Privacy Policy
Last updated: 2026-10-05
smallyt (smallyt.com) is a set of web tools for YouTube thumbnails and channel research, operated by Tomato House (토마토하우스), Seoul, Republic of Korea. This policy explains what data the service handles, why, and the choices you have.
Questions: privacy@smallyt.com.
In brief: Images you open stay on your device. We store no accounts, no IP addresses and no uploaded files. Analytics runs only as described below, and feedback is stored only if you send it.
1. What we collect and why
In brief: Most tools run entirely in your browser; only a few features send anything to us, and never more than they need.
1.1 Using the tools
The thumbnail downloader, preview, resizer and guide tools process images and links in your browser. Images you open are never uploaded. Thumbnails and video titles are loaded by your browser directly from YouTube’s public servers (i.ytimg.com and the YouTube oEmbed service).
1.2 Channel, keyword and similar-channel tools
To show public YouTube results, your query — a channel handle or ID, a keyword or a video ID, plus the chosen country and language — passes through our proxy to YouTube. Responses are cached at the edge for up to 24 hours (channel lookups up to 7 days) without any identifier of who asked.
1.3 Reference board
Thumbnails you save to the board, your notes and their order are stored only in your browser’s storage (IndexedDB). We never receive them.
1.4 Feedback, ratings and contact
If you rate a tool, answer “Did this work?”, or send the feedback or contact form, we store what you entered (rating, category, message and, only if you type it, your email address) together with the tool, language, page path, screen size class, browser family and app version. We do not store your IP address. Messages with text are checked with Cloudflare Turnstile to block spam.
1.5 Analytics and error reports
We use Google Analytics 4 to count page views and tool events (for example “thumbnail downloaded”, without the video or the file) so we can see which tools help. In the EU, EEA, UK and Switzerland it starts only after you accept; elsewhere it is on by default and can be blocked with any content blocker. Cloudflare Web Analytics counts anonymous page loads without cookies. If a tool fails, your browser may send one short error report per visit (tool, error code and message).
1.6 Abuse protection
To keep the research tools available, request counts per network are kept for up to 24 hours as a keyed hash of the IP address, in memory and in Cloudflare’s cache — never as the IP itself and never in a database. Cloudflare Turnstile may check your browser when limits are reached.
2. Service providers
In brief: We use a small number of providers, each only for the purpose listed.
| Provider | Purpose | Data | Location | Policy |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, proxy, database (D1), Turnstile, Web Analytics | Requests, feedback and ratings, anonymous page-load metrics | Global edge network; USA | cloudflare.com |
| Google LLC (Google Analytics 4) | Usage statistics | Pseudonymous identifiers, pages and tool events, device and approximate location | USA | policies.google.com |
| Google LLC (YouTube) | Source of public thumbnails and video data | Your browser’s requests to i.ytimg.com and oEmbed; our proxy’s queries | USA | policies.google.com |
4. How long we keep data
In brief: We keep data only as long as it is useful, then delete it.
| Data | Retention |
|---|---|
| Feedback, ratings and contact messages | Up to 24 months, or until you ask us to delete them |
| Error reports | 90 days |
| Cached YouTube responses | 24 hours (channel lookups up to 7 days) |
| Request counters for abuse protection | Up to 24 hours |
| Google Analytics data | 14 months |
5. Your rights
In brief: You can ask what we hold about you, and have it corrected or deleted.
Depending on where you live (for example under the GDPR, UK GDPR, the California Consumer Privacy Act or Korea’s Personal Information Protection Act) you have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent at any time. We do not sell or share personal information for advertising.
Email privacy@smallyt.com; we answer within 30 days. Because we store no accounts or IP addresses, it helps to tell us the approximate date and the text of your feedback. You may also complain to your data protection authority.
6. International transfers
In brief: Our providers may process data outside your country under recognised safeguards.
Cloudflare and Google process data in the United States and elsewhere. Transfers from the EEA, UK and Switzerland rely on the providers’ Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
7. Children
In brief: smallyt is not directed at children.
The service is not intended for children under 13 (under 16 in the EEA), and we do not knowingly collect their data.
8. Security
In brief: Data is encrypted in transit and access is limited.
All traffic uses HTTPS (HSTS). Feedback is stored in a database that only the operator can access. Tool images never leave your device, which removes the largest risk entirely.
9. Changes to this policy
In brief: We update this page before anything we collect changes.
The date at the top shows the latest version.
10. Contact
In brief: The operator responsible for your data is Tomato House.
Tomato House (토마토하우스), Seoul, Republic of Korea · Business registration no. 560-17-02847 · privacy@smallyt.com