Privacy Policy

Last updated: June 1, 2026.

What we collect

• Account info: email, display name, hashed password (or Google sign-in claim).
• YouTube data: channel metadata, channel ids, video ids, video titles, video descriptions, and scan results derived from the descriptions for channels you connect.
• OAuth refresh tokens: stored encrypted at rest using ASP.NET Data Protection. Never logged.
• Billing: Stripe handles all payment data. We store the customer + subscription ids only.

Google user data

Channel Workbench uses Google OAuth and the YouTube Data API only after you choose to connect a YouTube channel. We request the https://www.googleapis.com/auth/youtube.readonly scope so we can read your channel list, video list, and video descriptions. We use that read-only data to scan description links, identify broken or risky links, display findings in your dashboard, and generate scan/export/report views. We never request scopes that allow us to upload, edit, delete, comment on, or manage your YouTube content.

We store the minimum Google user data needed to provide the service: connected channel metadata, video metadata, descriptions needed for link scans, scan history, findings, and encrypted OAuth tokens. OAuth access and refresh tokens are encrypted at rest and are not written to logs. Access is limited to systems and personnel needed to operate, secure, and support Channel Workbench.

Channel Workbench's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data and other sensitive data

We use administrative, technical, and organizational safeguards designed to protect Google user data and other sensitive data against unauthorized access, use, disclosure, alteration, loss, or destruction.

• Encryption in transit: Channel Workbench is served over HTTPS/TLS so account, OAuth, and YouTube API data are encrypted while moving between your browser, our application, and service providers.
• Encryption at rest: OAuth access and refresh tokens, Amazon API credentials, and other stored integration secrets are encrypted at rest using ASP.NET Data Protection before being saved.
• Access controls: production data access is limited to authorized systems and personnel who need access to operate, secure, or support Channel Workbench.
• Logging controls: OAuth tokens, refresh tokens, and integration secrets are not written to application logs.
• Least-privilege OAuth: we request only the read-only YouTube scope needed for the product and do not request permissions to upload, edit, delete, comment on, or manage YouTube content.
• Account protection: passwords are stored as salted hashes through ASP.NET Identity, session cookies use secure authentication controls, and email confirmation is required for new accounts.

How we share data

We do not sell your personal information or Google user data. We share data only with service providers that help us operate Channel Workbench, such as hosting, database, email delivery, observability, and payment processing providers, and only as needed for those services. Stripe processes payment details directly; we store Stripe customer and subscription ids rather than card numbers. We may also disclose information if required by law, to protect users, or to investigate abuse or security issues.

What we don't do

• We do not sell your data.
• We do not transfer Google user data to advertising platforms, data brokers, or information resellers.
• We do not use Google user data for ads, retargeting, or interest-based advertising.
• We do not edit, post, or delete videos on your channel.
• We do not use raw, derived, aggregated, or anonymized Google user data to train generalized AI or machine learning models.

How long we keep data

Connected channel data, scan history, and findings are retained while your workspace is active so you can review results over time. When you disconnect a channel, we revoke OAuth tokens at Google and stop scanning that channel. When you delete your account, all workspace data, findings, and tokens are purged within 30 days, except where limited records must be retained for legal, security, or billing compliance.

Your rights

You can disconnect any channel from Channels, manage your account from Account, and export findings as CSV from the dashboard. For a full data export or deletion request, email [email protected].

Cookies

We use first-party cookies for authentication, session security, and CSRF protection. We also use the Google tag for conversion measurement for our own marketing. We do not use Google user data from the YouTube Data API for advertising, retargeting, or interest-based ad targeting.

Contact

Questions about privacy? [email protected].