Privacy Policy

We collect only what's needed to operate the service:

• Account data: the email and password you provide at signup. Passwords are stored hashed with Argon2id; the plaintext is never persisted. We retain account data for as long as your account is active.
• Google OAuth profile: when you connect a YouTube channel, we receive your Google email, display name, and avatar URL, plus an OAuth refresh token. The refresh token is stored encrypted at rest with AES-256-GCM; the encryption key lives in our server environment, separate from the database.
• YouTube channel data: for channels you connect, we fetch and cache the following via Google's official YouTube Data API:
  • Channel metadata (title, handle, thumbnail, subscriber/video/view counts)
  • Video metadata (title, description, tags, thumbnail URL, statistics)
  • Video transcripts where available — sourced either from (a) our browser extension reading YouTube's "Show transcript" panel on a page you are actively viewing in your own browser, or (b) the Data API's captions.download endpoint for manual caption tracks on channels you own
  • Top-level comments on videos on your connected channels
  • AI-generated visual descriptions of your video thumbnails (produced by Gemini Vision; stored as text and a 768-dimensional vector embedding for retrieval)
• Watch-page metadata for non-owned videos: when you use our browser extension on a YouTube video that is NOT on one of your connected channels, we fetch only the video's public metadata and public top-level comments via the Data API. We do not fetch, store, or AI-process the transcript of a video you don't own. We cache these responses for up to 24 hours.
• Service usage: per-feature request counts (Vibe Check, AI ideas, Predict SEO, etc.) for plan-limit enforcement, plus extension usage logs recording which page types triggered which features. Without an account, the extension counts only three steps under a random install ID — installed, saw the Video X-ray, tapped a locked card — with no YouTube data, no video IDs and nothing that identifies you; the Video X-ray itself is worked out in your browser from the page you are watching and is not sent to us. Usage data is retained for ~90 days then purged.
• Billing: when you subscribe, you tell us the country you live in (we also note the country of your IP address) so the right sales tax is applied, and Razorpay returns a subscription ID and status events that we store. We do not see or store card numbers, CVV codes, or UPI handles — all payment details are handled by Razorpay directly. Billing records (subscription IDs, payment status events, invoice metadata) are retained for 7 years to comply with applicable tax-record-keeping requirements; this retention applies even after account deletion (see §6).
• Session and device data: server-issued HttpOnly secure cookies for web sessions (7-day inactivity expiry); push notification tokens registered by the mobile app for transactional notifications; API keys you generate (stored as SHA-256 hashes — plaintext is shown to you only once at creation). Two small first-party cookies remember whether you picked the light or dark look (vf_theme) and how you found us (vf_src, below).
• How you found us: when you arrive through a link carrying campaign tags (UTM parameters), a member's invite code or a partner's code (?ref=), or from another website, we keep that source — the tags, the code, the referring site's domain, the page you landed on and when — in a first-party cookie (vf_src, 90 days), and copy it onto your account when you sign up. If you joined through a member's invite link we record which member invited you, so we can credit them; they only ever see totals (how many people joined, connected a channel or subscribed through their link), never who.
• Waitlist: while sign-ups are invite-only you can join a waitlist with your email address and, optionally, your YouTube channel. We keep them with how you found us (above), and use them only to send your invite. If you sign up, the entry is deleted with your account; if you don't, email privacy@viewfinch.com and we'll delete it.

• We do not run advertising trackers or session-replay tools. We use a privacy-friendly analytics provider (Umami) that does not set cookies and IP-truncates by design — see §4.
• We do not collect IP addresses persistently. IPs appear only in transient rate-limit counters held in Redis for seconds to minutes and in our application logs (auto-rotated within 7 days).
• We do not store your YouTube account password. Google's OAuth flow never reveals it to us.
• We do not access videos, channels, or comments outside what is documented in §1. For non-owned videos, we use only the public Data API surfaces; we never fetch or store transcripts of videos you do not own.
• We do not sell your data, share it for advertising, or use it to train AI models of our own or our sub-processors. Where prompts are sent to AI sub-processors (§4), we have selected providers whose published terms confirm they do not train on customer prompts on the tiers we use.

Our lawful basis for processing personal data is performance of the contract between you and Viewfinch (GDPR Article 6(1)(b); analogous bases under UK GDPR, the India DPDP Act 2023, and the California CCPA). For payment processing and tax record retention we rely on legal obligation (Article 6(1)(c)). We do not rely on consent for core service features; if you do not want your data processed for these purposes, the correct action is to not create an account or to delete an existing one (see §5).

Specifically, we use your data:

• To provide the analyses, AI suggestions, and scheduling features the product describes.
• To enforce plan limits and prevent abuse.
• To send transactional emails (verification, password reset, billing receipts). We do not send marketing email by default; we will ask separately if we ever introduce optional marketing email.
• To meet our legal obligations (tax recordkeeping, lawful requests from competent authorities).
• To learn which invitations, partners and campaigns bring people who find Viewfinch useful, to credit the members who invited them, and to apply invite and launch discounts. For this we rely on our legitimate interest in knowing which of our outreach works (Article 6(1)(f)); it is limited to the source described in §1, not your browsing, and is never shared with advertisers. Holding a waitlist entry is a step taken at your request before an account exists (Article 6(1)(b)).

We do not sell your data. We do not share it for advertising. We share it only with the sub-processors listed in §4, and only as needed to deliver the service.

