Last updated: September 15, 2026
Privacy Policy for TubeFlow
1. Introduction and scope
TubeFlow is an AI video research workspace operated by Coffee Flow Labs. This policy explains how TubeFlow accesses, collects, uses, stores, shares, refreshes, and deletes information when you use tubeflow.ai, app.tubeflow.ai, the TubeFlow Chrome extension, and related services.
TubeFlow uses YouTube API Services. By using YouTube-connected TubeFlow features, you also agree to the YouTube Terms of Service and acknowledge Google's Privacy Policy.
2. TubeFlow surfaces
This policy applies to TubeFlow's web application and Chrome extension, including the Library, Watch workspace, utility panel, playlists, channels, saved resources, groups, labels, notes, Video Feeds, Tools, AI Chat, AI summaries, TubeFlow AI-generated transcripts, chapters, Knowledge Explorer, Comment Insights, Fact Check, Product Research, Learning Plans, and related organization workflows.
3. Information TubeFlow handles
Account information includes your name, email address, profile image, authentication state, subscription, billing entitlement, consent state, preferences, feature assignments, and support or feedback communications.
YouTube API Data may include the authorized account or channel identity, subscriptions, playlists, playlist items, videos, channels, comments, identifiers, titles, descriptions, thumbnails, tags, durations, publishing information, pagination state, and other metadata returned by YouTube API Services.
TubeFlow-created information may include groups, labels, notes, saved-resource organization, feed definitions and results, chats and prompts, tool runs, research projects, learning plans, summaries, AI-generated transcripts, chapters, knowledge items, Fact Check records, settings, and generated outputs.
The Chrome extension may read the URL, title, type, and identifier of open YouTube tabs when needed for tab management or an action you invoke. It stores limited local preferences and recovery locators such as the selected panel tab, appearance, speed dials, and pending workflow identifiers. It does not inject visible content into YouTube pages.
Operational and analytics information may include account identifiers, name and email, device and browser information, page views, feature interactions, search queries, and error and performance telemetry. PostHog session replay is disabled. TubeFlow does not use YouTube API Data for advertising.
4. Authentication and storage
TubeFlow uses AWS Cognito for TubeFlow account authentication. TubeFlow session credentials are maintained using secure browser cookies and related security controls.
YouTube authorization is handled through Google OAuth. For users accessing TubeFlow version 1.40.2 or later, YouTube access and refresh credentials are encrypted and stored on TubeFlow's server. Earlier versions may maintain YouTube authorization using secure browser cookies. Removing browser or extension cookies alone is not treated as a YouTube disconnect.
TubeFlow uses managed PostgreSQL storage, Redis caches and queues, and limited browser or extension storage. Stored YouTube API Data is refreshed or deleted according to applicable YouTube policies and the purpose covered by your active consent.
5. How TubeFlow uses information
Account and service information
We use your account and authentication information to sign you in and maintain account security. We use subscription, billing, and contact information to check entitlements, support checkout and billing, and deliver account, service, and applicable product communications.
Workspace content and AI inputs
We use saved resources, groups, labels, notes, and organization context to maintain your TubeFlow workspace. When you request an AI feature, we process the relevant prompt, selected resources and context, video inputs, metadata, transcripts, and feature options to generate summaries, AI-generated transcripts, chapters, knowledge items, comment analysis, fact checks, research reports, learning plans, recommendations, and chat answers. Section 6 explains which inputs are sent to Gemini and how generated results are displayed and stored.
Operational information
We use account and request identifiers, feature interactions, search queries, and error and performance telemetry to operate, troubleshoot, protect, measure, and improve TubeFlow. Section 6 explains analytics and diagnostic processing by PostHog and Axiom. TubeFlow does not use YouTube API Data for advertising.
6. External sharing and service providers
When you invoke a Gemini-powered feature, TubeFlow may send Google the minimum information reasonably needed for that request. Depending on the feature, this may include a YouTube URL or video input, public or authorized video metadata, comments selected for analysis, a TubeFlow AI-generated transcript, your prompt, selected notes or resources, saved organization context, and feature options. Gemini processes these inputs and returns generated text or structured results that TubeFlow displays and may store as part of the requested workflow.
When you request a transcript or another feature that requires one, TubeFlow may send the eligible public YouTube video URL or video input to Gemini to generate timestamped text. The result is a TubeFlow AI-generated transcript, not YouTube captions or an official transcript, and it may contain errors. TubeFlow may securely reuse an existing generated transcript when another user requests the same eligible public video.
The provider subsections below explain which external providers receive or process information for TubeFlow, the information involved, and when this happens. Providers receive information as needed for the stated service or as otherwise disclosed and permitted. Information may be processed in countries where those providers operate. Google and YouTube information remains subject to the Limited Use restrictions below.
Railway
Information processed: Account and workspace records, YouTube-related data, AI request inputs and results, authentication credentials handled by the backend, cached data, queued jobs, and operational logs.
Purpose and controls: Hosts TubeFlow's API, AI processing and background services, PostgreSQL database, and Redis caches and queues. Information is processed as you use TubeFlow and as background jobs maintain the service. Use the account, disconnect, and deletion controls described below to manage stored information.
Vercel
Information processed: Requests to the TubeFlow website and web frontend, including requested URLs, IP addresses, browser information, and associated technical request information.
Purpose and controls: Hosts and delivers the website and web frontend when you visit them. This website delivery is separate from the backend processing and database storage hosted on Railway.
Amazon Web Services Cognito
Information processed: Account identity and authentication information, including email, basic profile information, and authentication/session credentials.
