PRIVACY POLICY

Last updated 2026.04.25

Summary

We collect the minimum we need to run the service: your Google account name and email, the channels you follow, billing data via Stripe, and basic site analytics. We don't sell personal data. You can export or delete your data at any time via the contact form.

1. Who we are

TubeBite is the controller for personal data we process about users of tubebite.cc. Reach us via the contact form.

2. What we collect

  • Account data — name, email, profile picture URL, Google subject id (from Google OAuth at sign-in).
  • Service data — the channels you follow, your email-frequency preferences, the bites we've sent you, and admin-only flags.
  • Billing data — if you subscribe, Stripe collects card and address details on its side; we receive a Stripe customer id, plan, status, and invoice metadata. We never see your card number.
  • Operational data — server logs (IP address, user-agent, request path), session cookies, and basic Google Analytics page-view data.
  • Email engagement — bounces and complaints reported by our email provider so we can stop emailing addresses that reject mail.

3. Why we use it (lawful bases)

  • To provide the service — performing the contract you have with us when you sign up or subscribe.
  • To bill you — performing the contract and complying with tax/accounting law.
  • To send transactional and digest emails — performing the contract; you can change frequency or unsubscribe at any time.
  • To keep the service secure and debug it — our legitimate interest in running a working, abuse-free service.
  • Analytics — our legitimate interest in understanding aggregate usage. EU visitors can block analytics with a browser-level setting; we currently rely on Google Analytics' standard configuration and do not display a separate cookie banner. (If you'd prefer we add one, let us know via the contact form.)

4. Who processes your data

We use the following sub-processors. Each is bound by their own DPA with us:

  • Google — OAuth sign-in and YouTube Data API.
  • Stripe — payments, billing portal, invoicing.
  • OpenAI — runs the model that produces the AI summaries. Video captions and limited prompt context are sent to OpenAI; we do not send your name, email, or billing data to OpenAI.
  • Cloudflare — CDN, DNS, and traffic protection in front of the application.
  • Amazon Web Services — image storage and outbound email.

The application itself runs on infrastructure we operate directly from the USA. Some sub-processors are based outside the EU; where data is transferred internationally we rely on the relevant Standard Contractual Clauses (SCCs).

5. Cookies

We set a session cookie so you stay signed in and a CSRF-protection cookie. Google Analytics sets its own cookies for page-view measurement.

6. How long we keep it

  • Account and channel data: while your account exists. Deleted on request, typically within 30 days.
  • Billing records: 7 years (US tax and accounting requirements).
  • Server logs: up to 90 days.
  • AI summaries themselves are public artefacts on the site; deleting your account does not retract previously-published summaries (which are not personal data — they're about the videos, not you).

7. Your rights

Regardless of where you live, you can ask us to:

  • Access a copy of your data.
  • Correct inaccurate data.
  • Erase your data — subject to legal retention.
  • Restrict or object to processing.
  • Receive your data in a portable format.
  • Withdraw consent (where we relied on consent).

If you're in the EU, GDPR gives you these rights directly and you can lodge a complaint with your local data protection authority. If you're in California or another US state with a privacy law, the equivalent rights under that law apply.

To exercise any of these rights, send a message via the contact form using the email address attached to your account.

8. Security

Connections are TLS-only. Passwords aren't stored — we delegate authentication to Google. We don't store card details — Stripe handles payment data. Internal access to production data is limited to the operator on a need-to-debug basis.

9. Children

TubeBite is not directed at children under 16. We do not knowingly collect personal data from children; if you believe a child has signed up, contact us and we'll delete the account.

10. Changes

If we materially change this policy we'll notify active accounts by email. The "last updated" date at the top will always show the current version.