Legal
Privacy policy
In short
- KillSlop has no accounts, ads, analytics or tracking, and never sells data.
- Looking things up cannot tell the server what you watch or read. The extension looks up by the first 4 characters of a hash, never by the video or post itself.
- Four things can leave your browser: a mark you make, a channel measurement, feedback you write, and, only if you switch the writing check on, the text of a post that nothing else could place. You can turn each of them off, and the writing check is off until you turn it on.
- Removing KillSlop opens a page asking why. Answering is optional, and the link that opens it carries only which version you had, never an identifier.
- Two service providers: Cloudflare, which hosts the API and this site, and TypeSafe, which runs the writing check's model. TypeSafe is used only while you have that check switched on.
Who we are
KillSlop is an open-source browser extension that hides AI-generated videos and posts on YouTube, X
and LinkedIn, and a small public API at api.killslop.app that serves an open list of
them. It is run by its maintainer ("we" below). The source code is public at
github.com/heyitsR1/killslop, so every statement
in this policy can be checked against the code.
What stays on your device
The extension keeps these in your browser, inside its own storage. We never receive them.
- A verdict cache (IndexedDB): for each YouTube video it has checked, and each X post with images or video it has seen, whether the platform labels it as AI, where that verdict came from and when; for each channel or X account, how many of its sampled uploads carried the label; and which handle belongs to which channel or account id.
- Your marks: each video, post, channel or account you called AI slop or not slop, when, and the title and name shown on the Your marks page.
-
Your settings, in
chrome.storage.sync: the on/off switches and your hide or dim choice. If Chrome sync is on, Chrome copies these settings to your Google account, as it does for any extension. They contain no browsing data. -
A random install id, 32 hexadecimal characters in
chrome.storage.local, used only to count your votes once (see below). - A count of items hidden since Chrome started, held in memory and gone on restart.
The extension reads the YouTube, X and LinkedIn pages you open, in your browser, to find the video, post, channel and account ids on them. On X it also reads, inside the page, the post data X has already sent to that page, to see which posts X itself labels as made with AI. That reading happens locally. With the writing check off, which is how it ships, nothing about the pages you view is sent to us. With it on, the single exception is set out under the writing check below.
What leaves your device, and when
Looking things up in the community list
When the Community list switch is on, the extension computes the SHA-256 hash of each video, post,
channel or account id on the page and sends only the first 4 hexadecimal characters
to api.killslop.app. The server replies with every entry in that bucket, one of 65,536,
and the extension finds its own matches locally. The server never receives an id you are asking
about, so it cannot reconstruct what you watched or read.
Your marks
When Contribute reports is on and you press AI SLOP or Not slop, or hide a whole channel or account,
the extension sends the id of what you marked, whether you called it slop, the platform
(youtube, x or linkedin) and your random install id. Removing a
mark on the Your marks page sends the same id again to take the vote back. With Contribute reports
off, your marks stay on your device.
Channel measurements
When Contribute reports and the Community list are both on, and what you come across shows that a YouTube channel or an X account crosses the threshold (on YouTube, at least 60% of at least 5 sampled uploads carry YouTube's AI label; on X, at least 25% of at least 8 posts with images or video carry X's AI label), the extension sends that channel's or account's id and handle if known, the two counts, and your install id. It does this once per channel or account. LinkedIn has no AI label, so nothing is measured there.
The writing check
Off unless you switch it on in the popup. X labels AI images and video but never text, and LinkedIn labels nothing at all, so a post made only of words cannot be placed any other way. When the check is on, three things happen in this order, and most posts never get past the first.
- The extension reads the post's text in the page and compares it with a list of signs of AI writing. A post showing none of them is settled there, in the page, and its text is not sent anywhere.
- For a post that does show them, the extension sends the first 4 hexadecimal characters of the SHA-256 hash of its text, and gets back every answer in that bucket. A post that anyone has had checked before is answered here, with no text sent.
