Privacy Policy

Who we are

GrumpTools ("we", "us") provides a set of online tools for content creators. This policy explains what we collect, why, who we share it with, and how long we keep it. It covers the GrumpTools website, the desktop app, and the GrumpTools Assist browser extension.

GrumpTools is operated by an individual developer based in Illinois, United States, who is the controller of the personal information described here. For anything in this policy, including requests to access or delete your data, contact [email protected].

Your use of the Service is also governed by our Terms of Service, which include an arbitration agreement, a class action waiver, and limits on our liability.

What we collect

Account information

When you create an account we store your email address, an optional display name, and a hashed version of your password. We never store your password in a readable form.

You can also sign in with Google instead. If you do, Google gives us your email address, your name and your profile picture, and we store an account record linking your GrumpTools account to your Google account id, together with the OAuth access and refresh tokens Google issues for that sign-in. Signing in asks Google only for your basic profile and email address. It does not request access to your YouTube channel: that is a separate, optional connection, described below, with its own tokens. An account created this way has no password until you choose to set one.

Files and content you submit

The tools work on what you give them. Depending on the tool, that can include video, audio and image files you upload, text prompts you write, links to public videos, and screenshots. We also record basic details about your uploads such as the original filename, size and file type.

Some tool results contain content derived from your files. For example, transcription produces the text of your audio, and Stream Finder produces the list of names read from a screenshot you provide. These results are stored alongside the job so you can retrieve them, and are deleted on the schedule below.

Your YouTube connection (optional)

If you connect a YouTube channel, we store an access token and refresh token for it, encrypted at rest, plus your channel's public name, handle, avatar, follower count, and the email address of the Google account you connected. See the YouTube section below for exactly what we do with that access.

Technical information

We store your IP address and browser user agent against each active login session, so you can review and revoke your own sessions from the account page. We also use your IP address, held only briefly in temporary storage, to apply rate limits and to meter free usage for people who are not signed in. We do not build advertising profiles from it.

How we use it

• To run the tool you asked us to run, and to give you the result.
• To authenticate you, keep you signed in, and let you manage your sessions.
• To enforce plan limits, daily quotas and rate limits, and to prevent abuse.
• To operate paid plans and process payments, if you subscribe.
• To understand how the product is used in aggregate, so we can improve it (see Analytics).
• To contact you about your account or, if you enable it, to notify you when someone downloads a file you shared.

We do not sell your personal information for money. To show ads to free accounts, and only if you consent, we share limited information (such as a cookie or device identifier and your IP address) with Google and its advertising partners so they can serve and measure ads. Paid accounts share nothing for advertising. See Advertising and US state privacy rights for your choices.

How long we keep it

Files are not stored permanently. GrumpTools is a processing tool, not a backup service, and you should keep your own copy of anything you care about.

Who we share it with

We use a small number of service providers to run GrumpTools. They only receive what they need to do their job, and only when you use the relevant feature.

We may also disclose information if we are legally required to, or where it is necessary to protect our rights or the safety of others.

AI processing

Two tools send your content to Google's Gemini API: the AI thumbnail generator (your prompt and any reference images) and Stream Finder (the screenshot you upload, which may show usernames visible on screen). Do not submit content you are not comfortable sending to a third-party AI provider.

Transcription uses a third-party speech-to-text provider. When you use the Transcript Generator or Auto Subtitles, we extract the audio from your file and send that audio to Groq, which converts it to text and returns it to us. Only the audio is sent, never the video, and never your name, email or account details. Groq states that it does not use API inputs to train models. If that service is unavailable, transcription is unavailable until it recovers.

YouTube API Services

Several tools use YouTube API Services. By using them, you also agree to be bound by the YouTube Terms of Service, and Google's Privacy Policy applies to information Google receives.

If you connect your YouTube channel, we request only the access needed to run the tools you chose:

• Reading and editing your videos' descriptions, so the Bulk Description Editor can apply the changes you preview and approve.
• Uploading a video, so the Music Copyright tool can upload a private check video to your channel to see what claims it triggers. That video is never public, and we delete it automatically after 7 days. We verify a marker we placed in the video's own description before deleting it, so we can never delete one of your real videos.
• Reading the comments on your videos, so Comment Wall can find the ones that mention the words you search for. Only your own channel can be searched. Results are held for up to 10 minutes to save repeat searches, are never stored in our database, and are deleted when you disconnect your channel. The video you render from them is kept like any other tool's output.

Limited use. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to provide the features you asked for. We do not use it for advertising, we do not sell it, we do not transfer it to others except as required to provide the feature or by law, and we do not allow humans to read it except with your explicit consent, to resolve a support issue you raised, for security purposes, or where required by law.

You can disconnect your channel at any time from the Connections page, which deletes the tokens we hold. You can also revoke our access directly through your Google account permissions page.

Cookies

We use one essential cookie to keep you signed in. It is required for the service to work and is always on.

Analytics may also set cookies, but when, and whether we ask first, depends on your region (see Analytics below). Google advertising cookies (free accounts only) are set only if you accept in the consent banner, and paid accounts get no advertising cookies at all. You can turn analytics off, or withdraw ad consent, at any time using the Cookies link in the app.

Crash reports and analytics

Crash reports — always on

When something in the app breaks, we always collect an anonymous crash report so we can find and fix the bug. This is diagnostic, not tracking: it records that our software failed. These reports run without cookies, without any persistent identifier, and are not linked to your account, your profile, or anything you do. We rely on our legitimate interest in keeping the Service working and secure, so they are collected whether or not you accept analytics below. Our server also records its own errors, which are ours, not yours.

