Security & control
The four principles
- Voluntary, separate connections. Google sign-in, your YouTube channel and your Google Cloud project are connected only at your explicit request and in three separate steps; TubeMakers never asks for or stores your Google password.
- Read-only access. For your YouTube channel, read-only permissions are requested exclusively. TubeMakers does not upload videos and changes nothing on your channel – publishing is done only by you in YouTube Studio.
- Separated data. Private channel data is visible only to the channel owner and the team members they explicitly authorise. Data of different channel owners is never analysed together.
- Revocable at any time. The YouTube and Google TTS connections can be revoked separately in TubeMakers. You can additionally manage Google access in your Google security settings; the complete deletion path is documented publicly.
Which data TubeMakers uses
| Data type | Examples | Who sees it | How long |
|---|---|---|---|
| Public channel and video data | title, description, thumbnail, views, likes, subscribers | users of the respective workspace | refreshed or deleted within 30 days |
| Your own channel analytics (after Google connection) | audience retention, traffic sources, impressions, click-through rate | channel owner and authorised team members only | while the connection exists; authorisation re-verified every 30 days |
| TubeMakers analyses | views per hour, outlier scores, patterns, recommendations | per feature and workspace | clearly labelled as TubeMakers analysis; at most 36 months where approved by YouTube |
| YouTube access tokens | Google OAuth tokens for your own channel | nobody – encrypted in the server vault only | while consent is active; immediate revocation possible |
| Google Cloud setup | project and billing identifiers, Workload Identity resources, voice | users of the respective workspace | setup access is short-lived and not stored; non-secret settings remain until deletion |
Which permissions are requested
For research and analytics TubeMakers requests exactly two read-only permissions from Google: read channel and video information (youtube.readonly) and read your own channel’s statistics (yt-analytics.readonly). The Google consent screen shows you these permissions before connecting. TubeMakers does not request write permissions for your channel; you upload and publish yourself in YouTube Studio.
Only for Google Cloud Text-to-Speech setup that you start yourself does a separate consent screen request the one-time scope https://www.googleapis.com/auth/cloud-platform. TubeMakers uses it solely to inspect or create the project you select, link your billing account, enable Text-to-Speech and configure the limited Workload Identity connection. The short-lived access is then discarded; TubeMakers stores neither a refresh token nor a service-account key.
What TubeMakers does not do
- No actions on your channel – no uploading, no publishing, no commenting, no playlist changes.
- No sale and no advertising use of Google or YouTube data; no third-party advertising in the application.
- No inference of sensitive attributes of viewers or creators (health, age, origin, religion, political opinion, sexual orientation).
- No mixing of private data of different channel owners.
- No cookies, no trackers and no external scripts on this website.
Technology in brief
Encrypted transport (HTTPS), encrypted access tokens that never leave the server, tenant and role checks on every access, logging of security-relevant events, regular backups and tested restore and deletion procedures.
Disconnecting
Disconnect YouTube in TubeMakers through Revoke access and delete data (direct link, sign-in required). Revoke Google TTS in setup through Revoke connection; this immediately blocks new and prepared speech calls. The customer project and its resources remain under your control and can also be removed in Google Cloud. The complete procedure is described on Delete your data.
Note: TubeMakers uses YouTube API Services. The YouTube Terms of Service and the Google Privacy Policy apply in addition.