Privacy Policy

1. Overview

TubeDoe ("we", "us", "our") provides YouTube channel analytics, video SEO optimization, AI coaching, thumbnail creation and creator research at tubedoe.com. This policy explains how we access, collect, use, store, share and protect information when you use our website and services, including information obtained through Google and YouTube APIs.

Connecting YouTube is separate from signing in to TubeDoe. You choose whether to authorize read-only channel analytics. You can use features that do not require those permissions without connecting your YouTube account.

2. Information we collect

• Account information: your name, email address, account identifiers, profile preferences and authentication information. Password-based accounts are managed by our authentication service; TubeDoe does not display your password.
• Content you provide: prompts, chat messages, reference images, branding images, descriptions, video or channel links, saved projects and generated content.
• Public YouTube information: channel and video identifiers, titles, descriptions, tags, thumbnails, publication dates and publicly available counters such as views, subscribers, video counts, likes and comments. This includes channels or videos you connect, research or track as competitors.
• Authorized YouTube information: channel-owner analytics made available by Google, such as views, watch time, average view duration, traffic sources and audience reports. Impressions and click-through rate are used only when an authorized report supplies them; permission does not guarantee every metric is available.
• Google connection information: granted permission scopes, connection timestamps, account email or identifier when available, and an encrypted refresh token used to maintain your authorized connection.
• Billing and service records: subscription status, payment-provider customer and subscription identifiers, credit balances and usage, generation records, notifications and service activity. Payment collection is handled through Stripe.
• Support and technical information: information you send in support requests, and diagnostic or security records. Contact-form submissions include your name, email, message, IP address and browser user-agent information.

3. Why we use information

We use information to authenticate you, operate your account and subscription, display channel and video dashboards, calculate source-based scores, record dated performance observations, provide research and comparisons, generate the content you request, save your projects, and deliver service notifications. We also use appropriate records to investigate errors, respond to support requests and protect the service against abuse.

Public counters can be collected periodically for connected channels and synced videos to build dated history. These observations are distinct from private, owner-authorized Analytics reports. We do not represent a competitor's private analytics as information available through your authorization.

4. Google and YouTube permissions

• youtube.readonly allows TubeDoe to read YouTube channel and video information for your connected workspace.
• yt-analytics.readonly allows TubeDoe to read authorized channel-owner Analytics reports for dashboards and performance insights.

TubeDoe requests read-only YouTube permissions only. It does not publish video metadata, channel descriptions, profile images or logos to YouTube. You can copy your drafts and apply changes yourself in YouTube Studio. Older Google grants may still list edit permission until you revoke them in your Google Account; TubeDoe does not use those permissions to make changes.

For a public example of these features, see our YouTube Analytics review page. It displays only real metrics explicitly shared by the channel owner; private dashboards, account details and Google credentials are not exposed.

TubeDoe's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used for the user-facing features described in this policy, not sold or used for advertising targeting.

5. Data protection and security safeguards

• Encryption of stored Google refresh tokens: refresh tokens are encrypted with AES-256-GCM before database storage. The encryption key is kept in server-side secret configuration, separate from the stored encrypted token.
• Server-side credential handling: Google OAuth client secrets, token-encryption keys and stored refresh tokens are handled by server-side code. The refresh-token table is not available through ordinary authenticated browser access. Server code obtains short-lived access tokens to make authorized Google requests.
• Protected connections: the production website and requests to Google's OAuth, YouTube and Analytics services use HTTPS to protect information in transit.
• Authenticated access and ownership checks: protected actions derive the requesting user's identity from their authenticated session. Owner-scoped database access rules and server-side checks restrict access to account records. Private channel analytics require verification of the authorized YouTube channel; a signed-in account or administrator role alone does not grant access to another creator's private analytics.
• Protected authorization flow: YouTube OAuth uses a signed state value with an expiry to validate the connection callback. Refresh tokens are stored encrypted after authorization.
• Read-only YouTube access: TubeDoe saves optimization drafts in your workspace but cannot publish or restore changes on YouTube. Previously saved metadata history remains available for review and copying.

