Privacy Policy

• You don't need an account to check a channel. The site never asks for access to your Google or YouTube account.
• When the site scores a channel, it stores the channel ID, the score, the time and your IP address.
• The site uses YouTube API Services to read public data about the channels checked.
• Google Analytics measures visits to spam.h.ki only if you accept its cookies. Cloudflare, which serves the site, may set a security cookie.
• A channel's owner can ask us to remove the channel's data. See Removal requests for a channel.

The site uses YouTube API Services (the YouTube Data API) to look up the channels you check and their public videos. By using the site you agree to be bound by the YouTube Terms of Service. How Google handles data is described in the Google Privacy Policy.

The site calls the YouTube Data API from our server with its own API key. It does not use Google sign-in and cannot reach private data in anyone's Google or YouTube account. Everything it reads from YouTube is public. The requests carry the channel ID, @handle or username that was searched for, not your IP address.

The scan record

Each time the site scores a channel, our server stores a scan record with the channel ID, the spam score, the date and time, and the IP address the request came from. A channel is scored when you search for it, open its result page (an address starting spam.h.ki/youtube/channel/) or press Run again. The site sits behind Cloudflare, so the address stored is the one Cloudflare passes on as the visitor's. The score of each check behind the total is stored too, with the channel ID and the time but without an IP address.

Server logs

Our web server logs every request: the date and time, the address requested (for a result page this includes the channel ID), the response status, the referring page, your browser's user agent and the network address the request arrived from, normally one of Cloudflare's. Error logs can contain the channel IDs and @handles that were looked up.

Kept in your browser

The site keeps three settings in your browser's local storage, and never sends them to us: spamtm-consent, whether you accepted or rejected analytics cookies; spamtm-theme, your light or dark theme; and spamtm-channels-run, how many channels you said you run, if you checked your own channel and answered that question.

• Lists of channels checked. The home page and the spam statistics list the latest channels checked, with their scores, and count the channels and checks found most often. They are built from scan records and show which channels were checked, never who checked them or from which address.
• Your IP address. The site's history API can list the channels checked from the same IP address as the request, over the last month. It returns channels and scores, never an address, and the site's own pages don't use it. The site uses stored IP addresses for nothing else.
• Improving the score. We study scan records and check scores to test and improve how the spam score is worked out.
• Running the site. We use server logs to run the site, keep it secure and fix errors.

We don't sell personal data, show ads or use what the site collects for advertising.

To score a channel, the site reads from YouTube and stores the channel's public details (ID, title, description, creation date, keywords, the addresses of its profile image and banner, and its subscriber, view and video counts), and the public videos in its uploads (for each: ID, title, description, tags, publish date, category, length, privacy status, and view, like and comment counts). It also records whether the profile image is one of YouTube's default images, and whether YouTube still returns the channel, with the date.

The spam score and each check's score are worked out by this site from that data. They don't come from YouTube, and a high score is not a decision by YouTube. Channel and video details are stored in database tables that other Freedom! Family Limited systems also use.

We delete our own copies of channel details after 30 days, and never show or use channel details older than 30 days. The shared tables are kept by those other systems, so we don't delete from them; instead, once a channel's details there are more than 30 days old, the site reads the channel from YouTube again before it shows or scores it, and if YouTube can't be reached it shows no result.

Your choice

The first time you visit, a bar at the bottom of the page asks whether Google Analytics may set cookies. Until you press Accept, the site doesn't load Google Analytics at all, and if you press Reject it never does. Both are one click. You can change your mind at any time with Cookie settings at the bottom of every page; rejecting after accepting also deletes the Google Analytics cookies. The site uses Google Consent Mode and grants only analytics storage: it shows no ads, so the advertising signals stay off.

Google Analytics

If you accept, the site loads Google Analytics 4 on spam.h.ki. A copy of the site running anywhere else doesn't. Google Analytics records the pages you view, including address changes the page makes without reloading; for a result page the address includes the channel ID. It also records which of the site's links and buttons you use, such as the heart.id suggestion after a check (with the channel's subscriber range and rounded score, not its ID). Google adds details about your device and browser and an approximate location. It sets the cookies _ga and _ga_6BW6ZC9TMK to tell visits from the same browser apart, for up to 2 years. Google explains how it uses information from sites that use its services.

Visit counting

spam.h.ki counts visits with stats.he.art, run by Heartbeat, part of the same group as heart.id. It sets no cookies and doesn't store IP addresses, so it doesn't wait for your choice above. It receives the address of the page you view (for a result page, that includes the channel ID), the page you came from, your browser and device type and your screen size. It tells visits apart with a code that changes every day, so visits on different days can't be linked. We use it only to count readers and see which pages are read most.

