DRC

Privacy Policy

Last updated 10 November 2026

DRC (Detection & Response for Creators) is operated by DRC-Security. It watches a YouTube channel or Instagram account for suspicious changes and tells the channel owner about them. This page explains what DRC collects, why, and how to stop it.

What DRC collects

• Your account. The email address an operator enters when creating your DRC login, and the password you set. Passwords are stored by Amazon Cognito and never visible to DRC.
• YouTube data. When you connect a channel, Google gives DRC a read-only token. DRC uses it to read your channel's name and description, the list of your videos, and each video's title, description, tags, visibility status, thumbnail address and publish time. It reads this about every five minutes. DRC does not read comments, analytics, subscribers, watch history, or anything about other accounts.
• Instagram data. When you connect an Instagram professional account, Meta gives DRC an access token. DRC uses it to read your username, name, bio, profile link, profile picture address and post count, and your most recent posts' captions, links, type and publish time. It reads this about every five minutes. Meta also requires every app using its Instagram login to request access to your messages; DRC never reads, sends or stores your Instagram messages and never calls Instagram's messaging services. DRC does not read comments, followers, insights, stories or anything about other accounts.
• Your phone number. Only if you add one in Settings for phone alerts. DRC uses it to send a confirmation code, a message for each new incident by WhatsApp or text message, and replies to your answers, and to read the YES or NO you send back. Mobile numbers and opt-in information are never shared with third parties or used for marketing.
• What DRC derives. A history of changes to the data above, the incidents DRC raises from those changes, and your answers and actions on those incidents.
• Contact form messages. If you write to us through the form on drcsec.com, the email address, reason and message you enter, so we can reply.
• On your device. The DRC app keeps your sign-in tokens in your browser's session storage so you stay signed in while the tab is open; they are cleared when you close it or sign out. DRC sets no tracking cookies and uses no analytics or advertising scripts.

What DRC does with it

DRC compares each read with the previous one. Differences are recorded as events and checked against a small set of rules that look for signs of a hijacked channel. That is the only use. DRC does not sell, rent or share your data, does not use it for advertising, and does not use it to develop, improve or train artificial-intelligence or machine-learning models.

Who it is shared with

DRC does not transfer or disclose your information to third parties. The only other parties involved are the service providers that run DRC on our behalf: Amazon Web Services hosts and stores the data, Google provides the YouTube data and the sign-in consent, Meta provides the Instagram data, its sign-in consent and WhatsApp alerts, Twilio delivers text-message alerts, and Cloudflare provides DNS and the Turnstile spam check on the contact form (see the Turnstile privacy addendum). Data may be disclosed if the law requires it.

Google and YouTube

DRC uses YouTube API Services. By connecting a channel you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. DRC's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. DRC never writes to your channel.

Meta and Instagram

DRC uses the Instagram Platform from Meta. By connecting an account you also agree to the Instagram Terms of Use. Meta's handling of your data is described in the Meta Privacy Policy. DRC never posts, edits, deletes or messages on your account.

Text message (SMS) and WhatsApp alerts

DRC-Security sends security alerts and one-time verification codes (2FA/OTP, sent when you add or confirm your number) only to a number you add and confirm in Settings, after you tick the consent box. Your number is used only for these messages and for reading your YES, NO, STOP and HELP replies. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Text messages are delivered by Twilio and WhatsApp messages by Meta, which act only as our delivery providers. Message and data rates may apply. Reply STOP to cancel and HELP for help.

How it is protected, where it is stored and for how long

Everything is stored in Amazon Web Services in the United States (us-east-1). All traffic uses HTTPS. Your Google and Meta tokens are kept in AWS Secrets Manager, encrypted at rest, and readable only by DRC's own services; the database is also encrypted at rest. Each customer's data is kept separate, and you can only see your own. Channel data and events are kept in a database while the channel is connected. Stored YouTube and Instagram data is refreshed on every check and retained no longer than 30 days after you disconnect, after which it is deleted.

How to stop it

• Disconnect a channel from the Channels tab in DRC. This revokes DRC's access at Google and deletes the token immediately.
• Revoke from Google at any time in your Google security settings at security.google.com/settings/security/permissions. DRC's next check will fail and it will stop reading your channel.
• Disconnect Instagram from the Channels tab in DRC, which deletes the token immediately, and remove DRC from the business portfolio you chose when connecting: in Meta Business Suite settings open Integrations at business.facebook.com/latest/settings/business_integrations and remove DRC. Removing it there alone also stops DRC: its next check fails and it stops reading your account.
• Stop phone alerts by removing your phone in Settings, which deletes the number, or by replying STOP to a DRC text message (START turns them back on).
• Delete your account and data by emailing the address below. Everything tied to your login is removed within 30 days.

Who to contact

Questions and deletion requests go to the DRC team at support@drcsec.com.

Changes

If this policy changes in a way that affects you, the date above changes and you will be told the next time you sign in.

Terms of Service