Privacy Policy

1. Who this applies to

The app is a private tool for the Built Secret YouTube channel. Only the channel owner’s Google account authorizes it. There are no other user accounts, sign-ups or customers, so this policy describes data the operator collects about the operator’s own channel.

2. Google user data the app accesses

After the channel owner approves access on Google’s consent screen, the app uses two read-only permissions through YouTube API Services: youtube.readonly and yt-analytics.readonly. Through them it reads:

• Per-video statistics from the YouTube Analytics API: views, engaged views, average view duration, average percentage viewed, likes, subscribers gained and estimated minutes watched.
• Audience-retention curves from the YouTube Analytics API: the share of viewers watching at each point of a video.
• Video details from the YouTube Data API: title, publish time and duration.
• The channel identifier, to request the channel’s own statistics.
• The Google authorization token that Google issues after consent (see section 4).

3. What the app does not access

The app does not request permission to upload, edit or delete anything on YouTube. It does not read comments, and it does not collect names, e-mail addresses or other personal information about viewers; the statistics it receives are totals per video.

4. How the data is used

The data is used only to produce internal reports and analysis for the channel owner’s own content decisions. It is combined with the channel’s own production notes, and compared with the performance of the same episodes on other platforms the operator owns (Instagram, Facebook and TikTok), which the app reads through those platforms’ own APIs under separate authorizations that this policy does not cover.

For YouTube data, the app is configured not to calculate new rates or scores, such as likes per 1,000 views or views per day; it works with the figures YouTube provides and with the view counts recorded at 24-hour, 72-hour and 7-day checkpoints. Earlier reports and stored records created before October 26, 2026 can contain rates the operator calculated from this data. Those are the operator’s own calculations; they are not provided or endorsed by YouTube.

The data is not used for advertising, is not sold, and is not used to build profiles of viewers.

5. Where the data is stored

The app runs on a computer operated by the operator. It stores:

• The Google authorization token, in a local file that only the operator’s user account can read.
• The API responses as received, a local database built from them, backup copies of that database, CSV exports and generated reports.

6. Cloud copies and other storage

The operator’s computer synchronizes its Desktop folder with Apple iCloud, and the app’s files are inside that folder. The authorization token, the collected statistics and their backup copies may therefore also be stored on Apple’s iCloud servers, under Apple’s terms.

The app’s source code is kept in a private repository. The repository is configured to exclude the token, the database, raw API responses and generated reports.

The app’s internal dashboard can be opened only from the operator’s own computer; it is not available on the internet.

7. Sharing and service providers

We do not sell Google user data, do not use it for advertising, and do not publish it. Only the operator reads it.

The operator maintains and analyzes the app with an AI coding assistant (Anthropic’s Claude Code). When the assistant reads local reports or database content, that content, which can include YouTube statistics and video titles, is sent to the AI provider for processing under the provider’s terms. The operator does not provide this data to the AI provider for any other purpose.

Apple iCloud (section 6) stores the files as described there. The app also reads, but does not write to, the operator’s production records kept in Notion.

8. Limited Use

Built Secret Analytics’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

9. Retention

Currently, collected data is kept until the operator deletes it. The app has no fixed retention period and does not delete data automatically. Statistics collected since the app began running in September 2026, and the backup copies that contain them, are still retained.

A scheduled job on the operator’s computer checks every day whether the last complete check is more than 25 days old. When it is, the job asks Google, with read-only access, whether the stored authorization is still valid and whether each stored video still exists with the same title, publish time and duration. The job changes or deletes nothing by itself; if something needs attention it leaves a note for the operator, who decides what to do. If the computer is off or offline on a given day, the check is attempted again on the following days.

10. Revoking access

You can revoke the app’s access at any time on the Google Account permissions page (opens in a new tab). After access is revoked or expires, the app can no longer sign in to Google, stops collecting YouTube data and reports an authentication failure.

The app does not delete data automatically when access ends. Deletion is carried out by the operator by hand (section 11); until then, data collected earlier remains.

If the operator disconnects the app, the operator revokes the stored token with Google right away and deletes the stored YouTube data within 7 days. If access is revoked on the Google Account permissions page, the operator deletes the stored YouTube data within 30 days of the revocation.

11. Deleting data

To request deletion, write to hello@hanastudio.co. The operator handles each request by hand: the stored token is revoked with Google right away and the data is deleted within 7 days of receiving the request. Deletion covers the authorization token, raw API responses, database rows, database backup copies, CSV exports and generated reports that contain YouTube data, and files synchronized through iCloud Drive, including their copies in iCloud Drive’s Recently Deleted folder. Deleting data here does not delete data that YouTube or Google stores.

12. Security

The authorization token is kept in a local file readable only by the operator’s user account, the dashboard is reachable only from the operator’s computer, and credentials are excluded from the source repository. No system is perfectly secure, and we cannot guarantee absolute security.

13. Google and YouTube

Built Secret Analytics uses YouTube API Services. By using it you agree to be bound by the YouTube Terms of Service (opens in a new tab). Google’s handling of data is described in the Google Privacy Policy (opens in a new tab).

14. Changes and contact

If this policy changes, we will update the effective date above.

Questions, complaints or deletion requests: hello@hanastudio.co.