Privacy Policy

1. Who we are

WebCoreLab is a digital agency. Contact: [email protected]. Homepage: https://webcorelab.com/.

2. What data we access

Our application requests these Google OAuth scopes:

• youtube.force-ssl — to read and manage channel metadata (title, description, playlists, video settings, comments) belonging to the authenticated channel.
• youtube.upload — to upload video files, thumbnails, captions, and metadata to the authenticated channel.

We only access data belonging to the single YouTube channel owned by the authenticated user (our own WebCoreLab channel). We do not access, view, or store data from other Google products, other YouTube channels, or other Google accounts.

3. How we use the data

Access is used exclusively to:

• Upload video content to our own YouTube channel.
• Update channel branding, video descriptions, titles, tags, and thumbnails.
• Read channel analytics and video performance for internal editorial planning.

We do not share, sell, trade, rent, or transfer any data obtained through Google APIs to third parties. We do not use this data for advertising, profiling, or any purpose beyond operating our own YouTube channel.

4. Data storage, protection and retention

This section describes the concrete safeguards we apply to the credentials and data obtained through Google APIs.

• Where credentials are stored. OAuth refresh and access tokens are stored in a single file on our own private server (Hetzner, EU region). The file is located outside the public web root, so it cannot be requested over HTTP under any circumstances.
• Access control. The token file is set to Unix permission mode 600: readable and writable only by one dedicated operating-system account. No other account, service, or process on the server can read it. Access to the server is limited to authorised personnel of WebCoreLab.
• Excluded from source control and backups. Credential files are listed in .gitignore and are not tracked in any code repository, and are never included in artefacts that leave our infrastructure.
• Encryption in transit. All communication with Google is performed over HTTPS/TLS. Tokens are transmitted only to Google's official OAuth and API endpoints and to no other destination.
• Least privilege. We request only the two scopes strictly required to operate our own channel (youtube.upload, youtube.force-ssl). We do not request scopes for other Google products, and the application operates on a single channel that we own.
• Account protection. The Google account that owns the channel is protected by two-factor authentication.
• Retention and deletion. Video files and channel metadata are not retained in our own databases beyond the time required to perform the upload or update operation. Tokens are kept only while the integration is in active use; when it is discontinued, the token file is deleted from the server and access is revoked on the Google side. No YouTube analytics data is stored long-term.
• Logging. Every API operation writes a timestamped entry to an internal log recording which operation was performed. Logs contain no access tokens, refresh tokens, or client secrets.
• Incident response. If we have any reason to believe a credential has been exposed, we revoke it immediately at https://myaccount.google.com/permissions, issue a replacement, and review the operation log for unexpected activity.
• No disclosure to third parties. Data obtained through Google APIs is never sold, rented, shared or transferred to third parties, is not used for advertising or profiling, and is not used to train artificial-intelligence or machine-learning models.
• User-initiated revocation. Access can be withdrawn at any time at https://myaccount.google.com/permissions. Revocation takes effect immediately and the application loses all access.

5. Google API Services User Data Policy

This application uses YouTube API Services. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By using this application, you also agree to be bound by the YouTube Terms of Service.

6. Google Privacy Policy

For information on how Google itself collects and handles data, please review the Google Privacy Policy: http://www.google.com/policies/privacy.

7. Your rights

You may revoke this application's access to your Google account at any time via Google Account permissions. Revocation is immediate and complete. You may also contact us directly with any questions or requests regarding your data.

8. Cookies and tracking

This application is a server-side integration that does not use cookies, analytics, or tracking of any kind in connection with the YouTube API data it accesses. Our public website (webcorelab.com) uses standard website analytics unrelated to this integration.

9. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this document indicates the last revision. Continued use of the application after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this policy or our data practices: [email protected].