We rely on the following sub-processors to deliver the Service. A live, machine-readable list is maintained at /legal/subprocessors.json and any material change is announced via email at least 30 days before it takes effect.

Infrastructure

• Hostinger, UAB — the virtual private server, located in India, that runs the application and its database.

YouTube + Google services

• Google LLC — YouTube Data API v3 — sanctioned access to channel/video/comment data on channels you connect. Subject to Google's own privacy policy.
• Google LLC — Generative AI (Gemini) — when you trigger AI features, we send prompts (≤8 KB per request) containing your video title, description, transcript snippets, top comments, and (for vision features) thumbnail bytes. On the API tier we use, Gemini does not train on prompts. Outputs are cached server-side; prompts themselves are not stored.

AI text-generation cascade (fallback order when a higher tier is unavailable)

• Groq Inc. (US) — same prompt content as Gemini; Tier 1 of our cascade.
• Cerebras Systems Inc. (US) — Tier 2 fallback. Same prompt content.
• Together AI / Together Computer Inc. (US) — text prompts only, used for thumbnail-image generation (Flux Schnell model).

Billing

• Razorpay Software Pvt. Ltd. (India) — payment processing. Receives your email, name, plan identifier, and the payment-instrument tokens you provide directly to Razorpay's checkout. We do not see card numbers.

Email

• Postmark — transactional email delivery (verification, password reset, billing receipts). The provider sees the destination email address and message body.

Analytics + error tracking

• Umami Software Inc. — cloud.umami.is (EU) — privacy-friendly page-view analytics. Cookieless and IP-truncated by design. Sees URLs of pages you visit and basic browser-fingerprint information (user agent, screen size). Does not track across sites.
• Functional Software Inc. (Sentry) — error tracking. Sees stack traces, request URLs, browser user agent, and your user ID (a UUID; no name or email). Only fires on errors; no personal data is sent during normal operation.

We support the data-subject rights granted by GDPR, UK GDPR, the India DPDP Act 2023, and the California CCPA / CPRA:

• Access + Portability: export every row of data tied to your account at any time via Settings → Export my data. The export is a JSON file containing 20 tables; secret fields (password hashes, encrypted OAuth tokens, API key hashes) are excluded.
• Deletion / Erasure: delete your account and all associated data from Settings → Delete account. Cascades through every table; cannot be undone. Exception: billing records (subscription IDs, payment status events, invoice metadata) are retained for 7 years to comply with tax-record obligations — see §6.
• Correction / Rectification: profile fields can be edited in Settings. To correct other data, contact privacy@viewfinch.com and we will action it within 30 days.
• Object / Restrict: because our lawful basis is contract performance, the practical way to object to processing is to delete the account (above). We do not currently process any data on a legitimate-interest basis that would allow narrower objection.
• Disconnect a channel: Settings → Channels → Disconnect immediately wipes that channel's videos, transcripts, comments, and visual descriptions from our database.
• Complaint: you have the right to lodge a complaint with a supervisory authority. In the EU, your local Data Protection Authority; in the UK, the ICO; in India, the Data Protection Board (once constituted). Contact details at the relevant authority's website.
• For California residents: the rights above mirror your CCPA "right to know," "right to delete," and "right to correct." You have the right to opt out of any sale or sharing of personal information — we do not sell or share for advertising purposes, so this opt-out is effectively the default.

Account deletion is immediate for everything except billing records (which we are legally required to retain) and the 30-day backup window. After 30 days, deleted data is permanently gone from backups too.

Viewfinch is not directed at children under 13. You must be at least 13 years old to create a Viewfinch account, and our Terms (§3) require accurate age representation at signup.

Important note about content depicting children. Some of the YouTube creators who use Viewfinch publish content that prominently depicts children — parenting reels, family vlogs, traditional-cooking content featuring multiple generations. When you connect such a channel, Viewfinch will process the thumbnails and metadata of those videos for analysis features. Specifically:

• Thumbnail images may be sent to our AI sub-processors (Gemini Vision) to generate visual descriptions. Google's safety classifiers occasionally block these requests automatically when a child is detected; our system handles those refusals gracefully and falls back to a metadata-only analysis path. We do not bypass or work around these classifiers.
• We do not perform face recognition, identification of specific children, or any biometric profiling on this imagery.
• We do not collect personal data ABOUT the children depicted (we have no relationship with them — we process the creator-uploader's content under the creator's account).

If you are concerned about Viewfinch's processing of any specific video that depicts a child you are responsible for, you can: (a) disconnect the channel, which immediately deletes that channel's data from our systems; or (b) contact privacy@viewfinch.com for a targeted deletion request, which we will action within 30 days.

Viewfinch is operated from India. Several of our sub-processors are based outside India (the United States, the European Union, and global cloud infrastructure providers). Where your personal data is transferred to a sub-processor in a third country, we rely on:

• Standard Contractual Clauses with sub-processors where the provider supports them (Google, Razorpay).
• The sub-processor's published data-processing addendum where SCCs are not separately offered (Hostinger, Groq, Cerebras, Together AI, Sentry, Umami).
• Your consent at signup to the cross-border transfers described in §4, as required by the DPDP Act 2023.

If you are a resident of a jurisdiction that requires data localisation, we will route your data accordingly or, if we cannot, decline to onboard you.

We'll update the date at the top of this page when this policy changes. For substantive changes that affect your rights — adding a new sub-processor, broadening data use, or extending retention — we'll send a notification email at least 30 days before the change takes effect.

Privacy enquiries: privacy@viewfinch.com.