Privacy Policy

1. Introduction

This Privacy Policy describes how TubeForge (hereinafter — “we”, “us”, “Service”) collects, uses, stores, and protects your personal data when using the TubeForge platform, available at tubeforge.co.

By using our Service, you agree to the terms of this Policy. If you disagree with any part, please stop using the Service.

2. Data We Collect

TubeForge collects the following categories of personal data:

Account data (via Google OAuth):

• Full name
• Email address
• Profile photo
• Google account identifier

Project and content data:

• Created projects, thumbnails, metadata texts
• AI generation settings and parameters
• YouTube channel statistics (when connected)

Payment data (via Stripe):

• Subscription and plan information
• Payment history and Stripe customer ID
• Card numbers are stored exclusively on Stripe servers and do not pass through our systems

Usage data (analytics):

• IP address, browser type, device information
• Platform actions, feature usage frequency
• Page views and session duration

2a. YouTube API Services

TubeForge is an API Client of YouTube API Services. By using TubeForge, you agree to be bound by the YouTube Terms of Service.

Your use of YouTube data through TubeForge is also subject to the Google Privacy Policy.

YouTube data we collect and process:

• Channel name and profile information
• Subscriber count
• Video statistics (views, likes, comments)
• Upload capabilities and channel status
• OAuth access tokens and refresh tokens (encrypted at rest)

Per-user data scoping:

YouTube API data is processed and displayed only within the authenticated session of the user who connected the YouTube account. TubeForge does not aggregate, combine, or display YouTube data across different users. No cross-user dashboards, leaderboards, or comparative analytics involving YouTube data are exposed publicly or to other users.

TubeForge does not aggregate YouTube API data with data obtained from other platforms, third-party analytics services, or non-YouTube sources without your explicit consent. YouTube API data is kept logically separated from any data originating outside the YouTube API Services.

Storage and refresh tokens:

YouTube OAuth access tokens and refresh tokens are stored encrypted at rest (AES-256) and used solely to access YouTube API Services on your behalf. Tokens are refreshed automatically while your account remains connected. When you disconnect your YouTube account or delete your TubeForge account, all stored tokens and YouTube-derived data are revoked and deleted from our systems within 30 days, except where retention is required by applicable law.

Derived metrics and AI processing:

TubeForge generates derived metrics from YouTube API data, including engagement scores, posting-time recommendations, AI-generated thumbnails, titles, descriptions, and tags. These derived metrics are visible only to the channel owner within the authenticated dashboard. Derived metrics are not exported via public APIs, sold, shared with third parties for advertising, or used to train generally available machine learning models.

To generate AI features (thumbnails, copy, recommendations), YouTube channel metadata (titles, descriptions, statistics) may be transmitted to our AI sub-processors, OpenAI and Anthropic, under their respective enterprise data-processing agreements. AI providers do not retain your YouTube data beyond what is required to process the request, and your data is not used to train their general models.

Revoking access:

You may revoke TubeForge's access to your YouTube data at any time. The fastest way is via “Settings” → “Connected Accounts” → “Disconnect YouTube” inside TubeForge. You can also revoke access directly via the Google security settings page or at myaccount.google.com/permissions. Upon revocation, all YouTube-derived data is deleted within 30 days.

3. How We Use Data

We use collected data for the following purposes:

Service delivery:

• Authentication and account management
• AI content generation (thumbnails, texts, SEO recommendations)
• Payment processing and subscription management
• YouTube channel analytics and statistics visualization

Product improvement:

• Usage analysis to improve UX and functionality
• Diagnosis and resolution of technical issues
• Development of new features based on usage patterns

Communication:

• Service notifications and updates
• Transactional emails (payment confirmation, subscription changes)
• Responding to support requests

4. Third Parties

TubeForge integrates with the following third-party services to provide platform functionality:

