Privacy Policy

Our Privacy Commitment

This API Client (Likes Search for YouTube) uses YouTube API Services to sync your liked videos with your consent (youtube.readonly scope). By using the Extension you also agree to our data practices described in this Privacy Policy and to the YouTube Terms of Service.

Likes Search for YouTube is designed with privacy as a core priority. Your liked video data—including titles, descriptions, and thumbnails—remains stored locally in your browser and is never transmitted to our servers.

However, to provide Pro license validation and ensure the security of our licensing system, we do collect minimal information when you activate a Pro license. This privacy policy explains exactly what data is collected, how it's used, and your rights under GDPR, CCPA, and other privacy regulations.

This Privacy Policy is permanently available at https://sophyte.com/youtube-likes-search/privacy. The Extension requires you to review and accept a privacy disclosure (linking to this policy) before OAuth and sync features are available. Links also appear in the extension popup and at https://sophyte.com/youtube-likes-search/terms.

YouTube API Data We Access, Collect, Store, and Use

When you grant OAuth consent, this API Client accesses Authorized Data (API Data relating to you) from YouTube API Services using the read-only scope https://www.googleapis.com/auth/youtube.readonly. We do not request write scopes.

YouTube Data API v3 endpoints used

• channels.list — to locate your liked-videos playlist
• playlistItems.list — to list items in your liked playlist
• videos.list — to fetch video metadata for those items

API Data fields we store locally

Video ID, title, description, channel name, channel ID, thumbnail URL, published date, date you liked the video, duration, view count, and status flags (e.g. deleted/private when returned by the API).

How we use that API Data

• To build a local searchable index of your liked videos (Ctrl+K overlay on youtube.com)
• To filter/sort and (for Pro users, at your request) export a local copy of that index
• To refresh or purge the local cache consistent with YouTube API Developer Policies (including a 30-day refresh/purge regime)

We do not send YouTube API Data (video titles, descriptions, thumbnails, or liked-playlist contents) to Sophyte servers. License validation traffic to api.sophyte.com never includes YouTube API Data.

Information Stored on Your Device (Cookies & Similar Technology)

This API Client stores, accesses, and collects information directly on your device / browser using browser storage technologies that are similar to cookies (Chrome extension storage and IndexedDB). We do not place third-party advertising cookies, and we do not use cookies to track you across other websites for YouTube API Data.

• IndexedDB (Dexie): liked-video API Data and sync metadata
• chrome.storage.local / session: mirrored video cache for the content-script overlay, settings, privacy acknowledgment flags, license cache (Pro), and short-lived sync/checkout session flags
• Chrome Identity token storage: OAuth authorization tokens managed by Chrome (see Authorization Tokens below)—not readable as ordinary cookies by our code, and never uploaded to our backend

Third parties that process non-YouTube data when you buy Pro (Stripe, Resend, Cloudflare) may set their own cookies or similar technology on their checkout/email/infrastructure domains under their own policies—not for storing your liked-video API Data on our behalf.

Information We Collect

1. Data Stored Locally in Your Browser

The following data is stored ONLY in your browser using Chrome's storage APIs and IndexedDB, and is NEVER transmitted to our servers:

• Video Metadata: Video ID, title, description, channel name, channel ID, thumbnail URL, published date, date you liked the video, duration, view count, and status flags (deleted/private)
• Extension Settings: Auto-sync preferences, sync interval, display preferences (theme, hide deleted videos), and keyboard shortcuts
• Sync Metadata: Last sync timestamp, count of active/archived/total videos, and cached data for performance
• Starter tier users: Limited to 300 videos
• Pro tier users: Unlimited videos

This data remains on your device until you uninstall the extension, clear your browser's extension data, or use Chrome's "Clear browsing data" feature.

Exports (user-directed data portability): When you choose Export (Pro), files and clipboard contents (CSV, JSON, Markdown, or NotebookLM-ready URL lists) are generated entirely on your device from data already stored locally. Export does not call YouTube API Services again, does not send API Data to api.sophyte.com, and does not upload files to Sophyte. Exported files become copies under your control (similar to saving your own data). The Extension’s in-browser stored copy of API Data remains subject to Disconnect deletion and the 30-day refresh/purge rules below.

2. Data Sent to Our Backend (Pro License Validation Only)

If you purchase a Pro license, the following data IS transmitted to our backend servers (api.sophyte.com) for license validation:

• License Activation Data (sent once when activating):
  • License key (alphanumeric code in format YTL-XXXX-XXXX-XXXX)
  • Device ID (randomly generated UUID stored locally)
  • Browser name and version (e.g., "Chrome 120.0.0.0")
  • Operating system platform (e.g., "MacOS", "Windows", "Linux")
  • Extension version (e.g., "1.0.1")
• License Validation Data (sent hourly while extension is active):
  • Device ID
  • JWT token (issued after successful activation)
  • Timestamp of validation request

IMPORTANT: Your video data, search queries, and browsing activity are NEVER sent to our backend servers.

