Privacy Policy

Last updated: 4 October 2026

Who we are

fallo (fallo.ai) is run by [Company legal name], [registered address] (“fallo”, “we”, “us”). This policy explains what we collect when you use fallo, why, and what you can do about it.

fallo has two kinds of users, and this policy covers both:

• Creators: YouTubers and online content creators who have a fallo account.
• Fans: people who join a creator’s list to get that creator’s new videos by email. Fans don’t have an account.

What we collect about creators

• Account: your name, email address, and a password hash (we never store your password itself). If you use Google sign-in, your Google account id instead of, or as well as, a password.
• Your channel: your YouTube channel id, title, @handle and channel picture, and your fallo address (fallo.ai/yourname).
• Settings: things like your sender name, reply-to address, time zone, which kinds of videos to send, your QR code style, fan rewards and recommendation swaps.
• API keys and webhooks: we store a hash of each API key (not the key itself), plus the web addresses you ask us to send events to.
• Security records: a log of important account actions (like logging in, changing settings or verifying a channel) with the IP address they came from, and failed or repeated login attempts by IP address, so we can stop people guessing passwords.
• Messages you send us through the contact form (see below).

What we collect about fans

When you join a creator’s list on their fallo page, we collect:

• Your email address, and a name if one is given.
• Your status: waiting to confirm, joined, unsubscribed, or bounced.
• Where you joined from: which of the creator’s links or QR codes you used (for example “QR code” or “video description”), and, if a friend shared their link with you, which fan brought you.
• When you joined and when you confirmed.

For each video email we send you, we record when it was sent and delivered, whether it was opened (using a tiny invisible image in the email) and whether you tapped Watch (the button goes through a fallo link that notes the tap, then takes you to the video on YouTube). Your email app may block the image, in which case we can’t tell if the email was opened. Video thumbnails and channel pictures in emails load from YouTube’s image servers.

Visits to a creator’s fan page are counted as daily totals per source (for example “12 visits from the QR code today”). We don’t track individual visitors.

The do-not-email list

If an email to an address bounces permanently, if someone marks a fallo email as spam, or if we block an address by hand, the address goes on a do-not-email list. No creator on fallo can email it again.

Contact form

If you use the contact form, we keep your name, email address, the topic, your message, your fallo address if you give it, and your IP address, so we can answer and spot abuse.

Google and YouTube data

fallo uses Google sign-in and YouTube API Services. By using fallo’s YouTube features you are also bound by the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy.

Signing up and logging in with Google

We ask Google for the basic scopes openid, email and profile. We use them only to create your fallo account and to recognise you when you log in. We keep your Google account id, name and email address. We don’t keep the Google access token: we hand it back to Google (revoke it) as soon as we’ve read who you are.

Verifying your channel

To prove a channel is yours, we also ask for view-only YouTube access (https://www.googleapis.com/auth/youtube.readonly). We use it once, to ask the YouTube Data API which channel your Google account owns (channels.list with mine=true), and compare that with the channel you added. Then we revoke the token straight away. We don’t store it, and we don’t keep any access to your YouTube account afterwards.

fallo never posts, comments, uploads, or changes anything on YouTube.

Public channel data

To email your fans when you post, fallo regularly reads your channel’s public information: your public video list (from YouTube’s public feed, and the YouTube Data API using fallo’s own API key), with each video’s title, description, thumbnail, live status and length. This is public data; it doesn’t use your Google sign-in.

Limited Use

fallo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to create and identify your account and to verify your channel.
• We don’t use it for advertising, we don’t sell it, and we don’t use it to train AI models.
• People at fallo don’t read it, except with your permission, for security reasons, or where the law requires it.

Removing fallo’s access

fallo doesn’t keep access to your Google account, but you can check and remove any app’s access at myaccount.google.com/permissions. To have your Google account id, name and email deleted from fallo, delete your account in Settings, or email hello@fallo.ai.

How we use information

• To run fallo: create accounts, verify channels, spot new videos, and email them to each creator’s fans.
• To confirm fans: every fan gets a confirm email and only joins when they tap it. If they don’t, we send one reminder.
• To show creators how they’re doing: where fans came from, and opens and Watch taps for each video.
• To send account emails, such as password resets, list review results, and notices about your account or address.
• To keep fallo safe and free of spam: rate limits, the do-not-email list, pausing channels with too many bounces or spam reports, checking uploaded lists and new videos (see AI safety checks).
• To answer you when you contact us.

