Home · Terms of Service · CCPA · Accessibility · Contact

Privacy Policy

Last updated: November 3, 2026

This Privacy Policy explains how Misconfigs LLC ("we," "us," or "our") collects, uses, and protects information when you use Leaklet, including the Chrome extension, leaklet.com accounts, and related download pages (the "Service"). By using the Service, you agree to the practices described here and our Terms of Service.

1. Overview

Leaklet for YouTube: Affiliate Opportunity Finder & Content Ideas is for ecommerce, website publishers, and content creators. Chrome scans do not require an account. When a scan builds the Opportunities list, the extension may send a short text sample, the page title, and the page URL to leaklet.com so Google Gemini can rank possible missing opportunities and suggest content ideas. We do not store that text after the response, and we do not receive full page HTML. Scan history stays on your device. If you have Leaklet Pro, the extension may also keep summaries on your leaklet.com account. After a fresh install, Leaklet may open the Get started page on leaklet.com. After a fresh Chrome Web Store install, Leaklet may contact leaklet.com once so we can tell that install from later use. That ping does not include page URLs or scan results. Open Leaklet, then go to any video, post, or page you want and scan it. Chrome may ask you to allow access to websites so Leaklet can read that page. The first scan after a fresh install uses one scan from your plan. A likely affiliate label can also match a promo or discount code. Free lifetime and Pro monthly scan counts live on leaklet.com. That server count is the source of truth. A cookie may identify this browser. The numbers shown in the extension are a copy. The Pro monthly count is keyed to your license, as described below. The opportunity request may include the device time zone and language. leaklet.com may look up a country code for the IP that reached the API using IPinfo. A worker uses those only to pick handwritten affiliate program pages for your region on topic matches, as described in section 2A. Time zone is preferred. Country is used when the time zone is missing or not a mapped zone.

You can create a leaklet.com account with the email and password you used on Stripe to retrieve your license key (if you have a valid active subscription), or cancel your subscription, or otherwise manage your account. Completing sign-in sets a session cookie. We store a one-way hash of your password, not the password itself. Email support@leaklet.com if you cannot sign in. We may still hold an email, password hash, Google account id if we received one, and Stripe ids until the account is deleted.

Data controller. For purposes of applicable privacy laws, Misconfigs LLC is the data controller for personal information processed through the Service. Contact: support@leaklet.com.

We do not currently appoint a separate EU or UK representative. If that changes or if applicable law requires one, we will update this Policy.

California notice at collection. If you are a California resident, this Policy describes the categories of personal information we may collect, the purposes for which we use it, and how to exercise your rights. The standalone CCPA / California Privacy Disclosures page is the notice at collection and Do Not Sell or Share statement. We do not sell personal information as defined by the California Consumer Privacy Act (CCPA), as amended by the CPRA. leaklet.com loads a Google Ads tag to measure visits from our ads, as described in section 4. The Chrome extension does not load that tag.

2. Information processed in the extension

When you click Scan, Leaklet reads the YouTube page on the active tab you chose. It may send a short text sample, the page title, and the page URL to leaklet.com so Google Gemini can rank possible missing opportunities and suggest content ideas. We do not keep that text after the response. The current extension does not send photos or video stills. Leaklet does not check outbound hops or label extracted URLs in the current Chrome extension.

On your device, using Chrome storage, Leaklet may keep:

• Settings
• In-progress scan state for the current browser session
• Completed scan history (ranked opportunities, not full page HTML)

This information stays on the device until you clear extension data, uninstall Leaklet, or delete history in the popup. If you have Leaklet Pro, the extension may also upload scan summaries: page URL and title, a short AI brief, topic and product names, program names, content idea phrases and their short expansions, chip names with https join URLs, and programs you marked Joined. It may also upload product names you saved in the extension. It does not upload page HTML, the caption transcript, photos, or video stills. The account dashboard calculates analytics from those summaries. You can delete that copy on leaklet.com. We keep up to 200 summaries on the account.

Scan counts. On a store install, Leaklet contacts leaklet.com to read and update remaining scans. Free lifetime and Pro monthly counts are stored on our servers. That server count is the source of truth. A cookie on leaklet.com identifies this browser. The extension may also store an install id so the same free-scan bucket can be found again. The popup only displays a copy of the server count. Pro monthly scans are keyed to your license. Deleting cookies or reinstalling does not reset a Pro count. Paid license keys stay on this device. Unpacked developer installs skip these caps.

