Privacy policy

Last updated: 21 August 2026

1. Controller

The controller for the processing of personal data is:

2. What this is about

TubeCompass is an analytics tool for YouTube channels. So that it can show the numbers of your channels, you connect your Google account. We then retrieve data from the YouTube interfaces on your behalf and store it, so that developments over time become visible.

We only process data about channels for which you have granted us access yourself, plus publicly available data about channels that you add for watching.

3. Which permissions we request, and what for

When you connect a channel, Google asks for your consent to the following permissions. Each one is needed for a specific purpose:

youtube.readonly

Reads which channels and videos belong to your account: title, thumbnail, duration, publication date and the public counter. Without this permission the tool would not know which videos to analyse.

yt-analytics.readonly

Reads your analytics numbers: views, watch time, audience retention, impressions, click-through rate, traffic sources, countries, devices, age and gender groups of your audience, as well as subscribers gained and lost. This is the actual content of the tool.

yt-analytics-monetary.readonly

Reads your channel’s settlement figures, that is actual revenue rather than estimates. If you do not accept this permission, everything else works unchanged; the revenue figures then stay empty.

youtube.force-ssl

Grants write access. We use it exclusively for a single action: publishing a reply to a comment under your video after you have written it and explicitly confirmed it in the tool. Nothing is published automatically, nothing is deleted and nothing about your videos is changed.

4. Which data we store

The following is held in a database on our server:

• Access data: your e-mail address and a password hash for the account with us, plus an encrypted Google refresh token per connected channel. The token is not stored in plain text.
• Channel and video details: channel name, channel image, subscriber count, video titles, thumbnails, durations, publication times.
• Analytics numbers per day and video: the metrics listed under point 3. They are displayed for at most 30 days — as required by the YouTube terms (see point 10).
• Public counters: hourly and minute-by-minute snapshots of the view, like and comment counter as it stands publicly under every video.
• Operational data: logs of the retrieval runs, error messages and the consumption of the API quota.

Comments are not stored. They are fetched live from YouTube when you open the comment view and are only displayed.

5. How we protect your data

The connection to the application is always encrypted (HTTPS); the browser is additionally instructed via HSTS to never connect without encryption. The Google refresh token that enables lasting access to your YouTube channel is not stored in plain text in the database but encrypted with AES-256-GCM. The key required for that lives separately from the database, in the server environment — so a copy of the database alone is not enough to reach your account.

Your password for your TubeCompass account is never stored in plain text; it is hashed by Appwrite, the service we use for account management. The database itself is not reachable from the public internet; only the operator has access to the server.

6. Legal basis

Processing takes place in order to perform the user relationship pursuant to Art. 6 (1) (b) GDPR. Connecting your Google account is additionally based on your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw at any time (see point 9).

7. Use of data from Google (Limited Use)

TubeCompass’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In concrete terms this means:

• The data is used exclusively to provide you with the features of TubeCompass.
• The data is not sold, not passed on to third parties, not used for advertising and not used to train AI models.
• Humans do not read this data, unless you explicitly ask for help with a problem, it is necessary for security reasons or it is required by law.

8. YouTube terms

TubeCompass uses the YouTube API Services. By using TubeCompass you agree to the YouTube Terms of Service. The Google Privacy Policy also applies.

9. Revoking access and deleting data

You can withdraw TubeCompass’s access to your Google account at any time, independently of us, through the security settings of your Google account. After that we no longer retrieve any new data.

If you disconnect a channel in the tool itself, we hand the permission back to Google and delete the stored token immediately. On request we delete all data stored about you; an informal message to info@codepa.de is enough. Deletion happens within 30 days.

10. Retention period

The YouTube Developer Policies permit displaying figures from the YouTube interfaces for at most 30 days. TubeCompass adheres to this: the time ranges in the overview and on the channel pages do not reach further back, and the history of an individual video likewise shows at most the last 30 days.

Operational logs are deleted after 90 days, technical access data of the website after seven days. If you disconnect a channel we delete the access immediately; if you delete a channel, every measurement taken for it disappears as well. After your account is deleted, all associated data is removed.

11. How we use, process and share the data

Use. The data retrieved from the YouTube interfaces is used solely to show you the numbers of your own channels: the overview across all your channels, the analysis of individual videos, audience retention and the comparison values calculated from them. For no other purpose.

Processing. A nightly job on our server retrieves the numbers and stores them in the database. From these we calculate values that do not come from YouTube but from us: your channel's usual range — the median and quartiles of your own recent videos at the same age — and from that a multiplier saying how a video stands in relation to your own earlier ones. These values are labelled in the interface as our own calculation and kept separate from the figures supplied by the YouTube interfaces. There is no automated decision-making and no profiling of individuals.

Sharing with external parties. We do not pass your data to anyone — not to advertising networks, not to data brokers, not to other users of the application. There is no sale and no exchange. Only two service providers have access to the data, and only because they supply the infrastructure the application runs on:

• The Constant Company, LLC (Vultr): provides the rented server and the data centre in Frankfurt am Main, Germany. The application and the database live there.
• Appwrite: manages the user accounts, that is e-mail address and password hash. Analytics figures for your channels are not held there.

Data processing agreements pursuant to Art. 28 GDPR are in place with both. They may process the data only on our behalf and only on our instructions, not for their own purposes.

Sharing internally. TubeCompass is operated by a single person (see point 1). There are no employees and no further internal parties the data could reach. The operator only sees your data if you explicitly ask for help with a problem, it is necessary for security reasons or the law requires it.

There is no exception: this data is also not used or shared for advertising, market research or the training of AI models.

12. Hosting and technical access data

When the website is accessed, technical access data is processed on the server side (IP address, time, address requested, browser identification). It serves the operation of the service and the defence against attacks and is deleted after seven days.

13. Cookies and audience measurement

This website sets no cookies and embeds no analytics or advertising services. In the tool itself, a technically necessary cookie is set for your sign-in, plus a cookie that remembers your language setting. Neither requires consent, because without these cookies signing in would not work.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). A message to info@codepa.de is enough.

You can also lodge a complaint with a supervisory authority. The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.

15. Changes

If the scope of processing changes, we update this policy and adjust the date given above. In the case of material changes we will also inform you in the tool.