Privacy policy
draft

1. Who operates ClipPilot

ClipPilot is a private operator tool for the owner of @Trini_Unknown (channel ID UCSkJEz_Z4RoG3hMgLfOtCow). It is not open for public sign-up. Contact the operator about privacy, access or deletion at nacheteytb@gmail.com.

The tool prepares authorized video clips, records editorial and technical checks, and is intended to upload approved video and review native channel analytics. It uses YouTube API Services, whose use is subject to the YouTube Terms of Service. Google's handling of information is described in the Google Privacy Policy.

2. Google permissions and data

The Desktop OAuth flow opens Google's consent page in the system browser. It requests offline access so the local tool can refresh access without a daily sign-in. It requests these three permissions together:

https://www.googleapis.com/auth/youtube.readonly

Read the connected channel's ID, title, statistics and status to confirm the expected channel and inspect its state.

https://www.googleapis.com/auth/youtube.upload

Upload authorized video bytes and metadata such as title, description, tags, category, visibility and any configured publication time. The integrated pipeline currently blocks public, unlisted and scheduled release.

https://www.googleapis.com/auth/yt-analytics.readonly

Retrieve daily channel reports: views, likes, comment and share counts, subscribers gained or lost, and estimated minutes watched. These are native API values with request dates and fetch time.

Google describes youtube.upload as permission to manage your YouTube videos; ClipPilot currently uses it for uploads. The analytics request does not retrieve individual viewer identities or comment text. It does not request monetary analytics, Gmail, contacts or Drive access. These permissions do not prove that the channel is monetized or that an upload succeeded.

3. What is stored and where

Access and refresh tokens and associated OAuth client material are encrypted with current-user Windows DPAPI at %LOCALAPPDATA%\ClipPilot\youtube-grant.dpapi, outside the project repository. The original downloaded Desktop client file must be kept separately in private storage. ClipPilot does not ask for a Google password or extract browser cookies.

Upload journals are also DPAPI encrypted. They contain operation identity, content hashes, metadata, resumable session information and, on completion, the video ID. Pipeline upload journals are kept in the local runtime area; direct module callers choose their journal path.

Local project files and SQLite manifests hold source paths and hashes, rights evidence references, transcripts and context references, edit plans, output video, subtitles, quality receipts, upload reservations and video IDs. Operations records hold task history and evidence; the financial ledger records only supplied invoice, payment or expense facts. These ordinary files and databases are not encrypted by the application.

Channel and analytics commands return JSON, which can be retained in local evidence files or agent transcripts. There is no automatic historical analytics database in the YouTube module.

4. Processing and sharing

The media module uses local FFmpeg and a locally cached speech model for transcription and rendering. Google receives OAuth requests and API calls, including approved video and metadata when an upload is authorized.

ClipPilot is operated through Orca and owner-selected AI agents or services. Prompts, source excerpts, transcripts, metadata, analytics or other evidence included in agent context may be processed by the configured external provider. Not all processing stays on this PC. The provider, account settings and material supplied must be reviewed before Google user data is included. Provider retention and model-training settings have not been verified; this draft makes no claim that providers retain nothing or never train on submitted data.

No data-sale, advertising-targeting or data-broker integration is implemented. No commercial submission adapter is active. Any future campaign delivery or new provider transfer needs its own disclosed purpose and consent before activation.

These static pages include no application cookies, analytics trackers, embedded players, third-party fonts or scripts. When hosted, the hosting service receives ordinary web requests and may keep access logs; its settings and retention must be reviewed before public release. Following an external link is subject to that site's practices.

5. Stop access and request deletion

1. Pause ClipPilot automation and stop active workers so they cannot continue processing or writing data.
2. Open Google Account third-party access settings, select ClipPilot and remove its access. This revokes Google's permission; it does not erase local files.
3. For local deletion or a privacy question, contact nacheteytb@gmail.com, identify the channel and describe the records concerned. Do not send passwords, tokens or client files.

The owner/operator must currently remove the local protected grant, relevant upload journals, channel/API evidence, manifests, transcripts and media selected for deletion, and review backups and provider-held conversation copies. ClipPilot has no single disconnect-and-delete command or verified end-to-end deletion workflow yet. Removing only the grant does not remove the other records. An uncertain upload must first be reconciled without retrying it under a new journal.

Deleting a local copy does not delete a video from YouTube. Manage published or uploaded videos directly in YouTube Studio; this application does not implement remote video deletion. Provider-held conversation deletion must also be handled in the relevant service.

6. Current retention limits

The implementation has no automatic expiry, API-data refresh schedule, revocation-triggered purge or verified backup purge. It retains local records until the operator removes them. The experiment's end date stops new work but does not delete records. There is no implemented deletion deadline that this draft can promise.

This is an activation blocker: a complete inventory, bounded retention rules and tested revocation/deletion handling are needed before collecting connected-channel data in regular operation. Preserving operational evidence must not become indefinite retention of Google user data.

7. Changes and questions

This draft must be updated and approved before publication or any material change in data use, recipients or account access. Changes to Google-data processing need appropriate notice and consent before the changed use begins. Privacy contact: nacheteytb@gmail.com.

Resumen: herramienta privada, aún en puesta en marcha. Los tokens se cifran en Windows; otros archivos locales no. Orca puede enviar contexto al proveedor de IA elegido. Revocar en Google no borra copias locales. El borrado y la retención completos siguen pendientes y bloquean la activación ordinaria.