-
Only a post that shows the signs and that nobody has ever had checked has its text sent to
api.killslop.app, which passes it to TypeSafe's model and returns a score. No id, no install id, no account and nothing about you goes with it.
The server stores the hash of the text and the score. It does not store the text. Nothing kept there can be turned back into a post, or assembled into anyone's feed, and the next person who meets the same post is answered from that hash without sending anything at all.
Feedback
Only when you send it. From the extension's Send feedback page: the category, your message, your email address if you choose to give one, and the extension version. If you opened that page from a YouTube, X or LinkedIn tab and leave "Include the page you were on" ticked, that page's link is added to your message.
The same form is on this site, at killslop.app/support, for anyone who cannot reach the popup or has already removed the extension. It sends the category, your message, and your email address if you give one, and nothing else: there is no extension version to report and no page to attach. It reaches the same inbox and is kept as the same kind of record. That page counts no visits, sets no cookies and loads no analytics.
Removing KillSlop
When you remove the extension, Chrome opens killslop.app/uninstall. The link the extension registers carries one thing: which version you had. There is no install id on it, and nothing on it could be joined to your votes. That page counts no visits, sets no cookies and loads no analytics.
Opening it sends nothing. Pressing one of the reasons sends that reason and the version. If you then write a note, or leave an email address for a reply, those are sent as well. It reaches the same inbox as Send feedback and is kept as a feedback record, as set out in the table below.
The waiting list
Before the extension was listed in the Chrome Web Store, this site had a waiting-list page that took
an email address and nothing else, plus the ?from= tag on the link you arrived by if it
had one: a short word we wrote into our own launch posts, saying which post an address came from and
nothing about you. The listing went live on 22 September 2026 and the page is gone; the address now
sends you to the store.
An address on that list is used for one email, telling you the listing is live, and for nothing else. It is never published, never added to the list of accounts, and cannot be looked up through the API. Once that email has gone out the list is deleted. Ask us any time and yours goes sooner.
Requests to YouTube
To read a video's AI label, the extension asks YouTube about that video from the YouTube page you are
on, with cookies left out, so the request is never tied to your YouTube account. It does this in the
background, about 1 KB at a time, once per video. The Your marks page shows thumbnails from YouTube's
image server (i.ytimg.com) and, for older marks saved without a title, fetches the title
from YouTube's public oEmbed endpoint, also without cookies. These requests go to YouTube, under
Google's privacy policy, and not to us. The extension makes no requests of its own to X or LinkedIn.
What the server keeps, and for how long
Like any website, the API sees your IP address when your browser connects. It uses it for rate limits and, for votes and feedback, to count one network once. It never writes your IP address to the database in the clear, and we keep no request logs. A "network" means your IPv4 address, or the /64 block of an IPv6 address, so one household counts once.
| Record | What it holds | Kept |
|---|---|---|
| List entry | A video, post, channel or account id, the platform, vote and measurement counts, the review decision, and times. For the maintainer's review of YouTube entries, the public title and channel name looked up from YouTube. | As long as the list exists |
| Vote |
Which entry, slop or not, when, and two keys: sha256(install id + entry + salt)
and sha256(network + entry + salt), where the salt is a secret held only by the
server.
|
Until you remove the mark, or the entry is removed |
| Measurement | The same two keys and a time; the counts are added into the entry. | As long as the list exists |
| Writing check answer |
sha256(post text), the score, which sign matched most, the model's name and a
time. Not the text, and nothing about who asked.
|
As long as the list exists |
| Feedback | Category, message, your email if given, extension version, time, and your network as a salted hash. | Until the maintainer deletes it |
| Waiting list | Your email address, the time, which of our launch links you came from if any, and your network as a salted hash. | Until the launch email has been sent, or you ask us to remove it |
Because each key is hashed together with one entry, the keys are enough to count you once per entry, and not enough to link your votes on two different entries to each other, or back to you. We cannot tell which votes or measurements are yours.
