Sourcy

Privacy Policy

Last updated: October 2026

This English version is provided for convenience. In case of any discrepancy, the French version prevails.

1. Data controller

The controller of the personal data collected through Sourcy is the app's publisher. Sourcy is a service offering in-app purchases (subscriptions and analysis credits) through Google Play.

Contact: contact@getsourcy.com

2. Data collected

Sourcy only collects the data strictly necessary for the service to work (data minimisation principle, Art. 5(1)(c) GDPR):

• Email address — provided when creating an account (by email, in the app or on the website, or through Google). Purpose: authentication. Legal basis: performance of the contract.
• Date of birth — requested only once, at first sign-in (age verification screen, in the app, on the website or in the extension). Purposes: enforcing the minimum age to use the service (13) and restricting AI analysis features to adults, in accordance with the Google Gemini API terms of use. It is never public, cannot be changed in the app and is deleted with the account. Legal basis: protection of minors and compliance with the AI provider's terms (legitimate interest).
• Public display name (optional) — the name chosen for the community leaderboard. Legal basis: consent.
• Votes and contributions — clarity votes, sources submitted to the catalogue. Purpose: calculating the evidence score.
• "AI or real?" votes — for each video you vote on: your opinion (AI or real), the moment in the video when you voted, the date and the video's title. Purposes: showing the percentage and the curve of voting moments, and letting you find your votes in your profile ("My votes"), visible only to you. Only totals are published (per video and per second of video), never the identity or address of voters. On a video with very few votes, someone who knows you just voted could still infer your opinion. On Android, you can also vote on a TikTok or Instagram video by sharing it to Sourcy: only the video's public identifier (its number or code, as it appears in the link) is kept with your vote, with no title, no playback moment and no other data from these platforms; no video is downloaded or analysed. A short TikTok link is resolved by your phone, which contacts TikTok directly: Sourcy only receives the identifier. Legal basis: performance of the contract.
• Source suggestion log — for each suggested source: account, link, passage concerned, date and result of the automatic check (section 3). Purposes: preventing abuse (20 checked suggestions per 24 hours) and monitoring the quality of the check. Kept for 30 days, deleted with the account. Legal basis: legitimate interest (service security and quality).
• Number of analyses and timestamps — activity counter and date of the last analysis. Purpose: community tiers and the 24-hour delay between analyses.
• Subscription and analysis credits — active subscription tier, renewal date, credit balance and badges owned. Purpose: providing the "Sourcy" analysis and managing billing. Legal basis: performance of the contract.
• Saved videos ("My list") and followed channels — identifiers of the videos and channels you choose to follow. Purpose: personal library and notifications. Legal basis: performance of the contract.
• Supporter status — indicates whether a voluntary donation has been made. Purpose: supporter badge.
• Technical crash data — if an error or crash occurs in the app, a technical report (error trace, device model, operating system and app version) is sent to our monitoring tool (Sentry). These reports contain neither your email nor your IP address. Purpose: fixing bugs and service reliability. Legal basis: legitimate interest.
• Usage statistics — technical events (e.g. "analysis started", "analysis succeeded", app version) recorded in our own database, linked to the account and anonymised when it is deleted. No third-party advertising tool. Purpose: improving the service. Legal basis: legitimate interest.
• Proof of purchase — for each purchase: the Google Play purchase identifier, the product, the date, the credits granted, the account's email address and, if it is refunded, what was taken back. Purposes: verifying each purchase with Google, preventing the same purchase from being credited twice, and taking back what it provided if it is refunded. Accessible only to our servers, it is kept after the account is deleted (section 5). Legal basis: performance of the contract, then legitimate interest (fraud prevention and proof of purchase in case of dispute).
• Address fingerprint and subscription grant dates — a fingerprint of your email address (not the address itself), linked to the dates of the last monthly credit grant and of the welcome bonus. No balance is kept. Purpose: preventing an account that is deleted and recreated with the same address from receiving these credits a second time. Kept after the account is deleted (section 5). Legal basis: legitimate interest (fraud prevention).
• Analysis requests — the videos you ask to have analysed. Purpose: showing the community which videos are awaited. Deleted 7 days after the video is analysed, and with the account. Legal basis: performance of the contract.
• Credit spending log — for each analysis paid with credits: the video, the amount, the date and its technical cost (amounts of computation and searches used at Google Gemini). Purposes: automatically refunding an analysis that fails and monitoring the cost of the service. Deleted with the account. Legal basis: performance of the contract.
• Hidden authors — the accounts whose contributions you choose to hide. Deleted with the account. Legal basis: performance of the contract.
• Reports — when you report a source, a video or a display name: the reported item, the reason and, where applicable, your description. Purpose: moderation. Kept after the account is deleted, with your address replaced by a pseudonym (section 5). Legal basis: legitimate interest (quality and safety of the service).

