Privacy Policy

1. Information we collect

We collect only what we need to operate VidSum:

Guest (anonymous) accounts.The iPhone and Android apps let you use VidSum without creating an account. To make that work we create an anonymous account on our servers the first time you open the app, identified by a randomly generated identifier and nothing else — no email, no name, no device advertising identifier. Your usage quota, purchases and history attach to that identifier. If you later sign in with Apple, Google or email, the same identifier is kept and your existing data carries over. If you never sign in, we never learn who you are, and deleting the account from Settings erases it exactly as it would an identified one.

• Google account information.When you sign in with Google (via Supabase Auth), we receive your email address, name, profile picture, and Google account identifier (the “sub” claim).
• Apple account information.When you use Sign in with Apple, we receive the identifier Apple issues for your account and an email address. If you choose Apple’s “Hide My Email,” that address is a private relay address rather than your real one, and we never see your real address. Apple provides your name only on the very first authorization, if you allow it. Signing in with Apple authenticates you; it does not grant access to YouTube — to see your subscriptions or search YouTube you separately connect a Google account, as described below.
• YouTube data accessed via the YouTube Data API v3. With the youtube.readonlyscope you grant, we read, on your behalf, your subscriptions, channel uploads, video metadata, captions, comments, and search results — solely to display them inside VidSum and to power summaries, takeaways, transcripts, and chat over the video you choose.
• OAuth tokens. Access and refresh tokens issued by Google for the scopes you approve, stored encrypted at rest so we can call the YouTube API on your behalf while your account is active.
• Product data you create. Saved playlists, generated summaries, takeaways, transcripts, and chat history produced inside VidSum.
• Billing state. Subscription tier, credit balance, and Stripe, App Store or Google Play purchase identifiers. Card numbers are entered directly into Stripe, Apple or Google and are never received or stored by VidSum.
• Operational logs. Standard request logs (IP address, user agent, timestamps, error traces) used to keep the service running, prevent abuse, and debug issues.

2. How we use your information

We use the information above only to provide and improve VidSum’s user-facing features — the summarization product. Specifically:

• Authenticate you and keep you signed in.
• Show your YouTube subscriptions, search results, channel uploads, and video pages inside VidSum.
• Generate AI summaries, takeaways, transcripts, and chat responses from videos you open in VidSum.
• Save playlists and summaries to your account so you can return to them.
• Operate billing and credit accounting via Stripe.
• Monitor reliability, prevent abuse, and improve product quality.

We do not sell your personal information, we do not use your data for third-party advertising, and we do not use information received from Google APIs to build, train, or improve generalized or non-personalized AI or ML models. We do not transfer Google user data to data brokers, information resellers, or any other party that aggregates or sells data, and we do not use it for creditworthiness or lending-eligibility decisions.

3. Limited Use of Google user data

VidSum’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means: we use Google user data only to provide or improve user-facing features that are prominent in VidSum’s interface; we do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users; we do not use Google user data for serving advertisements; and we do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations in compliance with applicable privacy and other laws.

4. Sharing and sub-processors

We do not sell user data and we do not transfer YouTube user data to third parties for any purpose unrelated to VidSum’s user-facing features. We rely on the following sub-processors, each engaged solely to operate VidSum:

• Google LLC— OAuth sign-in and YouTube Data API v3 calls made on your behalf.
• Apple Inc.— Sign in with Apple authentication, and App Store billing for subscriptions and hour packs purchased inside the iPhone app.
• Supabase— managed Postgres database, authentication, and storage hosting your account, OAuth tokens, saved content, and billing state in EU/US regions.
• fal.ai— AI inference provider used to generate summaries, transcripts, and chat responses from video content you open in VidSum.
• Google LLC (Gemini, via fal.ai)— the model that produces your summaries and answers. Transcripts and anything you type into Ask are routed to it through fal.ai.
• Stripe— payment processing and subscription management for purchases made on the web. Card data is entered directly with Stripe and never reaches VidSum servers.
• RevenueCat— receipt validation and entitlement management for App Store and Google Play purchases. Receives your VidSum account identifier and your purchase history. No payment card data is involved.
• Deepgram— speech-to-text, used only when a video has no captions available. Receives the audio of that video; it does not receive your account identity.
• Supadata— caption retrieval service. Receives the identifier of the video you asked us to analyse; it does not receive your account identity.
• Railway— hosting for the media-processing service that supports the captionless-video path described above.
• Vercel— hosting for the VidSum web application and API.

Every sub-processor listed above is engaged under a written agreement that requires them to provide protection for your data that is equal to or better than the protection described in this Privacy Policy, to process it only on our documented instructions and only for the purpose stated, and not to retain it longer than necessary for that purpose.

