Legal
Privacy policy
In short
- KillSlop has no accounts, ads, analytics or tracking, and never sells data.
- The server cannot learn what you watch. The extension looks things up by the first 4 characters of a hash, never by the video itself.
- Only three things send the ID of a video or channel: a mark you make, a channel measurement, and feedback you write. You can turn each of them off.
- The only service provider is Cloudflare, which hosts the API and this site.
Who we are
KillSlop is an open-source browser extension that hides AI-generated videos on YouTube, and a small
public API at api.killslop.app that serves an open list of them. It is run by its
maintainer ("we" below). The source code is public at
github.com/heyitsR1/killslop, so every statement
in this policy can be checked against the code.
What stays on your device
The extension keeps these in your browser, inside its own storage. We never receive them.
-
A verdict cache (IndexedDB): for each video it has checked, whether YouTube labels
it as AI, where that verdict came from and when; for each channel, how many of its sampled uploads
carried the label; and which
@handlebelongs to which channel id. - Your marks: each video or channel you called AI slop or not slop, when, and the title and channel name shown on the Your marks page.
-
Your settings, in
chrome.storage.sync: the on/off switches and your hide or dim choice. If Chrome sync is on, Chrome copies these settings to your Google account, as it does for any extension. They contain no browsing data. -
A random install id, 32 hexadecimal characters in
chrome.storage.local, used only to count your votes once (see below). - A count of videos hidden since Chrome started, held in memory and gone on restart.
The extension reads the YouTube pages you open, in your browser, to find the video and channel ids on them. That reading happens locally. Nothing about the pages you view is sent to us.
What leaves your device, and when
Looking things up in the community list
When the Community list switch is on, the extension computes the SHA-256 hash of each video or channel
id on the page and sends only the first 4 hexadecimal characters to
api.killslop.app. The server replies with every entry in that bucket, one of 65,536, and
the extension finds its own matches locally. The server never receives an id you are asking about, so
it cannot reconstruct what you watched.
Your marks
When Contribute reports is on and you press AI SLOP or Not slop, or hide a whole channel, the extension
sends the id of the video or channel you marked, whether you called it slop, the platform
(youtube) and your random install id. Removing a mark on the Your marks page sends the
same id again to take the vote back. With Contribute reports off, your marks stay on your device.
Channel measurements
When Contribute reports and the Community list are both on, and the videos you come across show that
a channel crosses the threshold (at least 60% of at least 5 sampled uploads carry YouTube's AI label),
the extension sends that channel's id and @handle if known, the two counts, and your
install id. It does this once per channel.
Feedback
Only when you send it from the Send feedback page: the category, your message, your email address if you choose to give one, and the extension version. If you opened the page from a YouTube tab and leave "Include the page you were on" ticked, that page's link is added to your message.
Requests to YouTube
To read a video's AI label, the extension asks YouTube about that video from the YouTube page you are
on, with cookies left out, so the request is never tied to your YouTube account. It does this in the
background, about 1 KB at a time, once per video. The Your marks page shows thumbnails from YouTube's
image server (i.ytimg.com) and, for older marks saved without a title, fetches the title
from YouTube's public oEmbed endpoint, also without cookies. These requests go to YouTube, under
Google's privacy policy, and not to us.
What the server keeps, and for how long
Like any website, the API sees your IP address when your browser connects. It uses it for rate limits and, for votes and feedback, to count one network once. It never writes your IP address to the database in the clear, and we keep no request logs. A "network" means your IPv4 address, or the /64 block of an IPv6 address, so one household counts once.
| Record | What it holds | Kept |
|---|---|---|
| List entry | A video or channel id, the platform, vote and measurement counts, the review decision, and times. For the maintainer's review, the public title and channel name looked up from YouTube. | As long as the list exists |
| Vote |
Which entry, slop or not, when, and two keys: sha256(install id + entry + salt)
and sha256(network + entry + salt), where the salt is a secret held only by the
server.
|
Until you remove the mark, or the entry is removed |
| Measurement | The same two keys and a time; the counts are added into the entry. | As long as the list exists |
| Feedback | Category, message, your email if given, extension version, time, and your network as a salted hash. | Until the maintainer deletes it |
Because each key is hashed together with one entry, the keys are enough to count you once per video, and not enough to link your votes on two different videos to each other, or back to you. We cannot tell which votes or measurements are yours.
What is public
Decided channels are published under CC0 at
/api/v1/export/youtube-channels.json:
the channel id, the kind of evidence, whether it was reviewed, the vote score, the measurement counts
and when it last changed. The lookup endpoint serves the same decisions by hash, and
/api/v1/stats publishes totals. Videos are never exported, and nothing about who voted,
measured or sent feedback is ever published.
How it is protected
- Everything travels over HTTPS, and every request the extension makes to us leaves out cookies.
- Requests are rate-limited per network by Cloudflare's rate limiter, which counts requests without us storing anything.
- The maintainer's review console is behind a password and a signed, HttpOnly session cookie, and it is the only place feedback can be read.
Service providers
Cloudflare, Inc. hosts the API and this website (Cloudflare Workers), stores the database (Cloudflare D1), and enforces the rate limits. Cloudflare processes connection data such as IP addresses to deliver requests, under its own privacy policy. We use no other processor: no analytics, no advertising, no payment provider and no email service.
What we never do
- Sell, rent or trade any data.
- Use data for advertising, credit decisions or profiling, or pass it to data brokers.
- Build a history of what anyone watches, on the device or on the server.
- Let anyone read what you sent, apart from the maintainer reading feedback and reviewing list entries.
Chrome Web Store user data
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. KillSlop uses what it handles only for its single purpose: hiding AI-generated content and keeping the open list that does it.
Your choices
- Community list off: no lookups and no channel measurements are sent.
- Contribute reports off: no marks and no measurements are sent; your marks stay on your device.
- Reset local data, in the popup: clears the verdict cache and your marks.
- Uninstall: Chrome removes everything the extension stored on your device.
Deleting what you sent
To take back a vote, remove the mark on the Your marks page while Contribute reports is on. To have feedback or an email address you sent deleted, reply to our email if you received one, or open an issue on GitHub saying roughly when you sent it, without posting your email address there. We will delete it. Votes and measurements cannot be found by person, because we cannot tell which ones are yours; they hold nothing that identifies you.
Children
KillSlop is not directed at children under 13, and we do not knowingly collect personal information from them. The only personal information the service can receive is an email address someone chooses to type into feedback. If a child has sent one, ask us and we will delete it.
Changes
When this policy changes, the new version is published on this page with a new effective date, and every earlier version stays readable in the project's public history on GitHub.
Contact
Questions and requests: open an issue on GitHub. To report a security or privacy problem privately, use the repository's Security tab, then Report a vulnerability.