Leaklet does not collect Chrome browsing history, does not run advertising or third-party analytics in the extension, and does not require login for Chrome scans. A leaklet.com account uses email sign-in. Cloud scan history and analytics are a Pro feature.

2A. Opportunity AI

When a Chrome scan builds the Opportunities list, we may send the page title, the page URL, and a short text sample to leaklet.com. On a YouTube watch page, that sample may include captions the page already exposes. Leaklet only scans YouTube watch, Shorts, live, and channel pages. It does not scan Instagram, blogs, or stores. Leaklet does not download the video file. The current extension does not send photos or video stills. We run that request on Google Cloud. Google Gemini returns ranked hints: review priority, revenue potential, publisher interest, page briefs, next steps, and content ideas. A scan may send that sample once more if the first pass returns no content ideas. Those ranks and ideas are not commissions, lost earnings, or proof a program exists, or a guarantee you or a publisher will be interested in a potential opportunity. We do not keep that text after the response. If the AI call fails, the opportunity list stays empty.

The Scan page on leaklet.com is a separate path for a signed-in account. You paste a YouTube video link. We ask YouTube's API for that video's title and description. Captions are included only after you grant access with the Gmail that manages the channel, and only for a video on that channel. We store a refresh token for that channel so a later scan can read captions again. The Leaklet sign-in stays the account on the subscription. A different Gmail can be connected for the channel. In Settings you can remove a YouTube Gmail that is not the Stripe billing email. The Stripe billing account stays linked. We send the title, description, and caption text to the same ranking step as a Chrome scan. We do not download the video file.

leaklet.com may send that IP address to IPinfo, a geolocation provider, to look up a country code. The same request may include the device time zone and language. A worker (not the AI model) uses the time zone first, then that country if the time zone is missing or not a mapped zone such as UTC, to pick handwritten affiliate program pages for your region on topic matches. That does not change opportunity ranks, invent commissions, or mean a merchant is in a program. We do not store the time zone, language, or that country code with the ranking payload after the response. A coarse region may be saved with the scan on the device. The Opportunities list may show that region next to Direct programs and Network Programs. Google user data from a connected YouTube channel is covered in section 2B. Separately, leaklet.com keeps a short operational access log for extension API calls (opportunity ranking and scan counts): the API path, the IP address that reached leaklet.com, a country code IPinfo returns from that IP, the time, the HTTP status, how long the request took, the response size in bytes, how many ranked or labeled items came back (a count only), an eight-character prefix of the random install id this browser minted (not the full id), whether the caller used a Pro license (yes or no, not the key), and whether the caller was the Chrome Web Store build, an unpacked build, or leaklet.com. We use that log to operate the service, measure reliability, and prevent abuse. We do not keep scanned page URLs, page text, photos, license keys, full install ids, or item names in that log. Those rows expire after 365 days.

2B. Google user data

Google user data is information Google gives us when you connect a YouTube channel on leaklet.com. A Chrome scan of a public YouTube page does not use your Google account.

When you connect a channel, Google may give us:

• Your Google account id
• Your Google email address, if Google has verified it
• Your name, if Google sends one
• The YouTube channel id and channel title for the channel you connect
• A refresh token, so a later scan can read captions again
• Caption text for a video on that channel, and only when you ask us to scan that video

We use this data to show which channel is connected, to confirm the video is on that channel, and to read the spoken captions for that scan. We then send the video title, the description, and the caption text to Google Gemini so it can rank product mentions and suggest content ideas. The title and description of a public video can also be read with a YouTube API key, without your Google account. Caption text needs the connected channel.

We do not create, edit, rate, or delete your YouTube videos, comments, playlists, or captions.

With whom we share, transfer, or disclose Google user data. We share, transfer, or disclose Google user data only with these parties:

• Google Cloud (Google LLC). We store your Google account id, email, channel id, channel title, and refresh token on Google Cloud so you can stay connected. We delete that connection when you remove the channel in Settings, when you delete the account, or when we delete it on request.
• Google Gemini (Google LLC). We transfer the video title, description, and caption text to Google Gemini to produce the ranks and content ideas you see on that scan. We do not keep that text after the response. We do not control how long Google keeps a request under Google's own terms.

