Privacy

Last updated 2026-10-10.

Hook Detector asks for no password. There are two ways in: sign in with Google, which shares your email address, name and profile picture with us, or open an account with an access code, which needs no email at all. Either way the account works through an API key. This page lists everything we keep about that account, who else sees any of it, and how to erase it.

What we never collect

• No password, phone number or payment card. There is nothing to pay for.
• No email address or name unless you sign in with Google or ask us for access, as described below.
• No analytics, advertising or tracking scripts on hookdetector.com, and no tracking cookies. The only cookies are the sign-in ones described below.
• We do not sell, rent or share your data with anyone for their own use.

What your browser keeps

When you sign in with Google or as the owner, the API (api.hookdetector.com) sets one cookie, __Host-hd_session, that holds your sign-in key. From then on the key is not kept anywhere page scripts can read; the cookie is sent only to the API and only over HTTPS, and signing out deletes it. Google sign-in also sets a short-lived cookie (hd_google, 10 minutes) that ties the sign-in to this browser. The app stores in your browser's localStorage a note that you are signed in (hd.session, the first characters of the key, not the key), the conversation you have open (hd.conv) and a run still in progress (hd.run). An account opened with an access code keeps its key in localStorage (hd.key), so you can always see and save it, and so does a browser that signed in before the cookie existed or that refuses it. The app also remembers your choices there so you do not set them twice: whether the sidebar is open (hd.rail), and the language, country, time window and number of results you last picked (hd.locale, hd.within, hd.count, hd.studio.long, hd.studio.packaging). All of it stays on your device. Anyone who can use this browser can use your account, so sign out on a shared computer. Clearing the site's data signs you out, and an account opened with an access code alone cannot be reopened without a key you saved.

What the API stores

• Your account: its credit balance, an optional label you choose, when it was created and last used.
• Your Google sign-in: if you sign in with Google, the email address Google has verified, the name and profile picture address on your Google account, Google's id for you, and when you first and last signed in. We never see your Google password.
• Your keys: a one-way hash of each key and its first few characters, never the key itself, with the name you gave it and when it was made, last used or revoked.
• Your runs: each topic you asked about, how many hooks you asked for, what it reserved and charged, its progress and result, and the idempotency key you sent with it.
• The hooks a run found: public facts about public clips: the creator's handle, views, likes, caption, cover image address, transcript, text on screen and our notes on why it spread.
• The videos a Long form or Packaging run found: public facts about public YouTube videos: the channel, title, thumbnail address, views, the channel's usual views, the opening as it was said and our notes on it, and the ideas written for your subject.
• Your decisions: which hooks and videos you kept or passed on.
• Your conversations: every chat message you send and every reply, with its title and the runs attached to it.

If you ask for access, we keep the email address and note you send, and whether we said yes. We email the access code to that address.

Our server logs record the network address that makes each signup, so we can stop one address from creating accounts in a loop. Signups, chat turns and new keys are also counted per hour in memory for rate limits; those counts are gone when the server restarts.

Who else processes it

• ScrapeCreators runs our searches on TikTok and Instagram. It receives the search words we build from your topic and the addresses of the clips we read. It does not receive your key or your account.
• Anthropic (Claude) is our language model provider. It receives your topic, your chat messages, and the transcripts, on-screen text, cover images, YouTube openings, titles and thumbnails of the videos being judged.
• ElevenLabs transcribes speech for dialect requests. It receives the first minute of some TikTok videos, to transcribe what is said.
• OpenAI is our backup language model provider. When Claude cannot answer, it receives the same topic, chat messages, transcripts, on-screen text and images. For dialect requests it also receives the first minute of some TikTok videos when ElevenLabs cannot transcribe them.
• Google handles Google sign-in. It learns that you signed in to Hook Detector, and it sends us the email, name and picture listed above.
• Resend sends our emails. It receives the email address of a person who asked for access and the message holding their code.
• Railway hosts the site and the API, and Supabase hosts the database. They store what is listed above on our behalf.
• TikTok and Instagram: a clip plays through the platform's own official player or embed, and every card links to the original post and its creator. When a clip plays, your browser talks to that platform directly and its own privacy policy applies.

Deleting your account

You can erase your account yourself at any time with DELETE /v1/account, or the delete_account tool over MCP. The request must carry the words delete my account as its confirmation, so it cannot happen by accident, and it is refused while one of your runs is still working. It erases the account and every row that belongs to it: all its keys, runs, hooks, decisions, conversations, messages and your Google sign-in details. Every key stops working at once. The details are on the API page.

An access request is not part of an account, so deleting the account does not erase it; email us and we will. Two things outlive a deletion for a while: server logs, and the database host's backups, which are kept for a limited period and then replaced. A copy of an embed we cached for a public clip is not your data and is kept.

Children

Hook Detector is not meant for children under 13, and we do not knowingly hold their data.

Changes and contact

When this page changes, the date at the top changes with it. The machine-readable guide at llms.txt always describes the live API.

Hook Detector is run by Awzor Media LLC. For privacy questions, and to have your data removed without your key, email contact@hookdetector.com; you can always delete your account yourself from your account page.