Desktop app install counts — always on

The desktop app tells us how many copies of it are in use. When it opens on a new day, it sends us its version number and whether this is its first time running, or its first time that day, week or month. That's all it sends: no identifier, no account and no details about you or your computer, and we keep only daily totals, so we can't tell one install from another. The app remembers on your computer only which days it has already counted. We rely on our legitimate interest in knowing whether the app is used and which versions still need support.

Analytics — depends on where you are

We use PostHog to understand how the product is used, which tools people use and where they run into limits. When it's on and you're signed in, this is not anonymous: it's associated with your user id, email address, display name and plan. Whether we ask first depends on your region:

• In the EU, UK and EEA, we do not run analytics at all until you accept in the consent banner.
• Elsewhere, including the United States, we run first-party analytics by default, and you can opt out at any time.

Either way, you can turn analytics off using the Cookies link in the app, and we treat a browser "Do Not Track" or Global Privacy Control signal as an opt-out. To delete your analytics history, email [email protected].

Session replay — only with your consent, everywhere

We also offer session replays, which reconstruct how you moved through the interface. Unlike analytics, these only ever run if you explicitly accept, in every region, regardless of the default above. The text you type is masked and is not captured, so passwords, file names and message contents are never recorded.

Sharing files with File Transfer

File Transfer creates a public link. Anyone who has the link can download the file, without signing in, until it expires or reaches its download limit. Treat the link as the key: only send it to the people you intend to have the file. You can add a password, cap the number of downloads, and set an expiry between 1 hour and 7 days.

We store only a hashed form of the link token and of any password, so they cannot be recovered from our database. If you turn on notifications, we email you when your file is downloaded. We never email the recipient.

Browser extension

The GrumpTools Assist extension adds a save button to video thumbnails on youtube.com. It runs only on youtube.com, and it talks to our server in exactly two situations:

• When you click save, it sends us the video id, whether the video is a Short or a regular video, and the note you typed, if you typed one (up to 200 characters). That is the whole request. It does not send the title, channel name, view count, thumbnail image or anything else from the page; we build the thumbnail link from the video id ourselves. Our server rejects any request that carries more.
• When you open the extension's popup, it asks our server who is signed in (your email) and on which plan, so it can show that and offer sign-in if you are not.

Saved thumbnails and their notes appear in your Thumbnail Inspo gallery, where you can edit or delete them at any time. They stay until you delete them or delete your account. The extension does not track your browsing, contains no analytics, and stores no credentials of its own: it reuses the session cookie you already have with us. On your computer it keeps only its own button display setting.

Advertising

Free accounts see ad slots; paid plans see no ads at all. Today those slots show only our own messages about GrumpTools plans. No advertising network is loaded, no advertising cookie is set and nothing about your visit is shared with an advertiser.

If we start serving third-party ads (for example through Google), we will update this policy first and ask for your consent before any advertising cookie is set. No ads would be personalised and no advertising cookie would be loaded until you accept in the consent banner, and a Global Privacy Control or Do Not Track signal would be treated as a refusal. You would be able to change your choice at any time using the Cookies link at the bottom of the app, and to opt out of personalised advertising directly through Google's Ads Settings or the industry pages at aboutads.info and youronlinechoices.eu.

Security

Connections are encrypted in transit with HTTPS. Passwords are hashed, YouTube tokens are encrypted at rest, and share links and share passwords are stored only as hashes. Access to each account's data is scoped to that account.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You use the Service at your own risk, and you are responsible for keeping your password confidential. If a breach affects your personal information, we will notify you and any regulator as required by applicable law.

Biometric information

We do not collect, capture, store, or use biometric identifiers or biometric information, as those terms are defined by the Illinois Biometric Information Privacy Act (BIPA). Our tools do not perform face recognition, face geometry scanning, fingerprint or iris scanning, or voiceprint analysis. Where a tool works on a video that happens to contain a person, it treats it purely as pixels and audio, and derives no biometric template from it.

US state privacy rights

We do not sell your personal information for money. However, serving personalised Google ads to free accounts may count as "sharing" for cross-context behavioural advertising, and as a "sale" or "share", under California and other US state laws. You can opt out at any time by rejecting ads in the consent banner, using the Cookies link in the app, or through Google's Ads Settings. We treat a Global Privacy Control signal as a valid opt-out. We do not knowingly sell or share the personal information of anyone under 16.

If you live in California, Virginia, Colorado, Connecticut, Texas, or another state with a comprehensive privacy law, you may have the right to know what personal information we hold about you, to obtain a copy of it, to correct it, to delete it, and to appeal a decision we make about such a request. We will not discriminate against you for exercising any of these rights. To make a request, email [email protected] from the address on your account. We may need to verify your identity before we act, and you may use an authorised agent.

The categories of personal information we collect, why, who receives it and how long we keep it are set out in the sections above.

Third-party links and content

The Service links to and surfaces content from other sites, including YouTube, Twitch and Kick. We do not control those sites, they have their own privacy policies, and we are not responsible for what they do with your information.

Your rights

Depending on where you live, including in the EU, UK and California, you may have the right to access a copy of your data, correct it, delete it, receive it in a portable format, restrict or object to how we process it, and withdraw consent. You also have the right not to be discriminated against for exercising these rights.

To exercise any of them, or to delete your account and everything in it, email [email protected] from the address on your account. We will action it within 30 days. Deleting your account removes your account record, your jobs and their files, your saved thumbnails, your bookmarks, your file transfers, and any connected channel's tokens.

Children

GrumpTools is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact [email protected] and we will delete it.

International transfers

Our servers are located in the United States, and our providers may process data elsewhere. If you use GrumpTools from outside the United States, you understand that your information will be transferred to and processed there, under laws that may differ from those in your country.

Changes to this policy

We may update this policy. If we make a significant change, we will update the date at the top of this page, and where the change materially affects you we will tell you in the app or by email.

Contact

Questions, data requests, or anything else: [email protected].