Privacy policy
Effective 5 November 2026
CommentTribe is a browser extension for Chrome and Firefox. It has no accounts, and it keeps your data in your own browser. This page lists everything it sends anywhere, and why.
What stays in your browser
- The commenters you star, the communities you make, and your settings.
- Your activity history: the videos where CommentTribe found your starred commenters.
- Your YouTube API key, if you add one. CommentTribe only ever sends it to Google, as part of YouTube API calls. It is saved in your browser's synced extension storage, so if you use Chrome Sync or Firefox Sync, your browser also carries it to your other signed-in devices through that sync service.
None of this is sent to us. You can export it to a file or delete it at any time by removing the extension.
What is sent, and only when you use that feature
| Sent to | When | What |
|---|---|---|
| YouTube Data API (Google) | You have added an API key | The video and channel IDs being looked up, with your key. |
| CommentTribe Sync server | You turn on Community Sync (off by default) | IDs only: the comment, video and commenter IDs you found, the channel IDs you follow, and a random install ID. No names, no comment text, no account. The server keeps no request logs. |
| Mojang API | You set a Minecraft skin by name | The Minecraft username you typed. |
| mc-api.io | A Minecraft skin is shown | The Minecraft player ID. |
| Google (sign-in and Cloud APIs) | You choose "Sign in with Google" to make an API key, or "Get my key back" | See the next section. |
Signing in with Google to make an API key
Getting a YouTube API key normally means several steps in the Google Cloud console. CommentTribe can do
them for you if you sign in with Google and allow it. It asks for the
https://www.googleapis.com/auth/cloud-platform permission, and uses it only to:
- create one new Google Cloud project in your account, named "CommentTribe key" and labelled
made-by: commenttribe, - turn on the YouTube Data API (and the API Keys API) in that project, and
- create one API key in that project, restricted to the YouTube Data API, and read it so the extension can save it.
CommentTribe remembers that project's ID in your browser settings. If you run it again, or press "Get my key back" after your key was removed, it reuses that project and its key instead of making new ones, so it never uses up more of your Google Cloud projects. If the saved ID is gone (for example after reinstalling), it finds the project by its label, or by the "ct-key-" that starts the ID of every project CommentTribe makes. "Get my key back" never creates a project.
Then the extension revokes the permission it needed, straight away. It does not read, change or delete any of your other Google Cloud projects or data, and it does not keep the sign-in token. CommentTribe sends the token and the key only to Google, never to us or anyone else.
CommentTribe's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The project and key are yours. You can see or delete them any time in the Google Cloud console. You can also check and remove CommentTribe's access at myaccount.google.com/permissions.
Reading Google Cloud pages
Two features read pages on console.cloud.google.com, and only after you allow it in a browser prompt:
- The step-by-step key guide reads the Google Cloud pages you visit while it runs, to point at the right buttons and to pick up your new key when Google shows it.
- The "Sync Google API Quota" button reads one number from the quota page it opens: how much of the YouTube Data API's daily allowance your key has used today, so the extension's own count can match it.
Nothing read from these pages leaves your browser, and CommentTribe gives the access back as soon as it's done.
How your data is protected
We use encryption and security procedures to protect the confidentiality of Google user data and the rest of your information:
- Encrypted connections. Everything the extension sends, including all traffic to Google and to the CommentTribe Sync server, goes over HTTPS, which encrypts it in transit.
- Sign-in token held only briefly. The Google sign-in token stays in memory while the key steps run and is never written to storage. It is revoked as soon as those steps finish. If that can't happen, for example because the tab was closed, the token stops working when Google expires it, normally within about an hour.
- Limited API key. The key CommentTribe creates is restricted to the YouTube Data API. It is kept in the browser's extension storage, which websites can't read, and it is never included in backup files.
- No Google user data on our server. The sign-in token, your API key and your Google Cloud project details never reach the CommentTribe Sync server.
- Protected Community Sync server. If you turn on Community Sync, the server stores only YouTube IDs, not linked to your install. Its database is encrypted at rest with AES-256 by our hosting provider, Cloudflare. Request logging is off, and uploads are rate limited.
How long data is kept, and how to delete it
- Google sign-in token: not kept, as described above.
- Your API key and Google Cloud project: kept until you delete them. Remove the key with "Delete key" in Settings, and delete the project in the Google Cloud console.
- Data in your browser: kept until you remove the extension, which deletes it. Backup files you saved stay on your computer until you delete them.
- Community Sync server: finds that YouTube has confirmed are kept and re-checked about every 30 days. Finds that are never confirmed are removed after 90 days, and finds YouTube no longer returns are removed after 7 days. Rate-limit counters that include your random install ID are deleted after they expire, within about a day.
Questions or deletion requests can go to the address under Contact below.
What we never do
- Sell or share your data. We don't have it to sell.
- Show ads or use tracking or analytics.
- Read your Google or YouTube account, or sign in to YouTube.
Changes
If this policy changes, the new version will be posted here with a new effective date.
Contact
Questions about privacy: brandoblues@gmail.com