StudioFlow Privacy Policy

Version 2026-07-16 · Contact & grievance channel: preetamnegi7@gmail.com

1. Who we are

StudioFlow is a YouTube content-operations tool for creators and teams: production planning, channel analytics, research intelligence, and publishing. The service is operated by YTStudioflow (India), who is the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023 (DPDP). For any privacy question, request, or grievance, email preetamnegi7@gmail.com — this address is the designated grievance channel and we aim to respond within 30 days.

2. YouTube API Services

StudioFlow uses YouTube API Services. By using StudioFlow you also agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy, which governs how Google handles your data.

3. Data we collect, and why

• Account data — your email, name, and profile picture from Firebase sign-in. Purpose: creating and operating your workspace, team access control, and communicating with you.
• Authorized YouTube data (only after you connect a channel) — channel statistics, video analytics, search terms, traffic sources, and impressions/click-through reports. Purpose: your dashboards, performance reviews, predictions, and recommendations.
• OAuth tokens — your YouTube refresh token, stored encrypted (AES-256-GCM). Purpose: syncing your data and publishing videos you explicitly initiate. Never used for anything else.
• Public YouTube data — public channel statistics, video metadata, trending charts, and search results, cached in a shared research database. Purpose: trend detection, competitor benchmarking, and topic research.
• Consent & usage records — the version and time of your acceptance of our Terms, and fair-use quota counters. Purpose: legal compliance and preventing abuse of shared research quotas.

4. Who processes it (subprocessors)

We do not sell your data, and we show no ads. Data is processed only by the infrastructure that runs the service:

• Vercel — application hosting (primary region: Mumbai, India).
• Turso — content database.
• Google Firebase — authentication only.
• YouTube API Services — data sync and publishing, under your explicit OAuth consent.
• Optional AI providers — only if you enable them in Settings. Local Ollama runs entirely on your own computer; nothing is sent to a cloud AI provider unless you select one.

International transfers: while the primary hosting region is Mumbai, these providers may process data in other regions under their own safeguards.

5. Security

• OAuth refresh tokens and workspace API keys are encrypted at rest with AES-256-GCM.
• All traffic is encrypted in transit (TLS/HTTPS).
• Direct client access to the database is denied; every request is authenticated and authorized server-side.

6. Retention and deletion

• Cached public search and trending data is deleted within 7 days; cached public channel data is refreshed or deleted within 30 days, in line with the YouTube API Services policies.
• Authorized (private) YouTube data is refreshed on a rolling basis and retained only while your channel stays connected.
• Disconnecting a channel stops all syncing; you can also revoke StudioFlow's access at any time from your Google security settings, which immediately invalidates our access.
• To request deletion of your account and all stored data, email preetamnegi7@gmail.com.

7. Your rights (DPDP Act, 2023)

You may at any time, by emailing preetamnegi7@gmail.com:

• request access to the personal data we hold about you;
• request correction of inaccurate data or erasure of your data;
• withdraw consent (which ends the related processing and may end the service);
• raise a grievance — and if unresolved, escalate to the Data Protection Board of India.

8. Children

StudioFlow is not directed at children under 13, and we do not knowingly collect their data. Users under 18 may use StudioFlow only with the consent of a parent or guardian, as required by the DPDP Act.

9. Cookies and local storage

StudioFlow uses browser local storage for sign-in session state, your Terms-acceptance record, and device preferences (interface scale, AI provider choice). No advertising or tracking cookies are used.

10. Changes to this policy

When this policy changes materially, its version number changes and you will be asked to review and accept the new version before continuing to use StudioFlow.