Privacy

Small app. Small data footprint.

TrollBooth is a private tool for two account owners. It collects only the information needed to find comments, prepare replies, and post replies the account owner explicitly approves.

Last updated July 10, 2026

Information TrollBooth stores

• Application account information and Voice Profile settings.
• Connected social-account identity and encrypted authorization credentials.
• Owned video or post context, public comments, commenter information supplied by the platform, and engagement counts used to prioritize comments.
• Generated drafts, the final text approved by the user, posting status, and limited synchronization/error history.

How information is used

TrollBooth uses this information only to synchronize comments on accounts the user connects, rank comments for review, prepare editable reply drafts, and post the exact replies the user approves. TrollBooth does not automatically publish unreviewed AI text.

Google and YouTube data

TrollBooth accesses YouTube only after the account owner grants permission through Google OAuth. It uses that access to identify the owner’s channel and videos, retrieve comments and thread context, and publish replies the owner approves.

TrollBooth’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

WordPress data

TrollBooth can read public WordPress comment-feed data and use an account owner’s encrypted, revocable WordPress Application Password to synchronize comment threads, publish only approved replies, and move comments to trash when the owner explicitly requests it.

AI drafting

For comments selected for drafting, TrollBooth sends Nano-GPT the minimum useful post, thread, comment, and Voice Profile context. Social credentials are never sent to the AI provider, and the AI provider has no posting tools or ability to act on a social account.

Sharing and sale

TrollBooth does not sell personal information, run advertising, or share information for unrelated marketing. Data is processed only by the infrastructure and API providers required to operate the application.

Retention and deletion

Connected-account data is retained while needed for the private inbox and reply history. An account owner may request disconnection and deletion of locally stored social data. Revoking TrollBooth in the Google Account permissions page also prevents future YouTube access.

Security

Production traffic uses HTTPS. Social credentials and provider keys remain on the server, application pages require authentication, and backend ownership checks restrict each user to their own connected accounts.

Contact

Questions or deletion requests: brento@brentozar.com.