Privacy Policy

YSaar uses YouTube API Services to access and organize your YouTube content. By using our service, you agree to be bound by:

• YouTube Terms of Service
• Google Privacy Policy
• YouTube API Services Developer Policies

You can revoke YSaar's access to your data at any time via the Google security settings page.

1.1 YouTube Data We Access

When you connect your YouTube account through per-user Google OAuth 2.0, we access and temporarily store the following YouTube data via YouTube API Services:

• Channel Information: Channel name, description, thumbnail, subscriber count, video count, upload dates
• Playlist Information: Playlist titles, descriptions, thumbnails, video counts, privacy status
• Video Metadata: Video titles, descriptions, thumbnails, channel information, publication dates
• Public Statistics: View counts, like counts, and other publicly available metrics
• OAuth Tokens: We securely store your encrypted Google OAuth access and refresh tokens to maintain your YouTube connection. Tokens are encrypted using AES-256-GCM encryption and stored securely in our database.

Per-User OAuth: Each user connects their own YouTube account with their personal API quota. Your OAuth connection is independent and private to your account only.

Important: We only access publicly available YouTube data. We do not access your private videos, watch history, or any data you have not explicitly made public on YouTube. We never download or cache actual video files.

1.2 Account Information

When you create an account with YSaar, we collect:

• Email address (for authentication and notifications)
• Username (for your account identification)
• Password (encrypted using industry-standard bcrypt hashing)
• Profile preferences and settings

1.3 User-Generated Organization Data

We store your personal organization preferences and notes:

• Custom names and tags for channels and playlists
• Personal notes and comments on videos
• Favorite/bookmark selections
• Custom playlist ordering and organization preferences
• Watch status and progress tracking

We use the collected information solely for the following legitimate purposes:

• Service Provision: To provide, operate, and maintain the YSaar service, including displaying and organizing your YouTube channels, playlists, and videos
• Data Synchronization: To periodically refresh your YouTube data (channels, playlists, video metadata) to keep your collection up-to-date
• Organization Features: To enable you to add custom names, tags, notes, and organize your YouTube content according to your preferences
• Account Management: To create and manage your account, authenticate your identity, and provide customer support
• Service Improvement: To understand usage patterns, improve features, optimize performance, and develop new functionality
• Communication: To send you service-related notifications, updates about new features, and respond to your inquiries
• Security: To detect, prevent, and address technical issues, fraud, abuse, and unauthorized access

We do NOT: Use your YouTube data for advertising, sell your data to third parties, train AI models on your content, or use your data for any purpose other than providing you with the YSaar service.

3.1 YouTube API Data Retention

In compliance with YouTube API Services Terms:

• Maximum Storage Period: YouTube data (channel info, playlist metadata, video details) is stored for a maximum of 30 calendar days before being refreshed or deleted
• Authorization Verification: We verify that your YouTube authorization remains valid every 30 days
• Automatic Deletion: If you revoke access through Google security settings, we delete all your YouTube data within 30 calendar days
• User-Initiated Deletion: If you request data deletion through our service, we delete your YouTube data within 7 calendar days
• No Permanent Caching: We do not permanently cache YouTube videos, thumbnails, or other media files beyond the necessary display period

3.2 Your Personal Data Retention

Your account information and personal notes are retained as follows:

• Account Data: Retained as long as your account is active
• Custom Notes & Tags: Retained indefinitely as part of your personal data until you delete them or close your account
• Inactive Accounts: Accounts inactive for more than 2 years may be deleted after email notification
• Account Deletion: When you delete your account, all your personal data is permanently deleted within 30 days

3.3 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmission uses HTTPS/TLS encryption
• Encryption at Rest: Sensitive data is encrypted in our Neo4j database
• Password Security: Passwords are hashed using bcrypt with salt
• Per-User OAuth 2.0: Each user connects their own YouTube account using secure Google OAuth 2.0 authentication. This means:
  • Each user has their own personal YouTube API quota (not shared)
  • OAuth access and refresh tokens are encrypted using AES-256-GCM encryption before storage
  • Tokens are automatically refreshed when they expire
  • We detect when users revoke access through Google settings and stop accessing their data immediately
• Access Control: Strict role-based access control limits who can access your data
• Regular Audits: We conduct regular security audits and updates
• Secure Infrastructure: Data is stored on secure servers with firewall protection and intrusion detection

4.1 YouTube API Services

YSaar uses YouTube API Services provided by Google LLC. When you connect your YouTube account:

• Your authentication is handled directly by Google through OAuth 2.0
• We access your YouTube data only through official Google APIs
• By using our service, you agree to YouTube's Terms of Service and Google's Privacy Policy
• You can revoke our access at any time through Google's security settings

4.2 No Third-Party Data Sharing

We do NOT share, sell, rent, or trade your YouTube data or personal information with third parties for their marketing or advertising purposes.

We may share your data only in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to share specific information
• Service Providers: With trusted hosting and infrastructure providers who help us operate the service (e.g., cloud hosting) under strict data protection agreements. These providers cannot use your data for their own purposes.
• Legal Requirements: When required by law, court order, or government regulation, or to protect our legal rights, prevent fraud, or ensure user safety
• Business Transfers: In the event of a merger, acquisition, or sale of assets, with advance notice to you

4.3 Analytics and Cookies

We use essential cookies for:

• Authentication: Keeping you signed in securely
• Preferences: Remembering your settings and theme choices
• Performance: Understanding how users interact with our service to improve functionality

You can control cookies through your browser settings, but disabling certain cookies may affect service functionality.

You have comprehensive rights regarding your personal data:

• Access: Request a copy of all personal data we hold about you in a portable format (JSON or CSV)
• Correction: Update or correct any inaccurate information in your account settings at any time
• Deletion: Request deletion of your account and all associated data. We will permanently delete your data within 7 calendar days (YouTube data) or 30 days (account data)
• YouTube Access Revocation: Revoke YSaar's access to your YouTube data at any time through Google's security settings page. We will delete all YouTube data within 30 days of revocation.
• Data Portability: Export your custom notes, tags, and organization preferences to take them to another service
• Objection: Object to processing of your personal data for specific purposes
• Restriction: Request that we limit how we use your data while maintaining your account
• Withdraw Consent: Withdraw consent for data processing at any time (note: this may limit service functionality)

Important for EU Users: These rights are guaranteed under the General Data Protection Regulation (GDPR). If you are located in the European Economic Area (EEA), you have additional rights including the right to lodge a complaint with your local data protection authority.

How to Exercise Your Rights

To exercise any of these rights, you can:

• Use the settings and data management tools in your account dashboard
• Disconnect YouTube: Visit Settings → YouTube Connection to disconnect your YouTube account. This will delete your OAuth tokens and stop all access to your YouTube data.
• Contact us at [email protected]
• Submit a data request through our support system

We will respond to your request within 30 days and may verify your identity before processing sensitive requests.

YSaar may store and process your data in various locations to provide our service globally. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, please be aware that:

• Your data may be transferred to and processed in countries outside the EEA
• We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses
• Your data is protected by this Privacy Policy regardless of where it is processed

EU User Consent Policy

In compliance with YouTube API Services requirements and GDPR:

• We obtain your explicit consent before accessing your YouTube data
• You have the right to withdraw consent at any time through Google's security settings
• We comply with all GDPR requirements for lawful data processing
• You have the right to lodge complaints with your local data protection authority