Legal
Privacy Policy
1. Introduction
We develop and operate TubeDetox (the “App”). By using the App, you agree to this policy.
2. Information we collect
2.1 User information
When you sign in with Google, we obtain Google profile information such as email address and name. For ad delivery (AdMob), Google may also collect information such as advertising identifiers.
2.2 Contact / feedback
- Sender email address and name
- Message content
2.3 Web app
When you sign in to the web app (/app) with Google, you grant access to your YouTube account (viewing and managing playlists and subscriptions). The credential used to keep you signed in is encrypted and stored only in a cookie in your browser; it is never stored on our servers or in a database. Playlists, subscriptions and other YouTube data are fetched directly from the YouTube Data API by your browser and are not collected or stored by us. Signing out deletes the credential and revokes the access granted to Google.
If you purchase the lifetime plan on the web, your Google account identifier and email address are sent to our payment processor, Stripe, Inc., to link the purchase to your account. Payments are processed by Stripe, and we never receive or store your card details. Playback positions used by the resume feature are stored only on your device or browser.
The web app uses Google AdSense, a third-party advertising service. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalized advertising in Google Ads Settings. For details, see how Google uses information in advertising. Ads are not shown to lifetime plan users.
2.4 Use of YouTube API Services
The App (iOS and web) uses YouTube API Services. By using the App, you agree to be bound by the YouTube Terms of Service. Please also refer to the Google Privacy Policy for how information is handled through YouTube API Services.
YouTube data accessed by the App (playlists, subscriptions and video information) is used only to display and play content and to manage your playlists and subscriptions within the App. It is never used for advertising, sold, or shared with third parties. You can revoke the App's access at any time via the Google security settings page.
2.5 Data protection
We protect Google user data, including OAuth tokens and YouTube data, with the following measures:
- Encryption in transit: all communication between the App, our website, Google and YouTube uses HTTPS (TLS). Unencrypted connections are not accepted.
- Encryption at rest (web): the refresh token is encrypted with AES-256-GCM before it is stored in a cookie in your browser. The cookie is set with the HttpOnly, Secure and SameSite=Lax attributes, so it cannot be read by JavaScript and is sent only over HTTPS. The encryption key is stored as a secret on the server and is never sent to the browser.
- Short-lived access tokens: access tokens used to call the YouTube Data API expire after about one hour. On the web they are kept only in the memory of the open browser tab.
- Secure storage (iOS): sign-in credentials are managed by the Google Sign-In SDK and stored in the iOS Keychain. Cached data stays inside the App's sandbox on your device.
- No server-side storage: we do not operate a database for user data. Tokens are processed on our server only momentarily to obtain new access tokens and are never logged or stored. YouTube data is never sent to or stored on our servers.
- Access control: server secrets (OAuth client secret and encryption key) are accessible only to the developer and are managed as encrypted environment variables on our hosting provider (Vercel).
- Deletion: signing out revokes the token with Google and deletes the cookie (web), or removes the credentials from the App (iOS). You can also revoke access at any time from your Google Account.
- Incident response: if we become aware of a security incident affecting user data, we will promptly take steps to contain it and notify affected users.
TubeDetox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train AI/ML models.
3. Purpose of use
We use contact information to reply to inquiries and to improve the quality of the App.
4. Management of personal information
We keep personal information accurate and up to date, and take security measures to prevent unauthorized access, loss, damage, alteration, or leakage.
5. Disclosure to third parties
We do not disclose personal information to third parties except when:
- You have consented
- Disclosure is required by law
6. Compliance and review
We comply with applicable Japanese laws and other norms, and review this policy as needed.
7. Disclaimer
We do not warrant that the App meets any particular purpose, expected features, commercial value, accuracy, or usefulness, or that it will be free of defects.
We may change the App’s specifications. We are not liable for any damages arising from discontinuation, changes, unavailability, data loss, device failure or damage, or other matters related to the App.
8. Copyright and intellectual property
All rights belong to us or to third parties who hold the rights.
9. Account and data deletion
TubeDetox signs in with Google (OAuth). The App does not create its own accounts.
Deleting in-app data
- Open TubeDetox
- Settings → Log out
- Uninstalling the App also removes cached data stored on the device
Revoking Google access
- Open your Google Account settings
- Security → Third-party access
- Remove TubeDetox access
Deleted: on-device cache (subscribed channels, video lists, etc.) and app settings.
Retained: data stored by YouTube / Google under their policies.