None of these sub-processors receive YouTube user data for purposes unrelated to providing VidSum to you. We may also disclose information when required by law, valid legal process, or to protect the rights, property, or safety of VidSum, our users, or the public.

5. Data retention

• OAuth tokens are stored only while your VidSum account is active and your Google authorization is valid. They are deleted when you disconnect Google, delete your VidSum account, or revoke access from your Google account.
• Summaries, transcripts, chats, and saved playlists are retained until you delete them or delete your VidSum account.
• Operational logs are retained for a limited period (typically up to 90 days) for reliability and abuse prevention.
• Billing records may be retained as required by tax, accounting, and other legal obligations.

6. How we protect your data

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect your information. These administrative, technical, and physical safeguards are designed to protect the confidentiality, integrity, and availability of all information we hold, including all Google user data we access.

Sensitive data. VidSum requests one sensitive Google OAuth scope, https://www.googleapis.com/auth/youtube.readonly. The sensitive data we therefore hold is your Google OAuth access and refresh tokens, together with the read-only YouTube account data those tokens let us fetch on your behalf — your subscriptions, your playlists and their items, and metadata for the videos you ask VidSum to summarize. Every protection listed below applies to that sensitive data specifically: it is encrypted in transit and at rest, isolated per user at the database level, never sent to any client, never shared with third parties for any purpose unrelated to the features you asked for, and deleted when you disconnect Google or delete your account.

The measures we apply are:

• Encryption in transit. All traffic between your browser or mobile app and VidSum, and between VidSum and every third-party API we call (including Google and YouTube APIs), is encrypted using TLS (HTTPS). We do not accept unencrypted connections.
• Encryption at rest. Our database and file storage are hosted on managed infrastructure (Supabase, on Amazon Web Services) where stored data, backups, and snapshots are encrypted at rest using AES-256.
• Row-level access isolation.Every table holding user data — including Google OAuth tokens, summaries, transcripts, chats, and playlists — is protected by PostgreSQL Row Level Security policies that allow each authenticated user to read and write only their own rows. A signed-in user cannot retrieve another user’s data even by manipulating requests.
• Google credentials stay server-side. Your Google OAuth refresh and access tokens are never sent to the browser, the mobile apps, or the browser extension. They are used only by our server to call the YouTube Data API on your behalf, and are never included in analytics, logs, or error reports.
• Secret management. API keys, service credentials, and signing secrets are stored as encrypted environment variables in our hosting platforms, never in source code, and are scoped so that client-side code cannot read them.
• Access control. Access to production systems and user data is limited to the small number of VidSum personnel who need it to operate and support the service, and is revoked when no longer needed.
• Deletion on revocation. When you disconnect Google, delete your account, or revoke access from your Google account settings, the associated OAuth tokens are deleted from our systems and we stop making API calls on your behalf.
• Vendor diligence. The sub-processors listed in section 4 are established providers that maintain their own recognised security programmes, and we share only the data each one needs to perform its function.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

7. Your rights and controls

You have the right to access, correct, export, and delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email vidsum-support@cloudgeng.com.

You can revoke VidSum’s access to your Google account at any time at https://myaccount.google.com/permissions. Revoking access immediately stops VidSum from making further YouTube API calls on your behalf.

8. Account and data deletion

You can delete your VidSum account and associated data at any time:

• In-app: open Settingsin VidSum and use the “Delete account” option. This permanently removes your profile, OAuth tokens, saved playlists, summaries, transcripts, and chats from our active systems.
• By email: send a deletion request from your account email to vidsum-support@cloudgeng.com and we will action it within a reasonable timeframe.

Backups are rotated on a schedule, so residual copies may persist briefly before being overwritten. Deletion does not affect data we are legally required to retain (for example, billing records).

9. Cookies and tracking

VidSum uses only cookies that are necessary to operate the service: authentication and session cookies set by Supabase Auth, and basic preferences (such as theme). We do not use third-party advertising cookies, ad pixels, cross-site behavioral trackers, or fingerprinting for marketing purposes.

10. Children

VidSum is not directed to children. The service is not intended for users under 13 years of age, or under 16 in the European Economic Area where a higher minimum applies. If you believe a child has provided us with personal information, contact vidsum-support@cloudgeng.com and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, provide additional notice (for example, by email or via an in-app message). Continued use of VidSum after a change becomes effective constitutes acceptance of the updated policy.

12. Contact

For privacy questions, data requests, or concerns about this policy, contact us at vidsum-support@cloudgeng.com.