Privacy Policy

What we store

When you sign in with Discord we read your user ID, username, display name, and avatar. That set stays in your session cookie so you do not have to sign in on every page load.

We also keep a small account record: your credit balance, the plan you are on, when you first signed in, and when you were last seen.

We do not store your Discord password. We do not receive one.

Your internet address

Every account is given a one time free credit grant, and to stop that being claimed over and over we check the internet address a sign in comes from.

We do not store the address itself. It is run through a one way keyed hash, and only the shortened result is written to a small file that records that a grant was claimed. That file is enough to answer "has this address claimed it before" and nothing else. It cannot be turned back into the address, and it is not used to build a profile, track you across sites, or show you anything.

The result of this check is also recorded on your account, as a note that the free grant was withheld. That is visible only to us.

This check is not perfect. A shared address, such as a home, an office, or a mobile network, can only claim the grant once between everybody using it. If that affects you, contact us and we will sort it out.

Connected YouTube channels

When you connect a channel we store its channel ID, title, handle, avatar, and public statistics such as subscriber, video, and view counts. Channels are connected by pasting a link to the channel, or its handle, which we resolve through the YouTube Data API.

If a channel was connected through Google with your permission, Google also gives us an access token and a refresh token for that connection. The refresh token is what lets the numbers keep updating after the first hour, and it is stored on the server alongside the channel it belongs to.

Access is read only. We cannot upload, edit, or delete videos, alter your channel, or read your private messages.

Payments and subscriptions

Payments are handled by Stripe, our payment processor. Your card number and other payment details are given to Stripe, never to us, and we cannot see or store them. Stripe processes that data under its own privacy policy.

What we receive back, and what we store, is the part we need to run your subscription: a customer reference, a subscription reference, which plan and billing period you are on, the status of the subscription, the current period end, whether a cancellation is scheduled, and the reference of the last payment.

We do not receive a breakdown of what you bought elsewhere, and we do not receive your card details. We keep payment and subscription records while your account exists, and afterwards for as long as the law requires us to keep records for tax and accounting, which is usually several years.

Credits and usage

We keep your credit balance and a record of the runs you start, so a tool can show you its output later and so we can refund a run that fails.

A record of a run usually holds the title or filename, the timestamps, the status, and the result. It is deleted when you delete the item from its page.

Files you upload

Files you upload are stored so the tool can work on them, and to show you the result afterwards. They are kept until you delete the item they belong to.

Some processing happens on our own servers. Some is done by third party services, which fetch the file or receive it with your request and return a result.

While a file is being processed it may be briefly reachable at a long random link so that the processing service can fetch it. The link is not listed anywhere and is not shared.

Downloaded videos

We do not keep the videos you download. A downloaded file is stored only while it is being handed to you, and is deleted once that transfer is done. Anything left over is removed automatically within an hour.

A video used for a review is kept only while that review exists, so the report stays available, and it is deleted when you delete the review.

What we do not do

We do not sell your data or use it for advertising, and we do not use your content to train models.

We do not read, send, or delete your Discord messages, and we do not join servers on your behalf.

Cookies

One cookie is used to keep you signed in. It is HTTP only, it is not readable by scripts on the page, and it expires on its own after seven days.

A second cookie remembers your cookie choice, so we do not ask you again on every visit.

A third cookie is set only if you arrive through an affiliate link. It holds the short code of the link, for about three months, and it is what lets the person who sent you be credited and your first period discount be applied if you subscribe later rather than straight away. It is not an analytics or advertising cookie, it is not shared, and declining analytics does not remove it. Clearing your cookies removes it, and the discount with it.

Google Analytics sets its own cookies, such as _ga, and only after you accept. Those cookies are managed by Google and are separate from your sign in session. If you decline, analytics does not load.

Affiliate links

When someone follows an affiliate link we count the click against that affiliate, and if they sign in afterwards we record that the account came from that link. That record is held on the affiliate record, not on the account they signed in with.

An affiliate can see that an account came from their link, when it was recorded, whether it has subscribed, and what it has earned them. They are not shown the name, the handle, the email, or any other detail of the person who signed up, and they cannot contact them through us.

If you have an affiliate link of your own, the same applies to the accounts that come through it. Your own referral and earning figures are visible to us, and to administrators of ScaleTool, for the purpose of running the program and settling what it owes.

If you take part in the program we also store the payout address you give us, which is normally the email on your PayPal account or your PayPal.Me link. It is used to send your payouts and for nothing else, it is visible only to the administrators who run the payouts, and it is kept while your account exists so a payment can be traced afterwards.

Analytics

We use Google Analytics to understand how ScaleTool is used, such as which pages are visited and how often. It loads only after you accept, and you can change your mind from Settings, or by clearing the cookie.

Google Analytics collects device and browser information, approximate location, referral information, and page views. We review this data in aggregate to improve the service.

Analytics data is used only for measurement. We do not use it to identify you personally, sell it, or use it for advertising.

You can opt out of Google Analytics across all websites by installing the Google Analytics opt-out browser add-on.

Why we are allowed to hold it

We hold the data described here to perform our agreement with you, which covers your account, your subscription, the tools you run, and the credits you spend.

We rely on our legitimate interests to keep the service working and to prevent abuse, which covers the one grant per address check, blocking accounts that break the terms, and basic security logging.

We rely on your consent for analytics cookies, and on legal obligation for the records we have to keep for tax and accounting.

Who we share it with

We share data only with the service providers that make a feature work, and only what that feature needs. They are bound to use it only for what we ask, and they process it on our instructions.

Payments go to our payment processor Stripe. Content you submit for processing goes to the specific service behind the tool you ran. Discord and Google handle the sign in and the channel connections. Google Analytics measures site usage.

Some of these providers are outside the country you live in, so your data may be processed elsewhere, including in the United States. Where that happens we rely on the safeguards those providers put in place for international transfers.

We may also disclose data if the law requires it, or where it is needed to enforce these terms or protect someone from harm.

How long we keep it

Your account record, credits, and subscription details stay while your account exists, and subscription records stay longer where tax and accounting rules require it.

Tool output is kept until you delete it from its page. Session data expires on its own after seven days.

The anti-abuse file of hashed addresses is kept for as long as the free grant exists, because deleting it would let the offer be claimed again.

Your choices and rights

Depending on where you live, you may be able to ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on our legitimate interests, and receive it in a portable format.

You can do some of this yourself: removing a channel deletes its stored data and its tokens, deleting a review or a tool result deletes its file, and turning analytics off in Settings stops the measurement.

You can also revoke access at any time from your Google Account permissions page, or from the Authorized Apps page in your Discord user settings. Either ends our ability to read anything further.

For anything else, write to [email protected], and we will respond. You will not be charged for exercising these rights, and we will not treat you differently for asking.

If you are not happy with our response, you can complain to the data protection authority where you live.

Age

ScaleTool is not intended for children under 13, or under the age where you live if that is higher, and we do not knowingly keep data about them. If you believe a child has given us data, contact us and we will remove it.

Changes to this policy

If we change what we collect or who we share it with, we will update this policy and change the date at the top, and we will tell you before a material change takes effect.