Privacy policy

YT PUBLISHING LTD, Hong Kong (“we”, “us” or “our”), operates Video Publisher and its website at video-publisher.online. For privacy questions, access or correction requests, and complaints, contact admin@video-publisher.online.

This policy covers the application’s video publishing, channel management, comment and analytics features, and communications with our support team. Video Publisher uses YouTube API Services. Google’s handling of your information is explained in the Google Privacy Policy.

The features you use and the permissions you grant determine which information is accessed. Some data concerns other people, such as the authors of public comments.

Google handles sign-in. Do not provide your Google password to Video Publisher. The public /demo workspace uses sample YouTube data and identity-only Google sign-in. The separate /staging integration workspace is restricted to approved test accounts and performs real YouTube API operations when you enable and use its features.

Google sign-in requests only openid, userinfo.email and userinfo.profile. In the restricted integration workspace, you enable each module separately. Permission to use an unrelated module is not required.

• Channel & library: youtube.readonly reads your channel, videos, private metadata, statistics and playlists.
• Publishing: youtube.upload uploads videos you select. It does not authorize editing or deleting existing content.
• Content & community: youtube.force-ssl supports video edits and deletion, supported channel settings, playlists, subtitles, comment creation, replies, editing, deletion and moderation.
• Performance analytics: yt-analytics.readonly and the accompanying youtube.readonly access read the channel and video reports returned by YouTube.

These seven scopes are requested only in the combinations required by the selected feature. The application checks actual grants. You can decline a module and continue using other modules. Broad youtube, partner scopes, commerce-link, video-download, paid-membership and monetary-analytics scopes are not requested in this verification build.

Information is used to deliver the channel functions you choose: upload or update a video, display an authorized report, manage a comment, maintain the connection, answer a support request, or investigate a service or security issue. Channel changes must follow your instructions.

Audience reports describe groups rather than identifying individual viewers. Search terms and referring videos are the traffic details returned by YouTube; they are not a viewer’s private search or browsing history. Missing or suppressed reports are not treated as proof of zero activity.

Estimated revenue is not a final payment amount. Video Publisher does not determine YouTube Partner Program eligibility or infer monetization status from analytics.

Video Publisher’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Google-derived information is used only for the prominently described features you authorize. It is not sold, used for ad targeting or credit decisions, or used to train general-purpose AI models. We do not combine customers’ private channel reports to create a cross-customer data product.

Human access is limited to your specific permission, necessary security work, or legal requirements. Staff and service providers are subject to the same restrictions. No general right to browse your private videos, comments or revenue reports is created by granting OAuth access.

Google and YouTube receive the API requests and content necessary to carry out the actions you choose. For example, an upload transmits the selected video and its metadata to YouTube, and a comment reply transmits your reply text. Public or unlisted content may be accessible to other people according to the visibility you choose and YouTube’s rules.

Hosting, storage and communication providers process information on our behalf only as needed to operate, secure and support the service, subject to the restrictions in this policy. Authorized personnel access information only for the purposes and under the Limited Use conditions described above. We may also disclose information when required by law or necessary to address a security incident. A transfer of Google-derived data in a business transaction requires the applicable prior user consent.

The application runs on server infrastructure. Hosting arrangements and processing locations are selected according to the legal requirements applicable to the user’s jurisdiction. The informational website is hosted through OpenAI Sites and its infrastructure providers. Google processes information under its own privacy policy. Where processing involves a cross-border transfer, applicable legal requirements and safeguards apply.

Contact admin@video-publisher.online with questions about the hosting arrangements applicable to your use of the application.

Short-lived connections

Google sign-in uses encrypted, Secure, HttpOnly cookies. Authorization cookies expire within 10 minutes; account sessions last up to one hour. Public demo sign-in discards Google tokens after reading your identity. The restricted live integration stores access tokens encrypted on the server, bound to your account, browser session and selected module, until their expiry (at most one hour). No refresh tokens or offline access are requested.

Data minimization

Video files pass to YouTube in upload chunks and are not retained by Video Publisher. Channel records, analytics, subtitles and comments are fetched on demand and held in the current page memory; the application does not build a persistent copy of those datasets. A short activity history stores your account identifier, operation name, affected channel/resource IDs, outcome and timestamp. History is available for seven days; expired tokens, upload-session records and history are purged when the integration workspace next processes a request. No expired connection or history is returned to users.

Disconnect workspace immediately deletes server-side connection records, upload-session records and activity history for your account and clears the test-session cookies. This does not revoke Google’s project-wide permissions or delete the content you placed on YouTube. Use Google account connections to revoke permissions. When a Google API response indicates that access is no longer valid, the application removes stored integration records for that account.

We process verified deletion requests sent to admin@video-publisher.online within 7 calendar days. Any separately retained support correspondence or legal records are limited to their continuing purpose. Providers may maintain protected operational logs under their service policies.

Security

Google tokens are not exposed to page scripts. Server-side checks restrict each operation to an approved test account, the enabled module and the connected channel. Writes require a same-origin user request; permanent deletion requires a separate confirmation.

The website does not include advertising pixels or visitor analytics scripts. Hosting and security providers process requests needed to deliver the service and may use security cookies.

Public demo sign-in uses __Host-vp_oauth (up to 10 minutes) and __Host-vp_session (up to one hour). The restricted integration uses __Host-vp_integration_flow and __Host-vp_integration with the same respective limits. These encrypted cookies are Secure and HttpOnly and cannot be read by page JavaScript.

The sample workspace resets simulated actions on reload. The restricted integration workspace performs real operations that persist on YouTube. External links open services with their own privacy practices. Revoking access is available at Google account connections.

You can request access to, correction of, or deletion of your information by emailing admin@video-publisher.online. Include the relevant channel URL or ID and enough information to identify your request. We may ask for proportionate evidence of control of the account; never send a password, access token or recovery code.

You can revoke access at Google’s third-party access settings. See our data deletion instructions for instructions on requesting deletion directly. Revocation through Google itself triggers the cleanup obligation; emailing us is optional after revocation.

Deleting application-held information does not itself delete a YouTube channel, remove published videos or comments, or erase information Google independently retains. Those actions are managed through YouTube. Rights and complaint options available under applicable data-protection law are not limited by this policy. In Hong Kong, information is available from the Office of the Privacy Commissioner for Personal Data.

Video Publisher is intended for adult channel owners and people authorized to act for a business or organization. It is not directed to children. If you believe a child has provided personal information to us, contact us so the matter can be investigated.

Updated policies will appear on this page with a revised date. Material new uses of Google data require appropriate notice and consent before the new use begins. Contact admin@video-publisher.online with any question about this document.