Payment processing (subscriptions and credit purchases) is handled by Google Play (Google LLC); Sourcy neither receives nor stores any banking data, only the proof of purchase described above.

3. AI analysis: personal key (local) or Sourcy key (server)

Video analysis works in two modes:

• Personal key (BYOK) — if you provide your own Google Gemini key, it is stored encrypted locally on your device (the operating system's native security mechanism) and never passes through our servers. Each analysis submitted with a personal key is logged (account, video, date) for 30 days, to prevent abuse and to limit the number of analyses per account; this log is deleted with the account. Legal basis: legitimate interest (service security).
• "Sourcy" key — reserved for subscribers and credit holders. In this mode, the video URL and the analysis instructions are sent to our servers, then to the Google Gemini API, which performs the analysis. A credit system deducts each analysis.

Checking suggested sources — when you suggest a source, its address, the passage concerned (the analysis's topic and note) and the video title are sent to our servers and then to the Google Gemini API, which reads the source page to check that it actually matches the passage. This check always uses Sourcy's key, never your personal key, and deducts no credits.

The YouTube API access key (used to retrieve public video metadata) is held by Sourcy on the server side and is never exposed to the user. Only the video's public identifier is sent; no account data is transmitted.

3a. Sourcy browser extension

The Sourcy browser extension (Chrome and compatible browsers) displays a video's evidence score and sources directly on YouTube. It processes data as follows:

• Browsing without an account — displaying the catalogue requires no sign-in and collects no personal data. Only the public identifier of the video being viewed is sent to our servers, to check whether it is in the catalogue.
• Google sign-in (optional) — needed only to run or request an analysis, vote or suggest a source. It uses the same account as the app; the email address and session token are kept locally in the browser and are only sent to Supabase, our authentication provider.
• Sign-in with an email address (optional) — it happens on the website's "account" page (section 3b), which hands the session to the extension when you click "Connect the extension". The extension renews it with Supabase straight away; no other page can hand it a session.
• Date of birth — asked only once in the extension window if it has not been given yet, with the same rule as the app.
• Personal Gemini key (optional) — if you save one, it is stored only in your browser's local storage (chrome.storage.local), is never synced across devices, is never sent to our servers, and is only sent to the Google Gemini API when you run an analysis. You can remove it at any time from the extension icon.
• No tracking — the extension does not collect your browsing history, does not read any page other than YouTube, installs no tracker and sends no data to advertising third parties. It accesses no website other than youtube.com, our servers, the Gemini API and, when you sign in, the Google sign-in page (accounts.google.com). It receives messages from no website, except the getsourcy.com "account" page.
• Contributions — the sources you suggest and your votes are public and linked to your account, as in the app (except "AI or real?" votes, published only as totals). Each suggested source goes through an automatic check before publication, as in the app (section 3); if this check is unavailable, the source is published without it, and only counts once others have validated it. When the account is deleted, your sources are anonymised and your votes deleted.

Uninstalling the extension erases all of this local data (session and personal key included). You can delete your account from the app, on the website (getsourcy.com/compte) or by writing to us (section 6).