Purpose and controls: Authenticates your TubeFlow account when you sign up, sign in, or maintain a session. TubeFlow account authentication is separate from your authorization to access YouTube data.
Google / YouTube
Information processed: Google authorization information, API request parameters such as searches and resource identifiers, and the content of YouTube actions you request. Embedded playback also involves browser/device information, IP addresses, and cookies or similar technologies handled by YouTube.
Purpose and controls: Connects your YouTube account, retrieves YouTube resources, and performs actions you explicitly request. YouTube serves embedded video content and may serve advertisements through its player. You can revoke account access through Google Security Settings or TubeFlow's disconnect controls; playback is separate from Gemini processing.
Google Gemini
Information processed: The prompt and feature options, selected notes/resources, organization context, video URLs or inputs, relevant metadata, transcripts, and comments needed for the requested AI feature.
Purpose and controls: Processes inputs to generate the AI result you request, which TubeFlow displays and may store. This includes transcript preparation needed by another AI feature. If you do not use an AI-powered feature, TubeFlow does not send related request data to Gemini for that feature.
PostHog
Information processed: Account identifiers, name and email associated with login identification, login times, page views, feature and billing events, and device/browser and error information. Events can be associated with your account; they are not necessarily anonymous.
Purpose and controls: Measures use, diagnoses errors, and helps improve TubeFlow as you visit the website or use the application. Browser analytics can use cookies or similar storage. PostHog session replay is disabled. Contact support@tubeflow.ai with privacy or deletion requests.
Axiom
Information processed: User and request identifiers, API endpoints and methods, search queries and selected parameters (such as search type, duration filters, account-owned request flags, and batch sizes), quota information, timestamps, response timing/status, and error details.
Purpose and controls: Receives operational telemetry when TubeFlow makes YouTube API requests, to diagnose failures and monitor performance and API usage. Telemetry may relate to your account and searches. Contact support@tubeflow.ai with privacy or deletion requests.
Paddle
Information processed: TubeFlow sends customer name/email and information needed to check subscriptions or create checkout. Payment and billing details entered in Paddle checkout are collected directly by Paddle. Paddle returns customer, transaction, and subscription records to TubeFlow for billing and account entitlements.
Purpose and controls: Checks your account's subscription status and handles purchases, renewals, and billing. Customer records may be created or looked up during subscription checks, as well as during checkout. Use available account billing controls to manage your subscription.
Resend
Information processed: Recipient names and email addresses, email subject and content, contact/communication preferences, message identifiers and tags, and delivery or failure information.
Purpose and controls: Delivers account and service emails and applicable product communications, and maintains relevant contact records when you sign up or interact with TubeFlow. Use unsubscribe or preference controls where provided for optional communications; account and service messages may still be necessary.
6a. Internal access
Within Coffee Flow Labs, human access to production user information is limited to TubeFlow's founder/operator. This includes access through the database, operational logs, analytics, billing, and support tools as needed for account administration, billing, responding to support requests, investigating security issues, and troubleshooting the service.
This administrative access does not give unrestricted permission to read Google or YouTube user information. Human access to that information is limited to circumstances allowed by the Google API Services User Data Policy: your affirmative agreement to view specific information for support, security investigations, compliance with applicable law, or internal operations using only aggregated, anonymized data as permitted by that policy. Routine administration or product improvement does not by itself authorize reading your private YouTube information.
7. Google API Limited Use
TubeFlow's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
TubeFlow limits use of Google user data to providing or improving user-facing features that are prominent in TubeFlow, security purposes, compliance with applicable law, and other uses permitted by the Limited Use requirements. TubeFlow does not sell Google user data or use it for personalized advertising. Human access is limited to circumstances permitted by the Google API Services User Data Policy, such as your affirmative agreement for support, security investigation, legal compliance, or appropriately aggregated internal operations.
8. Retention, refresh, and deletion
TubeFlow retains information only for the period needed for the disclosed purpose, applicable legal obligations, security, billing, and the retention rules governing YouTube API Data. Cached API Data is refreshed or deleted within the applicable YouTube policy period.
Disconnect YouTube immediately fences future YouTube API access across TubeFlow web, the extension, and every device. TubeFlow then programmatically revokes the Google authorization and deletes the private authorized-data set as soon as possible and no later than seven calendar days.
If authorization is revoked through Google's security settings, TubeFlow periodically detects that the grant is no longer verifiable, fences access, and deletes related API Data as soon as possible and no later than 30 calendar days after authorization can no longer be verified.
Delete My Content removes your private TubeFlow workspace content and disconnects integrations while retaining the TubeFlow account, billing-safe records, consent history, and sanitized compliance evidence. Full account deletion additionally removes the remaining account information subject to legal and billing requirements.
Disconnecting TubeFlow or deleting TubeFlow-stored data does not delete videos, playlists, comments, or other content stored by YouTube. Manage or delete content held by YouTube through YouTube or another authorized client.
9. Your controls
- Review or revoke Google access through Google Security Settings.
- Use Disconnect YouTube in TubeFlow to revoke authorization and start private API-data cleanup.
- Use Delete My Content to remove private TubeFlow workspace content while preserving your account.
- Contact support@tubeflow.ai for access, export, deletion, privacy, or full-account requests.
10. Policy changes and consent
For users accessing TubeFlow version 1.40.2 or later, TubeFlow provides in-product notice and requires renewed consent when changes materially affect how Google or YouTube data is used. We may also provide notice by email.
11. Contact
For privacy questions or requests, contact support@tubeflow.ai. TubeFlow is a product of Coffee Flow Labs.