Privacy

Last updated 8 Jul 2026

The short version

  • What we collect: public YouTube data (channel statistics, video metadata, public comments) via the official YouTube Data API; Instagram data only after a creator explicitly connects their account.
  • How long: raw comment text and daily statistics are a rolling 30-day cache, refreshed or deleted. Our permanent records are numbers we compute ourselves — intent scores, category counts, weekly follower aggregates.
  • Commenter identity: never stored in readable form — a salted one-way hash, used only for aggregate counting. We never publish, expose, or analyze individual commenters.
  • What we never do: sell data, publish comment text, or present our metrics as YouTube's or Instagram's.
  • Deletion: see data deletion; disputes about your profile go to disputes.

What we collect, and from where

Tokopo indexes public information about travel creators. From the official YouTube Data API we collect channel statistics (subscriber, view and video counts), video metadata (titles, descriptions, statistics), and public comments on those videos. We do not scrape any platform, and we do not collect anything from private accounts.

Comment author identity is transformed into a salted one-way hash at the moment of collection. The hash exists to avoid counting one person twice; it cannot be reversed into a name, and we never analyze or publish anything about individual commenters.

Retention: a 30-day cache plus our own analytics

Raw platform data is a rolling cache: comment text and daily channel statistics older than 30 days are deleted unless they were re-fetched from the API in the meantime. What persists are Tokopo-computed records: Intent Scores and intent densities (with their category counts), and weekly follower aggregates (average and change per week) that we derive before daily rows expire. These derived numbers are our own analysis of public activity — they are not YouTube or Instagram metrics, and every one of them traces to a stored computation.

Connected accounts (creators who claim a profile)

When a creator claims their profile by connecting Instagram, we receive their account username and ID to verify ownership, and an access token that we store encrypted. We use connected-account access only for what the creator authorized: verifying identity and, where granted, analyzing their audience's comments in aggregate for their own Intent Score. Disconnecting the app from Instagram settings, or asking us, deletes the token and the connection — see data deletion.

Sharing

We do not sell or rent data. Public pages show creator-level metrics we computed. Infrastructure providers (Amazon Web Services) process data on our behalf to run the service. We share data with authorities only when legally required.

Your rights

Creators can dispute anything on their profile (disputes — corrections for factual errors are guaranteed) and can delete connected-account data at any time (data deletion). Commenters: we hold no readable identity about you to delete — comment text itself expires from our systems within 30 days of its last fetch.

Contact

Tokopo · hello@tokopo.co. We reply from that address — expect an answer within 3 days.