We do not share, transfer, or disclose Google user data with Stripe, Resend, IPinfo, advertisers, data brokers, or any other third party. We do not sell Google user data. We do not use it for advertising. We do not use it to train our own machine learning models. People at Misconfigs LLC do not read your caption text or refresh token unless you ask us to for support, we need it to investigate abuse or a security problem, or the law requires it.

Leaklet's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Leaklet uses YouTube API Services. The YouTube Terms of Service and Google Privacy Policy also apply to those services. You can revoke Leaklet's access at Google Account permissions. You can also remove a connected channel in Settings on leaklet.com.

3. Requests to third-party sites

A scan may ask Chrome for optional host access so Leaklet can read the YouTube page you chose. The current extension does not send HEAD or GET hop checks to destination URLs found on that page.

3A. Payments and license email

When you subscribe to Leaklet for YouTube: Affiliate Opportunity Finder & Content Ideas Pro ($9/month), Stripe processes the payment. Stripe collects the details needed to complete checkout. We can see related records in our Stripe account, including your email address, payment amount, payment status, billing country, subscription status, and the limited card information Stripe shows merchants (for example the last four digits). We do not receive or store your full card number. After a Pro checkout we store your Stripe customer id and checkout email against the license key so Settings can open Stripe billing for that key. If you start checkout from the Chrome extension, we also store that install id against the license so this browser can unlock without pasting.

After you subscribe to Pro, we email your license key from licenses@leaklet.com. Those emails are sent with Resend from the leaklet.com service we operate on Google Cloud. We can access data tied to that send: the recipient address, the message we send (including a license key), delivery or bounce status, and operational logs such as time and destination.

Stripe, Resend, Google, and IPinfo process this information so we can take payment, sign you in, deliver a key, host leaklet.com, rank opportunity hints with Google Gemini, and look up a country code from the IP that reached leaklet.com. License email is sent with Resend from the leaklet.com service we operate on Google Cloud. Chrome is operated by Google. Their own privacy policies apply to services they provide. We send the ranking request to Google Gemini to produce that response. We do not keep the page text after the response. We do not control how long Google keeps a request under Google's own terms.

3B. Leaklet accounts

You can create a leaklet.com account with the email and password you used on Stripe to retrieve your license key (if you have a valid active subscription), or cancel your subscription, or otherwise manage your account. Completing sign-in sets a session cookie on leaklet.com. The session cookie lasts until you sign out, it expires, or you clear cookies for leaklet.com. We store a one-way hash of your password. We do not store the password itself.

If you still have an older leaklet.com account, we may still hold your email, account id, password hash if you created a password, Google account id if we received one, and Stripe customer or subscription ids when Stripe sent them, until you delete the account.

4. Download and marketing pages

If you visit leaklet download or legal pages hosted on the public internet, the host (Google Cloud, which serves leaklet.com) may record standard request metadata such as IP address, browser type, referring URL, path, and time, for security, operations, and abuse prevention. Account data, scan summaries, scan counts, license records, and the API access log are stored on Google Cloud. leaklet.com loads a Google Ads tag so we can measure visits from our ads. Google may set a cookie and receive the page address. The Chrome extension does not load that tag. The homepage includes a promo player from youtube-nocookie.com. Your browser loads that player from YouTube, and playback stays on YouTube under Google's terms. We do not receive a copy of what you watch. A leaklet.com account uses a session cookie, as described above.

5. How we use information

• Provide, operate, and improve the Service
• Process paid unlocks, license keys, and Pro billing
• Rank opportunity hints and content ideas with Google Gemini from a short text sample you scanned
• Suggest handwritten affiliate program pages for your region from time zone first, then a country code or language. Not used to rank opportunities or estimate payouts
• Sign you into a leaklet.com account so you can manage Pro billing or delete data
• Respond to support or legal requests you send by email
• Detect abuse and enforce our Terms
• Comply with legal obligations

We do not sell your personal information. We do not use scan contents to train our own machine learning models. Opportunity ranking uses Google Gemini as described in section 2A. Google's terms apply to that request.

