Privacy Policy for TubeFlow

1. Introduction and scope

TubeFlow is an AI video research workspace operated by Coffee Flow Labs. This policy explains how TubeFlow accesses, collects, uses, stores, shares, refreshes, and deletes information when you use tubeflow.ai, app.tubeflow.ai, the TubeFlow Chrome extension, and related services.

TubeFlow uses YouTube API Services. By using YouTube-connected TubeFlow features, you also agree to the YouTube Terms of Service and acknowledge Google's Privacy Policy.

2. TubeFlow surfaces

This policy applies to TubeFlow's web application and Chrome extension, including the Library, Watch workspace, utility panel, playlists, channels, saved resources, groups, labels, notes, Video Feeds, Tools, AI Chat, AI summaries, TubeFlow AI-generated transcripts, chapters, Knowledge Explorer, Comment Insights, Fact Check, Product Research, Learning Plans, and related organization workflows.

3. Information TubeFlow handles

Account information includes your name, email address, profile image, authentication state, subscription, billing entitlement, consent state, preferences, feature assignments, and support or feedback communications.

YouTube API Data may include the authorized account or channel identity, subscriptions, playlists, playlist items, videos, channels, comments, identifiers, titles, descriptions, thumbnails, tags, durations, publishing information, pagination state, and other metadata returned by YouTube API Services.

TubeFlow-created information may include groups, labels, notes, saved-resource organization, feed definitions and results, chats and prompts, tool runs, research projects, learning plans, summaries, AI-generated transcripts, chapters, knowledge items, Fact Check records, settings, and generated outputs.

The Chrome extension may read the URL, title, type, and identifier of open YouTube tabs when needed for tab management or an action you invoke. It stores limited local preferences and recovery locators such as the selected panel tab, appearance, speed dials, and pending workflow identifiers. It does not inject visible content into YouTube pages.

Operational and analytics information may include device and browser information, feature interactions, error and performance telemetry, and session replay where enabled. TubeFlow does not use YouTube API Data for advertising.

4. Authentication and storage

TubeFlow uses AWS Cognito for TubeFlow account authentication. TubeFlow session credentials are maintained using secure browser cookies and related security controls.

YouTube authorization is handled through Google OAuth. For users accessing TubeFlow version 1.40.2 or later, YouTube access and refresh credentials are encrypted and stored on TubeFlow's server. Earlier versions may maintain YouTube authorization using secure browser cookies. Removing browser or extension cookies alone is not treated as a YouTube disconnect.

TubeFlow uses managed PostgreSQL storage, Redis caches and queues, and limited browser or extension storage. Stored YouTube API Data is refreshed or deleted according to applicable YouTube policies and the purpose covered by your active consent.

5. How TubeFlow uses information

• Authenticate your TubeFlow account and maintain security.
• Display and organize playlists, channels, videos, saved resources, groups, labels, notes, feeds, and Watch context.
• Perform actions you explicitly request on your connected YouTube account, such as organizing playlists or playlist items.
• Generate summaries, AI-generated transcripts, chapters, knowledge items, comment analysis, fact checks, research reports, learning plans, recommendations, and chat answers.
• Operate, troubleshoot, protect, measure, and improve TubeFlow without using YouTube API Data for advertising.

6. Gemini and other service providers

When you invoke a Gemini-powered feature, TubeFlow may send Google the minimum information reasonably needed for that request. Depending on the feature, this may include a YouTube URL or video input, public or authorized video metadata, a TubeFlow AI-generated transcript, your prompt, selected notes or resources, saved organization context, and feature options. Gemini returns generated text or structured results that TubeFlow may store as part of the requested workflow.

When you request a transcript or another feature that requires one, TubeFlow may send the eligible public YouTube video URL or video input to Gemini to generate timestamped text. The result is a TubeFlow AI-generated transcript, not YouTube captions or an official transcript, and it may contain errors. TubeFlow may securely reuse an existing generated transcript when another user requests the same eligible public video.

TubeFlow also uses service providers for hosting and storage, authentication, analytics, billing, email delivery, and optional Notion export. These currently include Railway, Amazon Web Services Cognito, Google Gemini, PostHog, TubeFlow's billing provider, TubeFlow's email provider, and Notion when you connect it. Providers receive information only as needed to perform their service or where otherwise disclosed and permitted. Information may be processed in countries where those providers operate.

7. Google API Limited Use

TubeFlow's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TubeFlow limits use of Google user data to providing or improving user-facing features that are prominent in TubeFlow, security purposes, compliance with applicable law, and other uses permitted by the Limited Use requirements. TubeFlow does not sell Google user data or use it for personalized advertising. Human access is limited to circumstances permitted by the Google API Services User Data Policy, such as your affirmative agreement for support, security investigation, legal compliance, or appropriately aggregated internal operations.

8. Retention, refresh, and deletion

TubeFlow retains information only for the period needed for the disclosed purpose, applicable legal obligations, security, billing, and the retention rules governing YouTube API Data. Cached API Data is refreshed or deleted within the applicable YouTube policy period.

Disconnect YouTube immediately fences future YouTube API access across TubeFlow web, the extension, and every device. TubeFlow then programmatically revokes the Google authorization and deletes the private authorized-data set as soon as possible and no later than seven calendar days.

If authorization is revoked through Google's security settings, TubeFlow periodically detects that the grant is no longer verifiable, fences access, and deletes related API Data as soon as possible and no later than 30 calendar days after authorization can no longer be verified.

Delete My Content removes your private TubeFlow workspace content and disconnects integrations while retaining the TubeFlow account, billing-safe records, consent history, and sanitized compliance evidence. Full account deletion additionally removes the remaining account information subject to legal and billing requirements.

Disconnecting TubeFlow or deleting TubeFlow-stored data does not delete videos, playlists, comments, or other content stored by YouTube. Manage or delete content held by YouTube through YouTube or another authorized client.

9. Your controls

• Review or revoke Google access through Google Security Settings.
• Use Disconnect YouTube in TubeFlow to revoke authorization and start private API-data cleanup.
• Use Delete My Content to remove private TubeFlow workspace content while preserving your account.
• Contact support@tubeflow.ai for access, export, deletion, privacy, or full-account requests.

10. Policy changes and consent

For users accessing TubeFlow version 1.40.2 or later, TubeFlow provides in-product notice and requires renewed consent when changes materially affect how Google or YouTube data is used. We may also provide notice by email.

11. Contact

For privacy questions or requests, contact support@tubeflow.ai. TubeFlow is a product of Coffee Flow Labs.