single server in South Korea (Naver Cloud Platform). The application runs under a dedicated unprivileged account, listens only on the local interface behind the HTTPS proxy, and the stored data is not reachable from the web except through the signed-in service. Administrative access to the server is limited to the operator; no other person or third party has access.
• Data minimization: we request only one Google scope, store only the data listed in section 2, and never store your Google password or email address.
• Limited retention and deletion: data is deleted automatically after at most 30 days, and immediately when you disconnect (sections 5 and 7).
• Passwords and sign-in tokens of KillSpam accounts are stored only as hashes (salted scrypt and SHA-256), never in readable form.

If we become aware of unauthorized access to your data, we will revoke the affected tokens and inform the affected users through the service without undue delay.

5. Retention

• Scan results, comment data, and action logs are kept for at most 30 days and then automatically deleted.
• If Google reports that your authorization is no longer valid (for example you revoked it in your Google Account), we delete all of your data at the next daily check, and in any case within 30 days.
• The same applies to Instagram: if the Instagram token expires or is rejected, or Meta notifies us that you removed KillSpam, we delete your Instagram data.
• KillSpam account data (email, password hash, sign-in token hashes, today's usage count) is kept until you delete the account. Comment texts sent for the AI check are not kept at all.

6. Sharing

We do not sell your data or share it for advertising. Data is sent only to Google (YouTube Data API) and Meta (Instagram API) to perform the actions you request, and, when you run the AI check in the browser extension or in KillSpam for Mac, the comment texts you chose to check are sent to TypeSafe as described in section 2-1. Your email address and account data are never sent to TypeSafe. We may disclose data if required by law.

7. Your choices and deletion

• Disconnect in KillSpam: the "Disconnect and delete my data" button in the dashboard revokes our Google authorization and immediately deletes all your data (tokens, scans, logs).
• Revoke in Google: you can revoke KillSpam's access at any time at https://security.google.com/settings/security/permissions.
• Disconnect Instagram in KillSpam: the "Disconnect Instagram and delete its data" button deletes the stored Instagram token and all your Instagram data (scans, logs) immediately.
• Remove in Instagram: you can remove KillSpam under "Apps and websites" in your Instagram settings. Meta then notifies us and we delete your Instagram data.
• Delete your KillSpam account: in the extension's toolbar menu, open "Account" and choose "Delete account". The account and everything stored for it are deleted immediately. Signing out removes the sign-in token from your browser.
• Turn the AI check off: the extension's settings have an AI check switch. While it is off, no comment text leaves your browser.
• Email request: write to 3kbrotherteam@gmail.com and we will delete your data within 7 days.

8. Google API Services User Data Policy

KillSpam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Cookies

We use one session cookie to keep you signed in and one short-lived cookie to protect the sign-in flow. No tracking or advertising cookies. The browser extension uses no cookies; it keeps your settings and sign-in token in the extension's own storage in your browser.

10. Children

KillSpam is not directed to children under 14.

11. Changes

We will post changes to this page and update the effective date.

12. Payments

Web subscriptions are sold through Paddle.com, our Merchant of Record. Paddle collects and processes your name, email address, billing country and payment details under its own Privacy Policy. KillSpam never receives or stores your card details; we receive only the order and subscription status needed to unlock the AI check. YouTube and Instagram data is never shared with Paddle.

13. Contact

KillSpam is operated by Public Filca Inc. (퍼블릭필카 주식회사), CEO Cheol Kim, Business registration no. 406-88-02242, Mail-order business registration 2026-용인수지-3131, A-511, 338 Gwanggyojungang-ro, Suji-gu, Yongin-si, Gyeonggi-do 16942, Republic of Korea. Questions about privacy: 3kbrotherteam@gmail.com. The Instagram (Meta) integration runs on the Meta developer app registered to Bros Factory's verified Meta business account, administered by Cheol Kim.