Privacy Policy

Some of this you give us; some is created automatically as you use the service.

• Account information — the email address, name, and profile image URL that Google gives us when you sign in. We never receive or store your password.
• YouTube subscriptions — if you grant read access during Google sign-in, we retrieve channel IDs and names for the selection screen. We store only the channels you choose to follow in TubeSignal. We do not separately store the Google access token.
• What you enter — the YouTube links you submit, the email address you leave to be notified when a post is ready, and the questions you ask about a video.
• Free usage counters — the video IDs you explicitly request and the times of those requests, questions, and saves. We use them to calculate monthly allowances. Removing a saved item does not erase the usage record for that month.
• Anti-abuse signals — for share-mission outcome counting and the signed-out creation limit, we store a cookie identifier, device and browser details, and your IP address only as irreversible hashes. The original values are not stored.
• Usage information — the pages you visit, when you visit them, your device type, browser, and operating system, and how you arrived, plus usability signals such as clicks that got no response or were repeated (only the kind of element and the screen width — never what you type). Vercel Web Analytics aggregates this for us (see section 4). We also use Google’s ads conversion tag to see whether people who arrive from a search ad go on to follow a channel — that is for measuring ad performance, not for identifying you personally or following you around other sites to show you targeted ads.
• Push notification information — the device push endpoint and encryption public keys, browser and device details, and delivery or failure records when you enable notifications.
• Article share outcomes — the first shared article ID, sharer account, visit time, visible reading time, completed signup and channel subscription, and a hashed visitor identifier. We link anonymous visits to a verified account after signup or login to avoid duplicate mission credit. We do not store signed-out visitors’ IP addresses in this record.
• Billing information — your billing email, billing name and address, tax country, order and subscription identifiers, payment status, card brand, and masked card digits. Full card numbers, security codes, and payment credentials are collected by the checkout provider and are not sent to us.

The YouTube captions we read and analyze are information YouTube has made public. They aren’t personal information about you.

• Contract — to create and manage your account, provide articles and alerts you request, process purchases, manage subscriptions and refunds, and provide support.
• Legitimate interests — to secure, troubleshoot, measure, and improve the service, prevent fraud and abuse, and keep necessary business records, where those interests are not overridden by your rights.
• Legal obligation — to keep tax, accounting, payment, consumer-protection, and compliance records and respond to lawful requests.
• Consent — for non-essential advertising or analytics storage where the law requires consent. You may refuse or withdraw consent without losing access to the service.

We don’t use your account or payment information to send you advertising.

• Account information — deleted promptly when you close your account. Posts you created may stay reachable at their public URL; in that case we cut the link between the post and your account and the post itself remains. Free usage counters tied to the account are deleted too.
• Anti-abuse hashes — signed-out creation records are deleted after 35 days, and device/IP hashes from share visits after 400 days.
• Notification email addresses — kept after we send, so we can confirm and retry delivery. Ask us and we’ll delete them.
• Usage information — kept for statistics. We don’t use it to identify individual people.
• Article share outcome records — used to avoid duplicate credit and verify rewards. Records linked to the sharer or a verified visitor are deleted when that account closes.
• Order, subscription, tax, refund, and dispute records — kept for as long as required for the transaction and applicable tax, accounting, consumer-protection, fraud-prevention, and legal-claims periods. Under Korean e-commerce rules, payment and supply records and contract or withdrawal records are generally kept for 5 years, and consumer complaint or dispute records for 3 years.
• Payment credentials — we do not store full card details. Lemon Squeezy and its payment providers retain payment information under their own legal and compliance obligations; see their privacy notices for their retention practices.

We don’t sell your personal information. We share it only with the companies we need to run the service:

• Supabase — database and sign-in (US company; data stored in Singapore)
• Vercel — website hosting and visitor analytics (Web Analytics) (United States)
• Google — sign-in (OAuth), reading your YouTube subscriptions with permission (YouTube Data API), AI analysis (Gemini) that turns captions into a post, and search-ad conversion measurement (Google Ads) (United States)
• X Corp. — measuring X ad visits and conversions (X Ads Pixel) (United States)
• Meta Platforms, Inc. — measuring Facebook and Instagram ad visits and conversions (Meta Pixel) (United States)
• Microsoft Corporation — usability analytics such as session replays and heatmaps (Microsoft Clarity), when enabled; where consent is required it runs only after you accept, and text you type is masked (United States)
• Resend — sending notification emails (United States)
• Apple, Google, and other platform push services — web push delivery when enabled
• Lemon Squeezy, operated by Sold through Link, LLC (United States) — merchant of record and authorized reseller for purchases outside Korea. It collects billing contact details, billing address, tax location, and payment details; processes charges, tax, invoices, renewals, refunds, chargebacks, fraud checks, and buyer support; and sends us order and subscription status plus limited masked payment details needed to provide your plan.
• Lemon Squeezy’s payment and compliance providers, including Stripe where applicable — card processing, fraud prevention, identity and compliance checks, and payment-network operations. Those providers receive the information necessary for the payment method you choose under Lemon Squeezy’s instructions and their own legal obligations.

Beyond these purposes, we hand over information only when the law requires it.

Depending on where you live, including under the GDPR and UK GDPR, you may ask to access, correct, delete, restrict, or receive a portable copy of your personal information; object to processing based on legitimate interests; and withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. You may also complain to your local data-protection authority. California residents may request access, correction, or deletion and information about collection and disclosure, and may opt out of sale or sharing. We do not sell personal information or use it for cross-context behavioral advertising. We will not discriminate against you for exercising a privacy right.

You can close your account from My page. For any other request, email us from the address associated with your account so we can verify and respond to you.

Essential cookies keep you signed in, remember language and region choices, and protect account flows. Refusing these in your browser may prevent account features from working. Vercel Web Analytics provides aggregate, cookie-free traffic measurement. Google Ads, X Ads, and Meta Pixel may use storage or identifiers for ad conversion measurement, and Microsoft Clarity (when enabled) uses cookies for usability analytics. In the EEA, United Kingdom, and Switzerland, those advertising tools remain denied until you make an affirmative choice in our consent banner.

For share outcomes, visitors receive a one-year visitor cookie and a 24-hour referral cookie. Browser session storage carries visible reading time across articles. Expired referral sessions are removed after seven days, delivered notification records after 90 days, and device/network-range hashes after 400 days. It is sent only to TubeSignal and is not used for advertising tracking.

You can decline in the banner and still use the service. To withdraw a previous choice, clear TubeSignal’s site data in your browser and revisit the site, then choose Decline; you can also block or delete cookies in browser settings. You may email us if you need help. Withdrawing consent stops future consent-based measurement but cannot undo processing already completed lawfully.

Your information sits in a database with controlled access, and everything in transit is encrypted (HTTPS). Only the few people who need it to run the service can reach it.

TubeSignal isn’t for children under 13, and we don’t knowingly collect information from them. If you believe a child under 13 has given us information, email us and we’ll delete it.

We operate from the Republic of Korea; our primary database is hosted in Singapore; and providers listed above may process information in the United States and other countries where they or their subprocessors operate. Those countries may have different privacy laws. For restricted transfers from the EEA or UK, we rely as applicable on an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, and supplementary technical and organizational measures. Where a provider acts as an independent controller, its own transfer terms and privacy notice also apply. You may contact us for information about the safeguard relevant to your data.

California residents have the right to know what personal information we collect, to request that we delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising. To make a request, email us at the address below.

For anything about privacy, email support@tubesignal.net.

If this policy changes, we’ll post the new version here with the date it takes effect and what changed. For significant changes, we’ll tell you at least 7 days beforehand.