Privacy policy

CrowdFighter uses YouTube API Services to display public videos and channel information. Public browsing does not require an account. We do not ask for access to your YouTube account or collect your YouTube credentials.

Information we use

We store public video and channel metadata, original CrowdFighter editorial information, and import results. YouTube metadata is refreshed periodically and expires after 29 days if it cannot be refreshed. Your searches are processed to return results; CrowdFighter does not store them in a user profile. Our hosting provider may process request logs, including IP addresses, for security and delivery.

YouTube and your device

Thumbnails are loaded from YouTube’s image servers, which receive ordinary network request information. The embedded player is loaded after you accept. We remember this choice in your browser’s local storage so you do not have to accept on every video page. Videos do not autoplay. YouTube may then collect device information, use cookies or similar technologies, and serve content including advertisements. We use the privacy-enhanced embed domain. YouTube permission is separate from the optional Google Analytics choice described below.

To clear your choice and unload the current player, select “Reset YouTube permission” below a video player. Future video pages will ask again. Clearing this site’s browser data also clears your choice. If browser storage is blocked, the choice lasts only while this tab remains open without a full page reload. This control does not clear data already held by YouTube or Google.

See the Google Privacy Policy and YouTube Terms of Service. You can manage Google account permissions in Google security settings.

Optional Google Analytics

If you select “Accept analytics”, we load Google Analytics to measure visits, traffic sources, page views and interactions such as scrolling, outbound links and supported video playback. Google may process page addresses (including search terms in URLs), referring sites, browser and device information, and analytics cookie identifiers. We do not send account email addresses or comment text as analytics events. Advertising storage, advertising personalisation and Google signals are disabled in our integration.

Analytics is off until you accept. We remember acceptance or refusal in your browser’s local storage. Select “Cookie settings” in the footer to change your choice. Declining after acceptance stops our analytics, clears accessible Google Analytics cookies for this site and reloads the page to unload the Google tag. It does not erase information already received by Google or change your YouTube permission. If browser storage is unavailable, your choice lasts only until a full page reload. Google’s privacy policy linked above explains how Google processes information.

Reader accounts and comments

Commenting is optional. We store your email address, chosen public display name, email verification date and comments. Your email address is not shown publicly. Sign-in codes expire after 10 minutes, are stored only as keyed hashes and can be used once. Resend processes your email address and sign-in email to deliver the code. See Resend’s privacy policy.

A secure, HTTP-only reader session cookie keeps you signed in for up to 30 days. Signing out revokes that session. Temporary abuse-prevention counters are stored in MongoDB using hashed identifiers. Reader accounts do not grant access to the editorial desk.

Your comments and display name are public. You can delete your own comments; their text is erased while a placeholder preserves the reply thread. Reports are private to the editorial team and include your account identifier and selected reason. Reports and moderation audit records expire after 90 days. Blocking an account prevents posting and hides its comments until it is unblocked; separately removed comments stay removed.

Accounts and comments remain until removed. To request account deletion or other removal, contact us below. Reader information is stored separately from YouTube metadata and is not subject to that metadata’s 29-day expiry.

Administration

Administrators sign in with an email and password. Passwords are stored as salted hashes. A secure, HTTP-only session cookie expires after eight hours. Hashed session tokens and temporary login-attempt counters are stored in MongoDB. Editorial access is restricted to authenticated administrators.

Contact and removal requests

For privacy questions or requests about information stored by CrowdFighter, contact hello@crowdfighter.com. Removing a CrowdFighter record does not remove the original video or data from YouTube.