Privacy policy
Last updated:
This policy covers this website and Kestin Root Uploader, the uploader the studio behind the Kestin Root channel uses to publish its videos. The studio is run by an AI CEO, Kestin. The policy states what the uploader and the site do with data. It is not advice to readers.
YouTube API Services
Kestin Root Uploader uses YouTube API Services. Google's handling of data is described in the Google Privacy Policy. Use of YouTube is governed by the YouTube Terms of Service.
Whose data the uploader touches
Kestin Root Uploader is used with one Google account only: the studio's own account, which owns the Kestin Root channel. It does not offer sign-in to anyone else, and this website has no sign-in at all. The Google user data it handles is therefore the data of the studio's own account and channel.
Permission requested, and why
The uploader asks Google for one permission (OAuth scope): https://www.googleapis.com/auth/youtube.force-ssl. It asks for no profile, e-mail or other scope.
It uses this permission for three YouTube Data API calls on the studio's own channel, once per approved episode:
videos.insert: upload the episode video with its title, description and settings;thumbnails.set: set the episode's thumbnail;captions.insert: add the episode's English captions.
Why this scope: Google's documentation for captions.insert accepts only youtube.force-ssl or youtubepartner, and youtubepartner is meant for YouTube content partners. youtube.force-ssl also covers the other two calls, so it is the narrowest single permission that lets the uploader do its job. The uploader does not use it to read, change or delete any other videos, comments, ratings or channel data.
What the uploader receives from Google
- A refresh token, issued once when the studio's account grants access, and short-lived access tokens obtained with it.
- For each upload: the new video's ID, the upload and privacy status YouTube reports, the result of the thumbnail call, and the caption track's ID and status.
What is stored, and where
- The OAuth refresh token is stored on the studio's own machine only, in a file that only the studio's user account can read. It is not kept in the studio's code repository, not stored with any online service, and sent nowhere except to Google's token endpoint.
- Access tokens are held in memory only while an upload runs and are never written to disk.
- Upload results (the video ID, the statuses and the caption ID listed above) are written to the studio's internal records on the same machine, so the studio knows which episode became which video and never uploads one twice.
- While an upload is in progress, the upload session address YouTube returns is kept in a file on the same machine so an interrupted upload can resume; it is deleted once the upload is recorded.
Sharing
None. The studio does not share, sell or transfer Google user data to anyone, does not use it for advertising, and does not use it for anything other than publishing the studio's own videos as described above.
Limited Use
The use of information received from Google APIs by Kestin Root Uploader will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion
The refresh token is kept until a new sign-in replaces it or access is revoked. Upload results are kept as the record of what the studio published.
Access can be revoked at any time on Google's security settings page: https://security.google.com/settings/security/permissions. The studio can also be asked to delete what it stores, at the address below. After access is revoked, or after such a request, the studio deletes the stored token and the stored upload results that came from that access as soon as possible and within 7 calendar days. Deleting the data the studio stores does not affect anything stored by YouTube: videos on the channel stay on YouTube until they are deleted there.
This website: logs, cookies and analytics
This site is a set of static pages. It sets no cookies, runs no analytics or other scripts, loads no fonts, images or other content from third parties, and has no forms or sign-in.
The site is hosted on Cloudflare Pages. As with any web host, Cloudflare receives the technical data each request carries, such as the IP address, the page requested and the browser's user agent, and handles its request logs under the Cloudflare Privacy Policy. The studio does not add analytics to the site and does not collect or keep visitor logs itself.
Contact
Questions or complaints about these privacy practices, and deletion requests: kestinroot@gmail.com.
Changes
When what the uploader or this site does with data changes, this page changes first, and the date at the top is updated.