Privacy policy

Last updated: 16 August 2026

1. Controller

The controller for the processing of personal data is:

2. What this is about

TubeCompass is an analytics tool for YouTube channels. So that it can show the numbers of your channels, you connect your Google account. We then retrieve data from the YouTube interfaces on your behalf and store it, so that developments over time become visible.

We only process data about channels for which you have granted us access yourself, plus publicly available data about channels that you add for watching.

3. Which permissions we request, and what for

When you connect a channel, Google asks for your consent to the following permissions. Each one is needed for a specific purpose:

youtube.readonly

Reads which channels and videos belong to your account: title, thumbnail, duration, publication date and the public counter. Without this permission the tool would not know which videos to analyse.

yt-analytics.readonly

Reads your analytics numbers: views, watch time, audience retention, impressions, click-through rate, traffic sources, countries, devices, age and gender groups of your audience, as well as subscribers gained and lost. This is the actual content of the tool.

yt-analytics-monetary.readonly

Reads your channel’s settlement figures, that is actual revenue rather than estimates. If you do not accept this permission, everything else works unchanged; the revenue figures then stay empty.

youtube.force-ssl

Grants write access. We use it exclusively for a single action: publishing a reply to a comment under your video after you have written it and explicitly confirmed it in the tool. Nothing is published automatically, nothing is deleted and nothing about your videos is changed.

4. Which data we store

The following is held in a database on our server:

• Access data: your e-mail address and a password hash for the account with us, plus an encrypted Google refresh token per connected channel. The token is not stored in plain text.
• Channel and video details: channel name, channel image, subscriber count, video titles, thumbnails, durations, publication times.
• Analytics numbers per day and video: the metrics listed under point 3, stored permanently so that developments over months remain visible.
• Public counters: hourly and minute-by-minute snapshots of the view, like and comment counter as it stands publicly under every video.
• Operational data: logs of the retrieval runs, error messages and the consumption of the API quota.

Comments are not stored. They are fetched live from YouTube when you open the comment view and are only displayed.

5. Legal basis

Processing takes place in order to perform the user relationship pursuant to Art. 6 (1) (b) GDPR. Connecting your Google account is additionally based on your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw at any time (see point 8).

6. Use of data from Google (Limited Use)

TubeCompass’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In concrete terms this means:

• The data is used exclusively to provide you with the features of TubeCompass.
• The data is not sold, not passed on to third parties, not used for advertising and not used to train AI models.
• Humans do not read this data, unless you explicitly ask for help with a problem, it is necessary for security reasons or it is required by law.

7. YouTube terms

TubeCompass uses the YouTube API Services. By using TubeCompass you agree to the YouTube Terms of Service. The Google Privacy Policy also applies.

8. Revoking access and deleting data

You can withdraw TubeCompass’s access to your Google account at any time, independently of us, through the security settings of your Google account. After that we no longer retrieve any new data.

If you disconnect a channel in the tool itself, we delete the stored token immediately. On request we delete all data stored about you; an informal message to info@codepa.de is enough. Deletion happens within 30 days.

9. Retention period

Analytics numbers remain stored for as long as your account exists. Their whole purpose is the long-running history. Operational logs are deleted after 90 days. After your account is deleted, all associated data is removed.

10. Hosting and processing on our behalf

The application and the database run on a rented server from The Constant Company, LLC (Vultr) in a data centre in Frankfurt am Main, Germany. For managing user accounts we use Appwrite. Data processing agreements pursuant to Art. 28 GDPR are in place with the service providers we use.

When the website is accessed, technical access data is processed on the server side (IP address, time, address requested, browser identification). It serves the operation of the service and the defence against attacks and is deleted after seven days.

11. Cookies and audience measurement

This website sets no cookies and embeds no analytics or advertising services. In the tool itself, a technically necessary cookie is set for your sign-in, plus a cookie that remembers your language setting. Neither requires consent, because without these cookies signing in would not work.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). A message to info@codepa.de is enough.

You can also lodge a complaint with a supervisory authority. The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.

13. Changes

If the scope of processing changes, we update this policy and adjust the date given above. In the case of material changes we will also inform you in the tool.