6. Permissions

activeTab and scripting let Leaklet read the YouTube page on the current tab after you click Scan. storage saves settings and history on this device. Access to leaklet.com is used to record a one-time store install ping, to count free lifetime scans, count Pro monthly scans against your license, and to send a short text sample for opportunity ranking, as described in section 2A. The same request may include the device time zone and language, and may receive a country code from IPinfo, as described in that section. Optional http and https access is requested so the extension can read a YouTube page you scan. It is not used to watch your browsing in the background.

7. Data retention

• Extension storage: until you delete it, clear site/extension data, or uninstall
• Browser id cookie on leaklet.com: until it expires, you clear cookies for leaklet.com, or we rotate it. This cookie identifies the browser. It does not store the remaining scan count.
• Free lifetime scan count: kept on our servers, keyed to that browser id or install id
• Pro monthly scan count: kept on our servers for the current calendar month, keyed to a hash of your license, then it expires
• Account session cookie: until you sign out, it expires, or you clear cookies for leaklet.com
• Account data (email, password hash, Google id if we received one, Stripe ids): until you delete the account, we delete it on request, or we close the account service
• Connected YouTube channel (Google account id, Google email, channel id, channel title, and refresh token): until you remove that channel in Settings, you delete the account, or we delete it on request
• YouTube caption text: not stored after the ranking response. Google Gemini processes that request under its terms, as described in section 2B
• Stripe payment and subscription records: kept in Stripe and our Stripe account as needed for accounting, support, refunds, and fraud review
• License and sign-in emails and related Resend logs: kept as needed to deliver mail, debug delivery, and keep purchase records
• Email you send us: retained as needed to respond and for legal records
• Host logs for public pages: retained for a limited operational and security period
• Extension API access logs (API path, IP, country code, time, HTTP status, duration, response size, item counts, eight-character install id prefix, paid or free, store or unpacked or web): 365 days, then they expire. No scanned page URL, page text, photo, license key, full install id, or item names
• Opportunity AI text samples: not stored after the ranking response. Google processes that request under its terms
• Text sent for opportunity ranking: not stored by us after the response. A second pass, if the first returns no content ideas, is handled the same way
• Pro scan summaries, joined program names, and saved product names: until you delete them on leaklet.com, you delete the account, or we delete them. Up to 200 summaries
• Time zone, language, and country on the opportunity ranking payload: not stored with that payload after the response. Country may appear on the separate 365-day API access log described above

To delete account data we still hold, email support@leaklet.com. Stripe may still hold payment records after you cancel in Stripe or by emailing us. For other personal information we hold (for example an email you sent), contact support@leaklet.com. We will use reasonable efforts to respond as required by applicable law. We cannot remotely wipe chrome.storage on your device; you control that locally. Canceling in Stripe stops new paid periods.

8. Security

We implement reasonable technical and organizational measures. No method of transmission or storage is 100% secure. You are responsible for securing your device and browser.

In the event of a security incident affecting personal information we hold, we may notify affected users and relevant authorities as required by applicable law.

9. Legal bases (EEA/UK)

If you are in the European Economic Area, United Kingdom, or Switzerland, we process personal information under:

• Contract / pre-contractual steps: providing the extension and pages you request, processing payment, sending a license key, and letting you sign in to manage Pro billing or delete an account
• Legitimate interests: operating and securing the Service, responding to mail, and detecting abuse, balanced against your rights
• Legal obligation: retaining or disclosing information when required by law
• Consent: where required for any optional cookies we may add later

10. Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. For account deletion and other requests, contact support@leaklet.com.

If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local supervisory authority. California residents may have additional rights under the CCPA. Read the CCPA disclosures. We do not sell personal information as defined by that law.

11. International transfers

Misconfigs LLC is based in the United States. If you email us or load hosted pages from other regions, information may be processed in the U.S. and other countries where we or hosting and payment or email providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by subprocessors.

12. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.

13. Your choices

You can use the Chrome extension without an account. You can create a leaklet.com account with the email and password you used on Stripe to retrieve your license key (if you have a valid active subscription), or cancel your subscription, or otherwise manage your account. You may clear history in the extension, download a CSV on this device, or uninstall the extension. You can delete Pro scan summaries after you sign in.

14. Changes

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use after changes constitutes acceptance of the updated policy. This Policy does not create contractual warranties beyond those stated in our Terms of Service.

15. Contact

Privacy questions: support@leaklet.com

Misconfigs LLC. Leaklet for YouTube: Affiliate Opportunity Finder & Content Ideas.