We don’t use fan email addresses for anything except the emails fans signed up for: the creator’s videos, plus the confirm email, a reminder, and (if a creator has set one up) a thank-you when a fan brings friends. We don’t send our own marketing to fans.

AI safety checks

fallo uses Claude, an AI model made by Anthropic, to help keep spam and scams off fallo:

• Videos and channels: before a video email goes out, and when a channel is verified, we send the channel name and the video titles and descriptions to check for scams, phishing, gambling, adult content or impersonation. If something is flagged, it’s held for a person at fallo to look at.
• Uploaded fan lists: when a creator uploads addresses of people they already know, we run plain checks on the whole list and send the AI a sample of up to 80 addresses, with the channel’s name and some counts, to judge whether it looks like a real list of people who asked to hear from the creator.
• Staff summary: once a day, the AI writes a short summary for fallo staff from total numbers (sign-ups, emails sent, bounces and so on) and the names of channels that need a look. It doesn’t include fans’ addresses.

No Google user data is sent to the AI.

Who we share information with

We never sell or rent email addresses, and we don’t share personal information for advertising.

The creator you joined

A fan’s email address and activity (where they joined from, opens and Watch taps) are visible to the creator whose list they joined. The creator can download their list as a CSV file and read it through the fallo API.

When creators recommend each other (a “swap”), neither creator sees the other’s list. They only see how many fans each gained. If a fan taps to join the other creator’s list, they become that creator’s fan too.

Tools a creator connects

A creator can connect fallo to other tools with API keys, webhooks or Zapier. When they do, fallo sends their fans’ details (such as email address, status and where they joined from) to wherever the creator points it. Those tools are chosen and controlled by the creator, not by fallo.

Service providers

These companies help us run fallo and handle data on our behalf:

When the law requires it

We may share information if we’re legally required to, or where it’s needed to protect people, fallo or its users from fraud or abuse.

Cookies

fallo sets one cookie, called fallo. It keeps you logged in and protects forms against forgery. It’s marked HttpOnly (scripts can’t read it) and ends when you close your browser. There are no analytics or advertising cookies.

How long we keep information

• Creator accounts are kept until you delete them.
• Deleting your account (Settings › Delete account) removes, at once: your account, your channel, your whole fan list, your videos and every email record, your fan-page visit counts and your recommendation swaps. Your fans stop getting emails straight away.
• The delete button also removes your API keys, webhooks, uploaded lists, name history, safety-check notes about your channel, your contact messages and your account’s security log. Two things stay: a single record that the account was deleted, and login attempts, which are stored by IP address only and aren’t linked to your account. Addresses on the do-not-email list stay there too, so they’re never emailed again.
• Fans who unsubscribe stop getting emails immediately. We keep the record that they unsubscribed so they aren’t emailed again. To be removed completely, email us.
• Unused fallo addresses: if no YouTube channel is verified for a username within 30 days, we warn you, then release the name.
• The do-not-email list is kept permanently, so those addresses are never emailed again.
• Contact messages are kept so we have a record of what we were asked and answered.

Your choices and rights

• Fans: tap Stop these emails at the bottom of any fallo email. It works straight away.
• Creators: change your details in Settings, download your fan list from the Fans page, and delete your account in Settings.
• Google access: see Removing fallo’s access.

Anyone can ask us for a copy of the information we hold about them, or ask us to correct or delete it. Email hello@fallo.ai or use the contact form. We may need to check it’s really you, for example by replying to the email address in question. Depending on where you live, you may have further rights under local law, including the right to complain to your data protection authority.

If you’re a fan and want a creator to stop using your address in their other tools, ask the creator too: they control what they’ve downloaded or synced.

Security

We protect information with reasonable measures, including: encrypted connections (HTTPS), hashed passwords and API keys, encrypted storage for fallo’s own service secrets, limits on login attempts, and signed webhooks. No system is perfectly secure, so we can’t promise that information will never be accessed without permission. If you think your account has been misused, contact us straight away.

Children

fallo isn’t aimed at children under 13, and we don’t knowingly collect their information. If you think a child has given us their email address, contact us and we’ll delete it.

Where data is stored

fallo’s server is hosted by [hosting provider name] in [hosting location (country)]. Email is sent through Mailgun in the United States, and AI checks are handled by Anthropic in the United States. This means your information may be processed in countries other than your own, which may have different data protection laws.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell creators by email before it takes effect.

Contact

Questions or requests about privacy: email hello@fallo.ai or use the contact form.

[Company legal name]
[registered address]

See also our Terms of Service.