These safeguards reduce risk but cannot guarantee that every transmission or storage system is completely secure. Keep your sign-in credentials and share links private, and contact us if you suspect unauthorized access.

6. Service providers, AI processing and sharing

We do not sell your personal information. Information is processed by services needed to operate TubeDoe, including Lovable Cloud for application infrastructure, authentication, database and file storage; Stripe for payments; AI generation services for requested content; and email delivery services for service messages. Google receives the requests needed to connect your account, retrieve authorized data.

When you request AI coaching or generation, relevant prompts, conversation messages, reference images and channel, video, audit or analytics context may be sent to an AI service. TubeDoe saves conversations and generation records to support your history and projects. Google OAuth refresh tokens and client secrets are not inputs to AI generation. Do not include passwords, payment-card details or other unnecessary sensitive information in prompts or images. AI-service retention and processing are also subject to that provider's applicable terms; this policy does not promise zero retention by external providers.

If you create a public report share link, anyone who obtains that link can view the selected report snapshot without signing in. You can revoke the link and, where offered, set an expiry. Revocation does not erase copies someone has already downloaded or recorded.

We may disclose information where required by applicable law or where necessary to investigate abuse, protect rights or respond to a security incident, subject to applicable Google user-data restrictions.

7. Storage and retention

TubeDoe stores account records, saved content, conversations, generated assets, reports, dated performance snapshots, previously saved metadata history and service records to provide the workspace and its history. Retention depends on the record's purpose, your deletion requests, and applicable legal, accounting or security requirements; we do not claim a single automatic deletion deadline for all records.

Providers may process or store information outside your country. Backup and provider-held records can have different retention periods from active application records. Contact us for assistance with your data rather than assuming that cancelling a subscription or disconnecting YouTube erases all stored records.

8. Disconnecting Google and requesting deletion

Disconnecting a YouTube connection in TubeDoe deletes the stored authorization-token record for that connection. This stops TubeDoe from using that stored connection for future authorized requests. It does not by itself revoke permissions in your Google account, delete previously saved analytics, conversations, projects or public observations, or disconnect other separately authorized channel connections.

You can also revoke TubeDoe's access in your Google Account third-party connections. Revocation prevents further use of that Google authorization but does not itself remove information already saved in TubeDoe.

To request deletion of your TubeDoe account, stored Google data or uploaded content, email support@tubedoe.com from the address associated with your account and describe the records or connections involved. We may need to verify your identity before acting. We will explain any information that must be retained for legal, billing or security reasons. You do not need to provide your password or Google tokens.

9. Your choices and privacy rights

You can update available profile settings, choose whether to connect read-only YouTube Analytics, use available report exports, and revoke report links. Depending on the laws that apply to you, you may have rights to access, correct, delete or obtain a copy of your personal information, restrict or object to certain processing, or withdraw consent. Send requests to support@tubedoe.com. Withdrawing authorization can make the associated features unavailable.

10. Browser storage and third-party websites

Authentication uses browser storage and related session mechanisms to keep you signed in and refresh your session. Browser settings can clear or restrict this storage, which may sign you out or affect saved preferences. Google, Stripe and other services you visit through TubeDoe manage their own websites and storage under their own policies.

For information about Google's handling of data, see the Google Privacy Policy. TubeDoe's YouTube features are also subject to the YouTube Terms of Service.

11. Children and policy updates

TubeDoe is intended for users aged 16 and over, as stated in our Terms of Service. If you believe a child has provided personal information, contact us so we can investigate. We may update this policy as our service or legal obligations change; the date above identifies the latest revision.

12. Contact

For privacy questions, security concerns or data requests, contact TubeDoe at support@tubedoe.com. Please identify the affected account without sending passwords, OAuth tokens or payment-card details.