What is public
Decided channels, X accounts and LinkedIn authors are published under
CC BY-SA 4.0 at
/api/v1/export/youtube-channels.json,
/api/v1/export/x-accounts.json
and
/api/v1/export/linkedin-authors.json:
the id, the kind of evidence, whether it was reviewed, the vote score, the measurement counts and when
it last changed. The lookup endpoint serves the same decisions by hash, and
/api/v1/stats publishes totals. Videos and posts are never exported, no post text is ever
published, and nothing about who voted, measured or sent feedback is ever published. The votes and
measurements you contribute become part of that list under the same licence.
How it is protected
- Everything travels over HTTPS, and every request the extension makes to us leaves out cookies.
- Requests are rate-limited per network by Cloudflare's rate limiter, which counts requests without us storing anything.
- The maintainer's review console is behind a password and a signed, HttpOnly session cookie, and it is the only place feedback can be read.
Service providers
Cloudflare, Inc. hosts the API and this website (Cloudflare Workers), stores the database (Cloudflare D1), and enforces the rate limits. Cloudflare processes connection data such as IP addresses to deliver requests, under its own privacy policy.
TypeSafe runs the model behind the writing check, and receives the text of a post only while you have that check switched on and only for a post nobody has had checked before, under its own terms. It receives the text alone: no id, no install id and nothing about you. With the check off it is never contacted.
Donating is a page of its own, killslop.app/donate. Both the site's Donate button and "Support the project" in the popup open that page, and it is the page that links out to buymemomo.com, where donations are handled under that site's own terms. Opening our page sends nobody anything; following the link out takes you there, and we send them nothing about you. Nothing in KillSlop is behind a payment, and the extension knows nothing about whether you gave.
We use no other processor: no analytics, no advertising, no payment provider and no email service. The waiting list is stored at Cloudflare with everything else, and the launch email has not been sent yet. If we use a mail provider to send it, this policy will name that provider here before a single address is handed over.
What we never do
- Sell, rent or trade any data.
- Use data for advertising, credit decisions or profiling, or pass it to data brokers.
- Build a history of what anyone watches or reads, on the device or on the server.
- Let anyone read what you sent, apart from the maintainer reading feedback and reviewing list entries, and TypeSafe receiving a post's text while the writing check is on.
- Store the text of a post. The writing check keeps its hash and its score, never its words.
Chrome Web Store user data
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. KillSlop uses what it handles only for its single purpose: hiding AI-generated content and keeping the open list that does it.
Your choices
- Writing check off, which is how it ships: no post text is ever sent, and TypeSafe is never contacted.
- Community list off: no lookups and no channel measurements are sent.
- Contribute reports off: no marks and no measurements are sent; your marks stay on your device.
- Platforms, in the popup: turn KillSlop off on YouTube, X or LinkedIn separately.
- Reset local data, in the popup: clears the verdict cache and your marks.
- Uninstall: Chrome removes everything the extension stored on your device.
Deleting what you sent
To take back a vote, remove the mark on the Your marks page while Contribute reports is on. To have feedback or an email address you sent deleted, reply to our email if you received one, or open an issue on GitHub saying roughly when you sent it, without posting your email address there. We will delete it. Votes and measurements cannot be found by person, because we cannot tell which ones are yours; they hold nothing that identifies you.
To come off the waiting list before the launch email goes out, open an issue saying so without posting your address there, and we will reply with a private way to send it. The launch email itself carries a removal line, and the whole list is deleted once it has been sent.
Children
KillSlop is not directed at children under 13, and we do not knowingly collect personal information from them. The only personal information the service can receive is an email address someone chooses to type into feedback or into the waiting-list page. If a child has sent one, ask us and we will delete it.
Changes
When this policy changes, the new version is published on this page with a new effective date, and every earlier version stays readable in the project's public history on GitHub.
Contact
Questions and requests: open an issue on GitHub. To report a security or privacy problem privately, use the repository's Security tab, then Report a vulnerability.