Privacy Policy

TubeShelf is open-source software that anyone can run on their own server. The person or organisation operating this instance — the operator — controls the server, the database and any backups, and is responsible for the data described below. The authors of the TubeShelf software do not host this instance, receive no data from it, and have no access to it.

Everything below is stored in a database file on the operator's server. Nothing is sent to the TubeShelf project or to any analytics or advertising service.

• Account details — your name, email address, and either a hashed password or the identifier returned by the single-sign-on provider you used. Passwords are never stored in readable form.
• Sessions — a session identifier held in a cookie so you stay signed in. This cookie is strictly necessary for the site to work; there are no advertising or tracking cookies.
• Your subscriptions and lists — the YouTube channels you follow, plus any tags and custom lists you create.
• Viewing activity — which videos you have marked as watched, your playback position in a video, your watch-later list and your watch history.
• Preferences — theme, sort order, player and caption settings, and per-channel overrides.
• Cached video metadata — titles, descriptions, thumbnails, durations and publication dates for videos from the channels you follow. This is public YouTube data, cached so the feed loads quickly, and it is pruned automatically according to the retention window configured for the instance.

Linking a Google account is entirely optional. TubeShelf works without one; the only thing it enables is liking a video on YouTube from inside the player, and the optional auto-like feature.

• Scope requested — https://www.googleapis.com/auth/youtube.force-ssl. This is the narrowest scope Google offers that permits setting a rating on a video.
• What it is used for — reading whether you have already liked the video you are watching, and setting or removing your like when you ask for it (or when auto-like is enabled and you pass the threshold you configured). Nothing else.
• What is stored — the OAuth access and refresh tokens Google issues, encrypted at rest, together with the label of the linked account and the granted scope. Tokens are used only to call the YouTube Data API on your behalf.
• Unlinking — you can unlink at any time from your TubeShelf settings. Unlinking asks Google to revoke the token and deletes the stored tokens from this instance. You can also revoke access from your Google account's third-party access page.

Limited Use.TubeShelf's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google APIs is never sold, never used for advertising or profiling, and never used to train machine-learning models. It is not transferred to anyone except as needed to provide the like feature described above, or where required by law.

• YouTube and Google — to fetch public video and channel metadata, to stream video, and, if you linked an account, to call the YouTube Data API. Their handling of that traffic is covered by the Google Privacy Policy.
• Thumbnail images— served through this instance's own image proxy, so your browser does not contact Google's image hosts directly for them.
• SponsorBlock — when SponsorBlock is enabled, the player queries sponsor.ajay.app for sponsor segments using a partial hash of the video id. It can be turned off in settings.
• Your single-sign-on provider — only if the operator configured one and you sign in with it.

TubeShelf contains no analytics, no advertising and no third-party tracking scripts.

Your account data is kept for as long as your account exists. From your TubeShelf settings you can clear your watch history, remove your subscriptions, reset your preferences, unlink your Google account, and delete your account entirely. Deleting your account removes your profile, sessions, subscriptions, viewing activity and stored Google tokens from the database. Cached public video metadata is shared between users and expires on the instance's retention schedule.

Server backups, if the operator keeps any, are outside the application's control — ask the operator about their backup retention.

Passwords are hashed, and Google OAuth tokens and single-sign-on client secrets are encrypted at rest. The overall security of your data also depends on how the operator runs the server — transport encryption, patching and access control are their responsibility.

This instance is not directed at children under 13, and accounts should not be created for them.

Updates to this policy appear on this page with a new "last updated" date. Material changes to how a linked Google account is used will be reflected here before they take effect.

Questions about this document, or requests concerning your data, go to senth.wallace@gmail.com.