Privacy Policy

1. Introduction

This Privacy Policy describes how TubeForge (hereinafter — “we”, “us”, “Service”) collects, uses, stores, and protects your personal data when using the TubeForge platform, available at tubeforge.co.

By using our Service, you agree to the terms of this Policy. If you disagree with any part, please stop using the Service.

2. Data We Collect

TubeForge collects the following categories of personal data:

Account data (via Google OAuth):

• Full name
• Email address
• Profile photo
• Google account identifier

Project and content data:

• Created projects, thumbnails, metadata texts
• AI generation settings and parameters
• YouTube channel statistics (when connected)

Payment data (via Stripe):

• Subscription and plan information
• Payment history and Stripe customer ID
• Card numbers are stored exclusively on Stripe servers and do not pass through our systems

Usage data (analytics):

• IP address, browser type, device information
• Platform actions, feature usage frequency
• Page views and session duration

2a. YouTube API Services

TubeForge uses YouTube API Services. By using TubeForge, you agree to the YouTube Terms of Service.

Your use of YouTube data through TubeForge is also subject to the Google Privacy Policy.

YouTube data we collect and process:

• Channel name and profile information
• Subscriber count
• Video statistics (views, likes, comments)
• Upload capabilities and channel status

You may revoke TubeForge's access to your YouTube data at any time via the Google security settings page.

3. How We Use Data

We use collected data for the following purposes:

Service delivery:

• Authentication and account management
• AI content generation (thumbnails, texts, SEO recommendations)
• Payment processing and subscription management
• YouTube channel analytics and statistics visualization

Product improvement:

• Usage analysis to improve UX and functionality
• Diagnosis and resolution of technical issues
• Development of new features based on usage patterns

Communication:

• Service notifications and updates
• Transactional emails (payment confirmation, subscription changes)
• Responding to support requests

4. Third Parties

TubeForge integrates with the following third-party services to provide platform functionality:

• Stripe— payment processing. Payment data (card numbers) is processed exclusively by Stripe (PCI-DSS Level 1) and is not stored on our servers. See Stripe Privacy Policy.
• Google— OAuth 2.0 authentication, access to YouTube channel analytics. Data usage is governed by the Google Privacy Policy.
• OpenAI— AI content generation (thumbnails, texts, recommendations). Your content may be processed through OpenAI's API. We do not send personal data to OpenAI, only project content for generation.
• Resend— sending transactional emails (notifications, payment confirmations, access recovery). Only email address and message content are shared.
• PostHog— product analytics (only with your explicit consent via the cookie consent banner). See PostHog Privacy Policy.

We do not sell your personal data to third parties. Data is shared only with the listed services to the extent necessary for providing functionality.

5. Data Storage

Your data is stored on servers located in the European Union (EU). We use reliable hosting providers with ISO 27001 certification to ensure data security and availability.

Data is stored for the entire duration of your account usage. Upon account deletion, personal data is removed within 30 days, except for data we are required to retain under applicable law (e.g., transaction records — up to 7 years).

6. Cookies

TubeForge uses the following types of cookies:

Essential (always active):

• Authentication and session management (Auth.js)
• CSRF protection
• Cookie consent storage

Analytics (consent required):

• PostHog — session and device identifier
• Google Analytics — user identifier

Analytics cookies are set only after your explicit consentvia the cookie consent banner. You can change your choice at any time by clearing your browser localStorage or clicking “Settings” in the cookie banner.

7. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR) and other applicable legislation, you have the following rights:

• Right of access — obtain a copy of your personal data that we process
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (right to be forgotten)
• Right to restriction — restrict processing of your data in certain cases
• Right to portability — receive your data in a machine-readable format (JSON/CSV)
• Right to object — object to processing for marketing purposes
• Right to withdraw consent — withdraw previously given consent at any time

To exercise any of these rights, contact us at privacy@tubeforge.co. We commit to responding to your request within 30 days.

You can also export your data through account settings under “Settings” → “Data & Privacy”.

7a. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Categories of personal information we collect:

• Identifiers (name, email address, account ID)
• Commercial information (subscription plan, payment history)
• Internet or electronic network activity (usage data, IP address, browser type)
• Professional information (YouTube channel data when connected)

Your rights:

• Right to Know — request what personal information we have collected about you
• Right to Delete — request deletion of your personal information
• Right to Opt-Out — opt out of the sale or sharing of your personal information
• Right to Non-Discrimination — exercise your rights without receiving discriminatory treatment

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

To exercise your California privacy rights, contact us at privacy@tubeforge.co. We will respond to verifiable consumer requests within 45 days.

8. Data Deletion

You can request complete deletion of your data through account settings or by email. Upon account deletion, we will:

• Delete all personal data within 30 days
• Remove uploaded content (videos, thumbnails) from our servers
• Revoke YouTube API access
• Cancel active subscriptions via Stripe

Some data may be retained in anonymized form for statistical purposes or in accordance with legal requirements (transaction records — up to 7 years).

9. Data Security

We implement organizational and technical measures to protect your data:

• Data encryption in transit (TLS/HTTPS) and at rest
• Authentication via OAuth 2.0 — we do not store passwords
• Payment processing via Stripe (PCI-DSS Level 1)
• Regular database backups
• Restricted access to personal data

10. Policy Changes

We may update this Privacy Policy. We will notify you of significant changes by email and/or via a notification on the platform at least 30 days before changes take effect.

By continuing to use the Service after changes take effect, you agree to the updated Policy.

11. Contact

For all privacy and personal data processing questions, please contact:

Email: privacy@tubeforge.co

If you believe your rights have been violated, you have the right to file a complaint with the relevant data protection supervisory authority.