Privacy policy

Spike watches YouTube channels you add and surfaces uploads that cross a view threshold. We collect the minimum needed to run your account and show those events.

• We do not sell your personal data.
• We do not train AI or machine learning models on your account or on YouTube data we retrieve.
• We use DataFast for first-party analytics (pageviews and payment attribution). We also load a Google Ads tag and a Meta Pixel to measure advertising campaigns.
• You can deactivate the account in settings. Email us if you want the stored data deleted.

This policy should be read together with our terms of service.

Spike for YouTube is operated by Artem Starostenkov, a sole proprietor (jednoosobowa działalność gospodarcza) in Poland, trading as Artem Starostenkov Software (NIP 9512459479). References to “Spike”, “we”, “us”, or “our” mean Artem Starostenkov. The data controller for personal data processed under this policy is Artem Starostenkov. You can reach us at direct@spike.yt.

Account. When you sign up we collect your email address. You may later add a display name and an optional password. Passwords are stored as a hash. We send short-lived 6-digit codes to verify email and reset a password; those codes are stored hashed and expire in minutes.

Content you create. Projects (name, description, color), watches (YouTube channel id, title, thumbnail URL, view threshold, time window, status), webhook endpoints (name, HTTPS URL, optional signing secret, status), and API keys (name, prefix, hash, last used time).

Events and deliveries. When a watch fires we store the video id and title, channel id and title, publish time, public view count, threshold, window, and — when we can calculate it — views added in about the last hour. For webhooks we store delivery status, attempts, last HTTP status, and a short error. We do not persist the response body from your endpoint.

Billing. Paid subscriptions are processed by Stripe. We never see or store your card number. We store the Stripe customer id, subscription id, price id, plan, status, channel limit, and period dates so we can give you the right limits. Stripe’s processing is described in the Stripe privacy policy.

Hosting metadata. Our host may see standard request data (timestamp, route, response code, IP address) to serve the site and stop abuse. We do not store IP addresses in the product database.

Analytics. DataFast records pageviews, referrer, and device data so we can see which channels bring visitors. When you start checkout we pass the DataFast visitor and session ids to Stripe so a paid subscription can be attributed. DataFast’s processing is described in the DataFast privacy policy.

Advertising measurement. We load the Google Ads tag and the Meta Pixel so we can see whether ads led someone to the site, sign in, or start registration. Google and Meta may set advertising cookies and receive the page URL, referrer, and device data. That processing is described in the Google Privacy Policy and the Meta Privacy Policy.

• To create and operate your account, including sign-in codes and an optional password.
• To watch the channels you add and show threshold events in the dashboard.
• To POST signed webhooks to URLs you configure, and to expose watches and events on the API.
• To send service email (sign-in codes, password resets, billing receipts, security notices).
• To process payments, enforce plan limits, prevent abuse, and meet legal obligations.
• To understand site traffic and attribute paid subscriptions to marketing channels (DataFast).
• To measure advertising campaigns (Google Ads, Meta Pixel).

We do not sell or rent your personal data. The Google Ads tag and Meta Pixel are for campaign measurement; Google and Meta may also use cookies for ads reporting as described in their privacy policies.

We retrieve publicly available metadata for channels you explicitly add: channel id, title, and thumbnail; and, for matching uploads, video id, title, thumbnail, publish time, and public view counts. We do not access private videos, private comments, or a YouTube account login.

That metadata is stored so watches and the dashboard can work. If you configure a webhook or call the API, the same public fields may be sent to you. You are responsible for any endpoint you point us at.

Spike is not affiliated with YouTube or Google. Use of YouTube is also governed by the YouTube Terms of Service and the Google Privacy Policy.

We share information only with the services needed to run Spike, and only the minimum they need:

• Hosting (Vercel).
• Email delivery (OVH SMTP, from Spike at our spike.yt mailbox).
• Payments (Stripe).
• Analytics (DataFast). See the DataFast privacy policy.
• Advertising measurement (Google Ads). See the Google Privacy Policy.
• Advertising measurement (Meta Pixel). See the Meta Privacy Policy.
• YouTube, to retrieve public metadata for channels you add.
• Bot checks (Cloudflare Turnstile) when you create an account or reset a password. See the Cloudflare privacy policy.

We may also disclose information if required by law, to protect Spike and its users, or in connection with a corporate transaction such as a sale of the service. We will never sell your personal data.

• Account, projects, watches, events, webhooks, API keys, and delivery log: kept while the account is active or deactivated (deactivation is recoverable from our side).
• If you ask us to delete the account, we remove that product data. Billing records may be kept as required by tax and accounting law.
• Email codes expire within minutes and are invalidated when a new code is issued.
• The session cookie lasts 14 days.
• Deleting a watch stops that condition. Past events stay until you or we delete them.
• Hosting and mail providers may keep short-lived operational logs on their side.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. In the dashboard you can edit your name, change or remove a password, deactivate the account, revoke keys and webhooks, and export recent events.

Email direct@spike.yt to request access or deletion, or if a stored event is about you and you want it reviewed. Include the account email (or enough to identify the record). We will respond within 30 days or sooner when applicable law requires it.

We use TLS in transit, hashed passwords, hashed API keys, an httpOnly session cookie, and least-privilege access to the systems that run the product. No service can guarantee perfect security.

Spike sets a small number of first-party cookies needed to run the product and measure traffic. Google Ads and Meta may also set advertising cookies:

• spike_session — keeps you signed in (httpOnly, 14 days).
• spike_project — remembers the project selected in the dashboard (httpOnly, about 400 days).
• datafast_visitor_id — DataFast visitor id for analytics and payment attribution.
• datafast_session_id — DataFast session id for the same purpose.
• _gcl_au and related Google conversion cookies — set by the Google Ads tag to measure ad clicks and page views.
• _fbp and related Meta Pixel cookies — set by the Meta Pixel to measure ad clicks and page views.

The browser may also keep local UI preferences on your device (for example sidebar collapsed state). Those are not cookies and are not sent to us as account data.

Blocking the session cookie will prevent sign-in. Cloudflare Turnstile may set its own cookies on challenges.cloudflare.com during signup or password reset. Those are not used for advertising.

Spike is operated from Poland and served from Vercel. Stripe handles payments, DataFast handles analytics, Google and Meta measure advertising, OVH sends email, and Cloudflare Turnstile checks that signup and password-reset requests are human. Those providers may process information in the United States, Europe, or other regions. Transfers remain subject to applicable data protection law.

Spike is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. If we make material changes we will notify you by email or in-product banner. The “Last updated” date at the top of this page always reflects the current version.

Questions about this policy or your data?

• Artem Starostenkov, trading as Artem Starostenkov Software
• NIP 9512459479
• Email direct@spike.yt