Cloudflare

Cloudflare may set cf_clearance to remember that your browser passed its bot check. See Cloudflare's cookie list.

Content from other servers

Channel profile images and banners load in your browser from YouTube's image servers, so Google receives your IP address and browser details when you view them. The site shows no third-party ads. Links to heart.id are plain links: nothing on the page loads from heart.id.

A creator who uses heart.id, Freedom! Family Limited's dashboard for YouTube channels, can sign in to spam.h.ki with their heart.id account to see private views of their own channels' checks. Signing in is optional. The free checker works the same with or without it, and signing in never changes a channel's public result.

• What spam.h.ki receives from heart.id. A pseudonymous ID made for spam.h.ki alone, the IDs of the channels you have connected to heart.id, and which plan features you have. Your first name and initial only if you tick that option on heart.id's consent screen, which is off by default. spam.h.ki never receives your email address, your Google account ID, your heart.id user ID or any YouTube Analytics data.
• Consent. heart.id asks you the first time, on its own screen, listing what spam.h.ki will receive.
• Cookies. Signing in sets __Host-hki_state for 10 minutes while you go to heart.id and back, then the session cookie __Host-hki_sid, which is secure, not readable by scripts, and ends after at most 14 days or when you sign out. We store only a hash of it.
• Private check records. While you are signed in, the site keeps a record of each check of your own channels: the date, the score and band, the method version, and which of your videos each signal found. Only you can see them. They are kept for 30 days.
• Unlinking. You can unlink spam.h.ki at any time in heart.id under Settings, Linked sites. That signs you out of spam.h.ki everywhere, and spam.h.ki deletes your private check records within 7 days. The same happens if you delete your heart.id account, and a channel's records are deleted within 7 days of disconnecting it from heart.id.
• The sign-in record. So that every part of the site refuses a session from before you unlinked, spam.h.ki keeps one short record under your pseudonymous ID: when you last unlinked or deleted your account, when your plan features last changed, and which version of them it last saw. It holds nothing else, and is deleted 15 days after it last changed, so at most 15 days after you unlink or delete your heart.id account.

Your heart.id account, plan and billing are covered by heart.id's own privacy policy and terms.

Every page has a "Help & feedback" link. It opens a short form to ask a question, report a problem, send feedback or tell us a result looks wrong. You don't need an account to use it.

• Where it goes. The form sends your message to heart.id, which Freedom! Family Limited also runs. heart.id keeps the messages sent from both sites in one place, and we answer from there, by email.
• What is sent. The kind of message, what you write, and your email address if you give one. The form also attaches some details, so we can see what you saw: the address of the page you were on (without anything after a "?"), the site's version, your browser and system as your browser describes them, the size of your browser window, and whether you use the light or dark theme, and the reference of an error the page showed you, if it showed one. If you tell us a channel's result looks wrong, it attaches the channel's ID and the check you saw (the score, its band, the signals found, the method date and when the channel was read), and your answer to "Is this your channel?". If you're signed in with heart.id, it attaches your heart.id account, so the message is linked to it. The form lists every attached detail before you send it, and you can remove any of them.
• Error references. When something fails, the page shows a short reference such as E-7f3a1b, and our server logs it with what failed, in the server logs described above. A report you send with it lets us find that line.
• Screenshots. When you report a problem while signed in with heart.id, with your account attached, you can attach one screenshot, a PNG, JPEG or WebP image of up to 2 MB. The site passes it straight to heart.id without keeping it. heart.id stores it in a restricted Google Drive folder, with Google as our processor, and deletes it with the message. Crop out anything private before you attach it.
• Your email address. Optional. We use it only to answer your message. Without it we can't reply.
• How long. heart.id keeps the message, its details and our replies until 12 months after the message is closed, then deletes them.
• Keeping out automated messages. The form uses Cloudflare Turnstile, which checks in your browser that a person is sending the message. Cloudflare runs that check for us, as our processor, using your IP address and details of your browser. The site also counts the messages sent from each IP address over an hour, to limit how many one visitor can send. For that count the address is held in the server's memory for at most an hour. It is not sent to heart.id or kept with your message.
• Analytics. If you accepted analytics cookies, Google Analytics records that you opened the form and that you sent a message, with the kind of message only, never what you wrote.
• Why we may use it. To answer you and to fix and improve the site, which is our legitimate interest and, when you write to us, yours too (GDPR Art. 6(1)(f)).