• Stripe— payment processing. Payment data (card numbers) is processed exclusively by Stripe (PCI-DSS Level 1) and is not stored on our servers. See Stripe Privacy Policy.
• Google— OAuth 2.0 authentication, access to YouTube channel analytics. Data usage is governed by the Google Privacy Policy.
• OpenAI— AI content generation (thumbnails, texts, recommendations). Your content may be processed through OpenAI's API under an enterprise data-processing agreement. OpenAI does not retain your data beyond request processing and does not use it to train its general models.
• Anthropic— AI assistant (Atlas) and AI-derived metrics from YouTube channel data. Channel metadata may be transmitted to Anthropic's Claude API under an enterprise data-processing agreement. Anthropic does not retain your data beyond request processing and does not use it to train its general models. See Anthropic Privacy Policy.
• Resend— sending transactional emails (notifications, payment confirmations, access recovery). Only email address and message content are shared.
• PostHog— product analytics (only with your explicit consent via the cookie consent banner). See PostHog Privacy Policy.

We do not sell your personal data to third parties. Data is shared only with the listed services to the extent necessary for providing functionality.

5. Data Storage

Your data is stored on servers located in the European Union (EU). We use reliable hosting providers with ISO 27001 certification to ensure data security and availability.

Data is stored for the entire duration of your account usage. Upon account deletion, personal data is removed within 30 days, except for data we are required to retain under applicable law (e.g., transaction records — up to 7 years).

6. Cookies

TubeForge uses the following types of cookies:

Essential (always active):

• Authentication and session management (Auth.js)
• CSRF protection
• Cookie consent storage

Analytics (consent required):

• PostHog — session and device identifier
• Google Analytics — user identifier

Analytics cookies are set only after your explicit consentvia the cookie consent banner. You can change your choice at any time by clearing your browser localStorage or clicking “Settings” in the cookie banner.

7. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR) and other applicable legislation, you have the following rights:

• Right of access — obtain a copy of your personal data that we process
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (right to be forgotten)
• Right to restriction — restrict processing of your data in certain cases
• Right to portability — receive your data in a machine-readable format (JSON/CSV)
• Right to object — object to processing for marketing purposes
• Right to withdraw consent — withdraw previously given consent at any time

To exercise any of these rights, contact us at privacy@tubeforge.co. We commit to responding to your request within 30 days.

You can also export your data through account settings under “Settings” → “Data & Privacy”.

7a. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Categories of personal information we collect:

• Identifiers (name, email address, account ID)
• Commercial information (subscription plan, payment history)
• Internet or electronic network activity (usage data, IP address, browser type)
• Professional information (YouTube channel data when connected)

Your rights:

• Right to Know — request what personal information we have collected about you
• Right to Delete — request deletion of your personal information
• Right to Opt-Out — opt out of the sale or sharing of your personal information
• Right to Non-Discrimination — exercise your rights without receiving discriminatory treatment

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

To exercise your California privacy rights, contact us at privacy@tubeforge.co. We will respond to verifiable consumer requests within 45 days.

8. Data Deletion

You can request complete deletion of your data through account settings or by email. Upon account deletion, we will:

• Delete all personal data within 30 days
• Remove uploaded content (videos, thumbnails) from our servers
• Revoke YouTube API access
• Cancel active subscriptions via Stripe

Some data may be retained in anonymized form for statistical purposes or in accordance with legal requirements (transaction records — up to 7 years).

9. Data Security

We implement organizational and technical measures to protect your data:

• Data encryption in transit (TLS/HTTPS) and at rest
• Authentication via OAuth 2.0 — we do not store passwords
• Payment processing via Stripe (PCI-DSS Level 1)
• Regular database backups
• Restricted access to personal data

10. Policy Changes

We may update this Privacy Policy. We will notify you of significant changes by email and/or via a notification on the platform at least 30 days before changes take effect.

By continuing to use the Service after changes take effect, you agree to the updated Policy.

11. Contact

For all privacy and personal data processing questions, please contact:

Email: privacy@tubeforge.co

If you believe your rights have been violated, you have the right to file a complaint with the relevant data protection supervisory authority.