Privacy
The extension fetches the video's captions and sends them to our server, where a language model splits them into sections. Below we set out exactly what is sent, what we keep and who it is passed to.
Who is responsible for the data
The data controller - the one to write to about anything below - is:
- Name
- EMWU IT Services Michał Wojdyła
- Address
- ul. Nadbrzeżna Górna 4, 33-100 Tarnów, Polska
- Tax number (NIP)
- 8733009337
- contact@keyparts.app
What reaches the server
The transcript text of the video you point at, with its title, its channel name and the chapters from its description.
The video's id (eleven characters out of the YouTube address).
The ids of the videos on your screen, to mark the ones that already have sections.
Your account's token, in the header of every request.
On the Basic plan the transcript does not reach the server. The model built into Chrome reads it on your computer; what reaches us are the ids of videos and your token, as above.
What is kept of it
Account details: your e-mail address, your password in a form it cannot be read back from, the language of your e-mails, the dates your address was confirmed and your account activated, and the token the extension uses to connect to your account. If you buy the Pro plan, also the identifiers Stripe assigns and the date the plan is paid until.
Results: the video's id and title, the sections made for it, and technical details such as the model used and the cost. A result is shared: everyone who asks about the same video gets the same result. The only account recorded with it is the one that requested it first. The exception is a video whose page says not everyone may watch it - members only, unlisted or private: its result is kept for the account that asked and shown to nobody else.
Usage history: each time the language model splits a video into sections, we record your account, the video's id, its length, the cost and the date. The daily limit and our own spending are worked out from it. These entries are not deleted, because they are used for accounting.
The "saved for later" list: your account, the video's id and the date you saved it. An entry is made only when you click "Save" yourself. Removing an entry, or the whole list, deletes it at once.
The video's captions are not stored. They pass through the server to the language model, and only the result stays in the database.
What we don't collect
No tracking cookies. The site sets only one cookie: a session, when you sign in or open the sign-in or sign-up form. It keeps you signed in, guards the form against forgery and goes when you sign out. The public pages set none. Visits are counted by Umami on our own server: which page was opened, where the visit came from, the browser and the country. No cookie, no linking of visits and no IP address stored. The only outside script is Cloudflare Turnstile on the sign-up form, which checks that you are not a bot.
No browsing history, bookmarks or other tabs. The extension can reach only youtube.com and our server.
No picture and no sound from the video. Only the caption text YouTube displays anyway.
No profile of you. The videos you check are not used for ads or recommendations.
Who the data is passed to
OpenAI, L.L.C. - United States
The transcript text goes to an OpenAI language model, because that is what does the actual work. This is a transfer of data outside the European Economic Area. OpenAI states that data sent through the API is not used to train models.
OpenRouter, Inc. - United States
Some answers may be generated by an open language model reached through OpenRouter: the transcript text goes to OpenRouter and on to one provider chosen in advance (below). Every such request is routed only to providers that do not retain the data, with training on it refused. OpenRouter states that data sent through the API is not used to train models. This is a transfer of data outside the European Economic Area, based on standard contractual clauses.
Inference R&D, Inc. (InferenceNet) - United States
The provider on whose servers in the United States such an open model actually generates the answer. It states that it does not use customer data to train models, and it handles our requests without retaining them. This is a transfer of data outside the European Economic Area.
Google - in Chrome, on your computer
On the Basic plan the language model and the translator are parts of Chrome, provided by Google, and they work on your computer. We send nothing to Google; what Chrome does with them is set by Google's terms for Chrome.
Hetzner Online GmbH - Helsinki, Finland
The server the application and the database run on is in Finland, that is, in the European Union.
Stripe - Ireland and the United States
If you buy the Pro plan, the payment is taken by Stripe, which is the seller of record: Stripe sees your card and billing details, we never do. We pass Stripe your e-mail address and your account's number, and keep the customer and subscription identifiers it gives back. Receipts, invoices, refunds and cancellation are Stripe's; its own privacy policy applies to the payment.
Cloudflare, Inc. - United States
Cloudflare Turnstile runs on the sign-up form to check that you are not a bot, and sees your IP address and browser details while doing so. Mail you send to our contact address also passes through Cloudflare. This is a transfer of data outside the European Economic Area.
Resend, Inc. - United States
The e-mails we send you (address confirmation, password reset, notice that your account is active) are sent for us by Resend, which sees your address and the message. This is a transfer of data outside the European Economic Area.
How long we keep data
Results are kept with no time limit. That is what lets a video someone has already checked open straight away. They do not go when an account is deleted, because other people use them too. A result kept for one account alone goes with that account.
The "saved for later" list stays until you remove it. A single video goes with the cross on the list, the whole list with the button on the account page or in the extension's window. The list also goes when the account is deleted.
Deleting the account immediately removes your saved videos and your password and disconnects the extension. We keep only your e-mail address, so that no new account can be made with it, and the usage history, for accounting. If you want the address removed too, write to the contact address at the top of this page. We will remove it by hand and detach the results and the usage history from you.
Your rights
You have the right of access to your data, and to its rectification, erasure, restriction of processing, portability and objection, as well as the right to lodge a complaint with the President of the Personal Data Protection Office. To use them, write to the contact address at the top of this page.