Aegis, a Content ID service also run by Freedom! Family Limited, offers a free channel check on aegis.h.ki. When you check a channel there, the Aegis page in your browser asks this site to read the channel's public details from YouTube, and this site sends the answer back to that page.

• What is read. Through YouTube API Services, the channel's ID, title, @handle, profile image address, and subscriber and video counts, and for up to its 200 newest public videos, their IDs, titles, publish dates and view counts.
• What Aegis's page receives. The channel's ID, title, @handle, profile image address and subscriber and video counts; the total views and the uploads a month of those videos; and the three most viewed of them, with their IDs, titles and view counts. It receives no spam score and nothing else this site stores.
• What is kept here. The answer is held in our server's memory for up to 24 hours, so checking the same channel again doesn't read YouTube again. It is not written to the database. Each check adds a line to the server logs with its result, the YouTube quota it used, and two codes made from your IP address and its network. The codes are made with a secret key that changes every day, so they can't be turned back into an address or linked across days. These lines are kept as long as the rest of the server logs (see How long we keep it).
• Keeping out automated checks. Aegis's page uses Cloudflare Turnstile, which checks in your browser that a person is asking. This site sends the result to Cloudflare to confirm it, and counts the checks from each IP address over a minute and an hour, in the server's memory only, to limit how many one visitor can make.
• Why we may use it. To answer the check you asked for, and to protect the service and its YouTube quota from abuse, which is our legitimate interest and, when you ask for a check, yours too (GDPR Art. 6(1)(f)).
• What Aegis does with it. What Aegis's page and Aegis itself do with the answer, and with anything you give Aegis, is described in Aegis's own privacy policy on aegis.h.ki.

• Cloudflare serves the site, so every request, with your IP address, passes through Cloudflare.
• Google receives what is described under Google Analytics if you accept its cookies, the channel IDs, @handles and usernames the site looks up through YouTube API Services, and your IP address when your browser loads channel images.
• Our hosting provider, Amazon Web Services (AWS), in the us-east-1 region (N. Virginia, United States), runs the server and the database.
• Other Freedom! Family Limited systems share the database tables that hold channel and video details.
• heart.id, if you sign in with it, as described above, or send us a message, as described under Messages you send us.
• Heartbeat runs stats.he.art, which receives what is described under Visit counting: the address of each page you view, the page you came from, your browser and device type and your screen size. It sets no cookies and stores no IP addresses.
• Aegis, also run by Freedom! Family Limited: its page on aegis.h.ki receives a channel's public details when you check the channel there, as described under Channel checks for Aegis.

These providers may process data outside the country where you live, where data protection laws may differ.

• Your IP address with a scan record: 90 days. After that the IP address is removed from the scan record, which is then kept without it, as the scores are.
• Scores and check scores: up to 36 months, then deleted. A job deletes older records every day.
• Channel and video details read from YouTube: We delete our own copies after 30 days, and never show or use channel details older than 30 days.
• Server logs: 30 days.
• Google Analytics data: Google Analytics keeps event data for 2 months and user-level data for 14 months from the last visit.
• Sign-in sessions: at most 14 days, or until you sign out or unlink.
• The sign-in record kept under your pseudonymous ID: deleted 15 days after it last changed, so at most 15 days after you unlink or delete your heart.id account.
• Private check records of your own channels: 30 days, and deleted within 7 days of unlinking.
• Settings in your browser, your cookie choice included: until you clear them.

Anyone can check any public channel here, so a score may exist for your channel without you asking. If you own a channel, you can ask us to remove its scan records and check scores, which also takes it off the lists of latest channels checked, and its stored public details and videos. Other Freedom! Family Limited systems use the same tables for those details, so we will tell you what we removed. The site can't yet stop a channel from being checked again: a new check stores a new scan record.

To ask, email [email protected] with the subject "Removal request", the channel's URL or ID, and what you want removed. To show that you control the channel, we will send you a short code to add to its description while we check.

Removing data from this site changes nothing on YouTube. To change or delete data on YouTube, use YouTube itself.

Depending on where you live, including under the GDPR in the European Union and the United Kingdom, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy of it, and to withdraw consent you have given. To make a request, email [email protected]. For scan records made from your IP address, tell us the address and roughly when you used the site; we may ask for more to confirm it was yours. We reply within one month. You can also complain to the data protection authority where you live or work.

When this policy changes, we publish the new version on this page and update the "Last updated" date at the top. If a change means we use data in a new way, we will say so on the site before it takes effect and, where the law or YouTube's policies require it, ask you to agree again.

For questions or complaints about this policy or the site's privacy practices, email [email protected], or contact our support team at https://freedom.support.tm.

See also the Terms of Use.