VidR Privacy Policy
VidR is a private, owner-operated application for YouTube channels owned by Dominik Łupicki or managed by him with explicit authorization. It has no public user registration. This policy describes what data VidR accesses through Google APIs, how it is used, stored, retained, and deleted.
Data VidR accesses
With the channel owner's OAuth consent, VidR may access the connected channel's identity, video and playlist metadata, captions, processing and publication status, public statistics, and YouTube Analytics and Reporting data. Estimated-revenue data is accessed only for channels whose owner has separately and explicitly granted the dedicated revenue authorization; the default analytics consent covers performance data only. VidR may upload and set an owner-approved custom thumbnail; it does not retrieve thumbnail images through the API. VidR receives OAuth tokens and never asks for or stores a Google or YouTube password.
Purpose
VidR uses these data solely to: authenticate that a token belongs to the expected channel; publish and verify owner-approved finished videos; upload and set approved thumbnails; manage approved captions, playlists, localized metadata, and scheduling or private status; and display private, owner-only channel analytics. A sequential thumbnail-rotation feature is present in the codebase but disabled; it will not run before its changed use case is approved by YouTube.
Storage and security
OAuth credentials are stored locally under the operator's Windows account and encrypted with the Windows Data Protection API (DPAPI). Tokens are never placed in source control, logs, or the analytics database. The private dashboard server stores tokens in files readable only by its dedicated service account. Channel identity, API operation receipts, public counters, and authorized Analytics/Reporting data are stored in private, access-controlled databases and files. No data is exposed publicly.
Sharing and Limited Use
VidR does not sell, rent, share, or transfer Google user data to third parties, does not use it for advertising, and does not allow human access except by the authorizing owner/operator. VidR does not combine YouTube API data with third-party data sources. Aggregate statistics combine only channels verified to belong to the same YouTube-recognized content owner and are visible only to the operator. VidR's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention
Retention is enforced automatically by scheduled cleanup jobs. The periods below reflect the implemented behavior of the application:
| Data | Retention |
|---|---|
| Public-counter snapshots (views, subscribers) | 90 days |
| Authorized Analytics/Reporting history | While the channel remains connected; deleted when it disconnects |
| Raw Reporting report files | 180 days |
| Upload session receipts | 180 days |
| Resolved (inactive) alert records | 180 days |
| API usage accounting | 395 days |
| Cached channel metadata | Refreshed on every collection cycle; deleted when the channel disconnects |
VidR verifies at least every 30 days that each stored authorization remains valid. If an authorization is revoked or can no longer be verified, VidR stops using the data and deletes the channel's stored data within 7 days.
Disconnecting, revocation, and deletion
The operator can disconnect a channel from VidR at any time. Disconnecting revokes the Google OAuth token and deletes the locally stored token together with the channel's stored data immediately, and in every case no later than 7 calendar days. Access can also be revoked directly in Google's security settings at security.google.com/settings/security/permissions. Revocation does not delete content stored by YouTube itself; YouTube content is managed through YouTube.
User control
The operator may request access to, or deletion of, stored data by contacting dominiklupicki@gmail.com. Valid deletion requests are completed as soon as possible and no later than 7 calendar days.