3b. Account on the website

The getsourcy.com/compte page lets you create an account with an email address, sign in, choose a new password (code sent by email), give your date of birth, link your account to the extension and delete your account. It sets no cookie and stores nothing in your browser: the sign-in only lasts as long as the page. It only talks to Supabase (authentication) and Cloudflare's captcha (section 4). Purchases stay in the Android app (Google Play).

4. Processors

• Supabase Inc. — database and authentication. Data hosted in the European Union (eu-west). SOC 2 Type II certified.
• Google LLC (Gemini) — AI analyses and checking of suggested sources. In "Sourcy key" mode, the video URL and the analysis instructions go through our servers and then the Gemini API; in personal-key mode, the call goes directly from your device. Google participates in the EU-U.S. Data Privacy Framework (DPF, adequacy decision of 10 July 2023).
• Google LLC (YouTube Data API v3) — public video metadata, called by our servers with a key provided by Sourcy. Only the video's public identifier is sent.
• Google Play (Google LLC) — payment processing (subscriptions and credits). No banking data is sent to Sourcy.
• Cloudflare, Inc. (United States) — website hosting and anti-bot captcha (Turnstile) when creating an account, signing in and changing a password, in the app and on the website. The captcha looks at technical browser signals to tell a person from a bot, without advertising cookies. Cloudflare participates in the EU-U.S. Data Privacy Framework (DPF).
• Google LLC (Google sign-in) — signing in with a Google account, in the app or in the extension, if you choose it.
• Functional Software, Inc. ("Sentry", United States) — technical crash monitoring. Error reports are hosted in the European Union (Germany region) and configured without personal data (no email, no IP address). Sentry participates in the EU-U.S. Data Privacy Framework (DPF).

Sourcy uses YouTube API Services. By using the app, you also agree to the YouTube Terms of Service. Data processed by Google is handled in accordance with the Google Privacy Policy.

5. Retention periods

• Account data (email, date of birth, display name, counters, subscription, credits, "My list", followed channels, analysis requests, spending log, hidden authors): kept while the account is active, deleted within 30 days of the account being closed — except the email address contained in the proof of purchase (see below). Analysis requests are also deleted 7 days after the video is analysed.
• Reports: kept for moderation; when the account is deleted, your address in them is replaced by a pseudonym specific to your account.
• Suggested sources: kept for the continuity of the catalogue, anonymised when the account is deleted (neither address nor identifier).
• Votes (including "AI or real?" votes and the moment they were cast): kept while the account is active, deleted with it.
• Crash reports (Sentry): kept for 90 days, then deleted automatically.
• Source suggestion log and personal-key analysis log: kept for 30 days, deleted with the account.
• Usage statistics: kept linked to the account while it is active, anonymised as soon as the account is deleted.
• Proof of purchase (including the account's email address): kept after the account is deleted, for five (5) years from the purchase, the general limitation period under French law (article 2224 of the Civil Code), so that a purchase can be proven in case of dispute and cannot be credited twice, then deleted.
• Address fingerprint and subscription grant dates: kept after the account is deleted, for as long as needed to prevent a bonus from being obtained again.
• This data serves no other purpose.
• Data stored on your phone: your analysis history, your searches and the local copies of your votes and display name never leave the device; your personal Gemini key is only sent to Google Gemini. They are erased from the phone when the account is deleted, and the key can be removed at any time from the "Gemini key" page.

6. Your rights (GDPR) and account deletion

Under the GDPR, you have the following rights: access, rectification, erasure, restriction, portability and objection.

To exercise your other rights: contact@getsourcy.com

You also have the right to lodge a complaint with the CNIL — www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or with the data protection authority of your country of residence.

7. Security

Sourcy implements the following measures: TLS encryption in transit, Supabase Row-Level Security in the database, JWT authentication, and encrypted storage of personal keys on the device. No advertising tracking cookies or third-party behavioural analytics tools are used — the technical monitoring (Sentry) and internal usage statistics described in sections 2 and 4 are used only for reliability and service improvement. Your personal data is never sold, rented or shared with third parties for commercial or advertising purposes.

8. Contact

For any question about this policy: contact@getsourcy.com