Privacy Policy
Effective 19 October 2026
This policy explains what Google and YouTube data 4orxie AI Editor ("the app") accesses, how it is stored and used, and how access can be removed. The app is a personal tool operated by 4orxie. It runs only on 4orxie's own Windows PC and is used only with 4orxie's own YouTube channels (@4orxie and @4orxclipz). There is no app server and no sign-up.
1. YouTube API Services
The app uses YouTube API Services. By connecting a channel you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
2. Google data the app accesses
| Permission | Data and purpose |
|---|---|
youtube.upload | Uploads the creator's own finished videos to the connected channel as private, with a scheduled publish time and their title, description and tags. |
youtube.readonly | Reads the connected channel's ID, name and handle (to make sure the right channel is connected), the status and scheduled time of videos the app uploaded (to confirm scheduling worked), and the titles of recent uploads (to avoid uploading the same video twice). |
yt-analytics.readonly | Reads statistics for the channel's own videos: views, likes, comments, shares, average percentage viewed, minutes watched and subscribers gained. They are used to compare videos and choose posting times. |
The app does not access the Google account password (sign-in happens on Google's own page), Gmail, Google Drive, contacts, the account's email address, or any private data of other people's channels.
3. How sign-in credentials are stored
- Sign-in uses Google OAuth 2.0 for installed apps with PKCE. Google returns a one-time code to the PC itself
(
127.0.0.1), which the app exchanges with Google for tokens. - The long-lived refresh token is encrypted with Windows DPAPI (current-user scope) and saved in the user's local app-data folder on that PC, outside the app's project files. It can only be decrypted by the same Windows user on the same PC.
- Short-lived access tokens are kept in memory only while the app runs.
- Credentials are sent only to Google. They are never written to the app's logs, job files or settings, and the app's log writer removes anything that looks like a token.
- Limitation: DPAPI protects the credentials from other Windows users and other computers. It does not protect them from software running as the same Windows user on that PC, so the PC itself must be kept secure.
4. What is stored, and for how long
The app keeps these records on the creator's PC, as ordinary (unencrypted) local files:
- the connected channels' IDs, names and handles, and a log of when they were connected;
- for videos the app uploaded: the YouTube video ID and link, the scheduled time and the publishing status;
- the video statistics listed in section 2.
They are kept only for tracking the creator's own publishing and performance, in line with the YouTube API Services Developer Policies:
- stored YouTube data is refreshed from YouTube or deleted at least every 30 days; video statistics may be kept longer, but the app's access is re-confirmed at least every 30 days;
- a request to delete stored data is carried out as soon as possible and within 7 days;
- if access is revoked through Google's security settings, the stored credentials and YouTube data are deleted within 30 days.
5. How the data is used and shared
- Google data is used only to publish, schedule and review the creator's own videos as described above.
- It is not sold, not used for advertising, and not shared with data brokers or other third parties, except for the AI assistant described below.
- The app also prepares posts for TikTok and Instagram through Buffer, with videos hosted on Cloudflare R2. Those services receive the creator's own video files and captions only, not data obtained from Google.
- The creator operates the app with the help of an AI assistant, Anthropic's Claude. When the creator directs it, for example to run a publishing check or compare video statistics, data described in section 2 (such as channel names, video IDs, scheduling status and statistics) is processed by Anthropic as part of that conversation, under Anthropic's privacy policy. The app is written so that sign-in tokens are never displayed in that conversation.
The app's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. This website
This website uses no cookies, analytics or trackers, and loads nothing from other sites. The hosting provider may record standard technical request data (such as IP addresses) in its own logs.
7. Removing access
- Revoke the app's access at any time on your Google Account's Third-party apps & services page (also reachable through Google security settings). After that the app can no longer access the channel.
- To delete the data the app has stored, contact us at the address below.
8. Children
The app is not directed at children and is not used to collect information from them.
9. Changes
If this policy changes, the new version will be posted on this page with a new effective date.
10. Contact
4orxie · support@4orx.net