1. Information We Collect

Account data: When you register, we collect your email address and display name. Passwords are hashed using PBKDF2-SHA256 with per-user salts and are never stored in plaintext.

Usage data: We track transcript and clip usage counts per account to enforce plan limits. Saved transcripts, extraction jobs, and clips include the video details needed to provide those features.

IP addresses: We store the IP address of requests to the Service, with or without an account, together with a one-way network identifier. We use them for security and abuse prevention. They are visible only to our administrators.

Payment data: Payment processing is handled entirely by Stripe. We store your Stripe customer ID, subscription ID, and confirmed invoice amounts and currencies, but never see or store your credit card details.

Discovery analytics: We record referral hostnames, public landing paths, supported campaign tags, and a browser-tab session identifier. We do not collect referral URL queries. First-touch information is kept in your browser for up to 30 days and can be associated with your account when you sign in. We keep application activity logs, product analytics, referral session records, and payment-event records without automatic age-based deletion so we can investigate issues and measure historical performance. Account attribution and optional discovery answers remain with your account. You can edit or remove your optional answer on the dashboard. Records of payments not yet linked to an account are also retained. Account and data deletion requests are handled separately as described below. These signals help us measure discovery, activation, and confirmed payments.

2. How We Use Your Information

We use your information to: (a) provide and maintain the Service; (b) enforce plan limits; (c) process payments; (d) send critical service communications (billing issues, security alerts); (e) respond to support requests; (f) understand how people discover and use ChannelScout. We do not sell your data or use it for advertising.

3. Data Storage & Security

Your data is stored on Cloudflare's global network (D1 database, R2 storage). Transcripts and clips you create are associated with your account and not visible to other users. All data is transmitted over HTTPS. Authentication uses JWT tokens stored in your browser's localStorage.

4. Data Retention

Transcripts in your Library are retained as long as your account is active. Clips are retained per your plan's retention policy (7-90 days, or permanent for Studio). Account data is retained until you request deletion. We will delete your account within 30 days of request.

New uploaded audio and video originals are temporary. By default, they are scheduled for deletion 24 hours after successful transcription. If you choose to keep an original for clipping, it is scheduled for deletion 7 days after successful transcription. Active transcription and clip processing are protected. You can see the expiration and delete the original sooner in its upload result or saved transcript. Deleting an original does not delete your saved transcript or completed clips; creating new clips afterward requires another upload. Older uploads without an expiration date are labeled separately. Unfinished file uploads expire after 24 hours. Paused or failed transcription originals have a 7-day recovery period; the job shows its deletion deadline. Active transcription and clip processing postpone deletion.

Deleting your account removes your account, your Library (saved transcripts and their AI summaries), clips and their stored files, uploads, favorites, followed channels, extraction jobs, and discovery answer. Transcripts of public YouTube videos may be retained in our transcript database without any link to your account; this applies when you save them, remove them from your Library, or delete your account. Transcripts of your uploads and imported files are never added to it. Some operational and security history is kept: activity, usage, analytics, and channel monitoring records stay under a deleted-account number without your email or IP address, using a one-way network identifier, timestamps and actions, for security, diagnostics and traffic analysis; records of actions our administrators took on your account keep the identifiers recorded at the time, including your email; a deletion record with a one-way hash of your email is kept; and Stripe keeps its own billing records. To ask about deleting retained records, contact us. Those requests are handled separately from account deletion.

5. Third-Party Services

We use: (a) Cloudflare for hosting, CDN, and data storage; (b) Stripe for payment processing; (c) YouTube for transcript and video data (governed by YouTube's Terms of Service and Google's Privacy Policy); (d) Anthropic (Claude) for AI summaries: when you request an AI summary, the transcript text and the video or channel title are sent to Anthropic to generate it. We use Cloudflare Web Analytics(privacy-friendly, no cookies, no cross-site tracking) to understand aggregate page traffic. We do not use advertising networks or social media pixels.

6. Cookies & Local Storage

We use localStorage (not cookies) to store your authentication token for session persistence. We do not use tracking cookies. Cloudflare may set functional cookies for security and performance (e.g., bot detection).

7. Your Rights

You have the right to: (a) access your personal data; (b) correct inaccurate data; (c) request deletion of your account and data; (d) export your transcripts and clips; (e) withdraw consent at any time by closing your account. To exercise these rights,contact us.

8. GDPR & CCPA

For EU residents (GDPR): Our legal basis for processing is contractual necessity (providing the Service) and legitimate interest (security, fraud prevention). For California residents (CCPA): We do not sell personal information. You may request disclosure of the categories and specific pieces of personal information we hold about you.

9. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children. If we learn we have collected data from a child under 13, we will delete it promptly.

10. Contact

For privacy-related inquiries, use our contact form. Data Protection Officer: Navecta LLC, United States.