Last updated 2026-10-12.
This explains what we hold about you, why we hold it, and what you can ask us to do with it. “We” and “us” mean the makers of YTF Tool and of its phone app.
Your email address, which is how we identify your account. Your password, kept only as a hash — a one-way scramble that we cannot reverse and neither can anybody who obtains the file. The age range and country you give us when you register, which tell us who the tool is for and where to take it next. A fingerprint of your computer: six one-way hashes derived from hardware identifiers and from your Windows installation — we keep the hashes and never the identifiers themselves, they cannot be turned back into a serial number, and this is how one account stays on one computer and how we tell whether a computer has already had its free credits. We keep that fingerprint in a separate record of computers that have received free credits, alongside the address that received them, for that purpose alone. Your computer’s name, and the network address your requests come from. When your copy last checked in, and how many credits it has left. The title of a video at the moment it is counted, so that a repeated request cannot charge you twice for the same one. The name of the step the tool is on while it is running — for example “images” or “building the timeline” — which is how we see where people get stuck; it is the name of the step and never anything from your video. And the fact that you accepted these terms, when, and from where.
Your scripts, your voiceovers, your images, your finished videos and your own API keys stay on your computer. The tool does not send them to us, and we have no way to read them.
To run your licence and your allowance; to keep one membership on one computer; to answer you when something goes wrong; and to count how many people use the tool, so that we know where to put our effort next. We do not profile you and we do not advertise to you.
Nobody. We do not sell, rent or share your data. PayPal handles payments and sees only what a payment needs; your card details never reach us. The other services the tool uses run under your own accounts, not ours, and we pass them nothing.
For as long as you have an account, and for a short while afterwards so that a mistake can be undone. Ask us to delete it and we will: in the phone app (Account, then Delete my account), or on https://ytfpanel.com/ytf/delete-account, which needs no app. We finish a deletion within 30 days. The record of the payments you made is kept for as long as tax law requires.
A copy of what we hold, a correction to it, or its deletion. Write to admin@ytfpanel.com and we will do it.
The tool uses none. Our admin panel sets one session cookie, and only we sign in to that.
The licence database and the signing key sit outside the public web root. Passwords are hashed. Your copy of the tool holds a signed licence rather than anything of ours. No system is perfect and we will not pretend otherwise.
When you sign in on a phone we keep a sign-in record: your account’s email address, which kind of phone it is (Android or iPhone), when it signed in and when it was last used, so that you can see it and sign it out under Account. The phone keeps its sign-in token in its own secure storage; we keep only a one-way hash of it. When Phone link is switched on in the tool, your computer sends us what its run screen shows while a video is being made - the title, the step it is on, how far it has got and the last lines of its log - so that the phone can show it; we keep the last 20 runs. The titles you send from the phone, and the setup answers that go with them, are kept so that your computer can build them and the phone can show what became of them; we keep the last 50.
If you rent a cloud computer from the app, the app talks to your cloud provider (DigitalOcean, Hetzner, Vultr or Google) with the token you give it. That token is kept only on your phone, in its secure storage, and is sent only to that provider; the provider bills you directly, and we never see your payment details. The API keys you send to your cloud computer go from your phone straight to that computer and never to us. Your cloud computer pairs itself to your account with a one-time code and tells us its name, its address, its version, its certificate’s fingerprint and one-way hashes of the machine, and when it was last heard from, so that it appears among your cloud computers; Forget removes it.
The app has no ads, no analytics and no tracking. It reads nothing on your phone outside its own storage, and it never sends us your contacts, your location, your photos or your files.
If we change it, we will say so in the tool.
Write to admin@ytfpanel.com, or to us in the community you joined. To delete your account: https://ytfpanel.com/ytf/delete-account.