Privacy Policy
What SpotTheCatch collects, why, and how to make us delete it.
Last updated: 6 November 2026
What we collect
SpotTheCatch is a consumer tool. You send it a link to a public video. That is the core of the service, and it is the only thing we need from you to work.
| Data | Why | Legal basis |
|---|---|---|
| Your messaging platform user ID (a pseudonymous identifier such as your Telegram user ID or Instagram scoped ID) | To deliver your verdict, track your credit balance, and remember your saved links | Performance of a contract (providing the service you asked for) |
| The URL of the video you sent us, plus the analysis we produce from it | To answer your question and to cache verdicts so repeat checks are instant | Performance of a contract |
| Your language preference | To reply in your language rather than the video's language | Performance of a contract |
| Your email address, if you purchase a subscription | Billing and receipts | Performance of a contract |
| Approximate usage counts and cost tracking (no message content) | To keep the service affordable and to detect abuse | Legitimate interests (operating and securing the service) |
What we do NOT collect
- Your contacts, messages, photos, or videos from your device.
- Your follower lists, comments, or private account content.
- Location data.
- The raw video file beyond the moment of analysis. Downloaded media lives in temporary storage for a few seconds and is deleted immediately afterwards.
Who we share it with
We do not sell your data. We share the minimum needed with the service providers that run the product:
- Payment processors (for example Polar or Stripe) receive your payment details and billing address. They handle their own privacy compliance and act as a merchant of record where applicable.
- Video extraction and AI providers receive the public video you asked us to analyse, so the verdict can be produced. They process it on our instructions and do not use it to train their models.
- Search providers receive queries we generate to verify claims and pricing.
- Infrastructure providers (hosting, database, object storage) store the data listed in this policy.
How long we keep it
- Verdict cache: 30 days, then it is re-computed on demand.
- Your account and check history: until you delete it or close your account.
- Billing records: as long as tax law requires.
- Temporary media: deleted within seconds of analysis.
Preventing free-trial abuse
New accounts get a few free checks. To stop the same account deleting its data and signing up again for more, we keep a one-way fingerprint of your account ID (an HMAC hash) after you delete your data. If you bought the one-time First Pack, we keep a second fingerprint of the same kind so the offer cannot be bought again after a delete. Neither can be turned back into your ID, and they are used for nothing except deciding whether a new sign-up gets free checks and whether the First Pack is still available. Legal basis: legitimate interests (preventing abuse of a free or discounted offer).
If you are a creator whose video was checked
When someone sends us a public video, we store our analysis of it — what it claims, what we saw on screen, and our label — so the next person who checks the same video gets an instant answer. Our labels describe the video's claim and its evidence, not you as a person, and we do not show your handle on shareable cards by default. You can object to this processing, ask us to correct a verdict, or ask us to delete our stored analysis of your video by writing to privacy@spotthecatch.com with a link to the video. Legal basis: legitimate interests (helping viewers judge public claims).
AI disclosure
Every verdict is produced by an AI system and can be wrong. We say so on every verdict and card, and shareable images carry machine-readable AI-generated metadata.
Your rights under the GDPR
You have the right to access, correct, export, restrict, object to, and erase your personal data, and to withdraw consent where we rely on it. You also have the right to complain to your national supervisory authority.
You can exercise all of these yourself using the delete my data page, or by emailing privacy@spotthecatch.com. We respond within 30 days.
Security
Traffic is encrypted with TLS. Passwords are never stored (we use Telegram and Instagram sign-in only). Credit balances are protected by an immutable ledger with transactional guarantees against double-charging and double-crediting. We delete raw media immediately after analysis.
Children
SpotTheCatch is not directed at children under 16 and we do not knowingly collect their data.
Changes
We will update this page and change the date at the top when our practices change. Material changes will be announced in the Telegram channel.
Contact
Questions about this policy: privacy@spotthecatch.com