3. Data Collected by Third-Party Services

Stripe (Payment Processing)

When you purchase a Pro license, Stripe (our payment processor) collects:

• Your name and email address
• Payment information (credit card, Apple Pay, Google Pay, etc.)
• Billing address
• Order details and transaction history

We receive from Stripe: your email address, your name (optional, if provided), payment intent ID, and payment status (paid, refunded, etc.). We do not have access to your full payment card details.

How we use your email:

• Storage: We store your email address in our secure database (Cloudflare D1, encrypted at rest)
• License Key Delivery: We send you an automated email with your license key immediately after purchase (via Resend)
• Customer Support: We may use your email to respond to support requests or refund notifications
• Marketing (opt-in only): During Stripe Checkout you may see an optional checkbox to receive product updates. We only send promotional email if you explicitly opt in. Transactional emails (license key delivery, refund/support replies) are always allowed and do not require that checkbox.
• No Sharing: We do NOT share your email with third parties (except Resend for email delivery and Stripe for payment processing)
• Data Deletion: You can request deletion of your email at any time by contacting sophytedigital@gmail.com

Stripe's privacy policy: https://stripe.com/privacy

Google (OAuth Authentication & YouTube Data API)

When you authorize the extension to access your YouTube liked videos, Google collects:

• Your consent to grant access to the youtube.readonly scope
• Authentication tokens (managed by Chrome, never visible to us)
• API usage logs (managed by Google)

The extension requests the following OAuth scope:

• https://www.googleapis.com/auth/youtube.readonly - Read-only access to your YouTube account data

This scope allows the extension to:

• Fetch your list of liked videos
• Access video metadata (title, description, thumbnail, duration, view count, etc.)

Google's privacy policy: http://www.google.com/policies/privacy · https://policies.google.com/privacy

Cloudflare (Infrastructure)

Our backend API is hosted on Cloudflare Workers. Cloudflare may collect:

• IP address (for DDoS protection and performance)
• Request timestamps and HTTP headers

Cloudflare does NOT have access to your video data (it remains local in your browser).

Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

How We Use Your Information

Local Video Data (Stored in Browser)

• To provide instant search functionality across your liked videos
• To enable filtering by channel, date, duration, and other attributes
• To sync your video index when you enable auto-sync
• To preserve your archive and organizational preferences

License Validation Data (Sent to Backend)

• To verify the authenticity of Pro license keys
• To enforce device limits (Pro licenses allow up to 3 devices)
• To prevent unauthorized sharing or resale of licenses
• To provide customer support and process refunds
• To detect and prevent fraud or abuse

OAuth Tokens (Managed by Chrome)

• To authenticate API requests to YouTube Data API v3
• To fetch your liked videos list on your behalf
• Tokens are managed by Chrome's identity API and never sent to our backend

We Do NOT Use Your Data For:

• Advertising or selling your data to third-party brokers
• Marketing emails unless you explicitly opt in at Stripe Checkout
• Building user profiles or behavioral analytics
• Training AI/ML models
• Any purpose other than providing the extension's core functionality (and optional opted-in product updates)

Google API Services & YouTube Data

YouTube Data API v3 Usage

The extension uses Google's YouTube Data API v3 to access your liked videos. Here's how it works:

1. Authentication: You click "Sync Liked Videos" → Chrome displays Google's OAuth consent screen → You grant permission → Chrome securely stores an OAuth token
2. Data Fetching: The extension requests your liked videos from YouTube's servers using the OAuth token. This happens entirely in your browser.
3. Local Storage: Video metadata is stored in your browser's IndexedDB. YouTube's API responses never touch our backend servers.

Scopes Requested

• youtube.readonly - Read-only access to your YouTube account

Why This Scope Is Necessary

This scope is required to fetch your list of liked videos and their metadata. Without it, the extension cannot function. We request the narrowest scope possible—we do NOT request write access, upload access, or access to private information beyond liked videos.

Token Security & Retention (YouTube Developer Policies §III.E.4a)

• OAuth authorization tokens are stored by Chrome’s Identity API in Chrome’s secure token storage—not on Sophyte servers
• Tokens are used only for purposes consistent with your consent: authenticating read-only requests to YouTube API Services to sync your liked videos
• We store tokens only as long as necessary while you remain connected; on Disconnect we revoke the token with Google and remove it from Chrome’s cache
• Tokens are encrypted/isolated by Chrome from other extensions
• You can revoke access anytime via Google’s security settings (links in “How to Delete Data & Revoke Access” below)
• We NEVER send authorization tokens to our backend servers

Chrome Extension Permissions Explained

The extension requests the following Chrome permissions. Here's why each is necessary:

Required Permissions

• identity: To use Chrome's OAuth flow for Google authentication. Triggers Google sign-in and manages YouTube API tokens. Data accessed: OAuth tokens (managed by Chrome, not accessible to us).
• storage & unlimitedStorage: To save your video index and preferences locally. Pro users can index unlimited videos, which exceeds Chrome's default 5MB quota. All data stored locally in your browser.
• alarms: To enable auto-sync and periodic license validation. Triggers background tasks at scheduled intervals. No data access (scheduling only).
• contextMenus: To provide right-click "Search in Likes" functionality. Adds custom menu item when right-clicking on YouTube. Selected text processed locally.

Host Permissions

• https://www.googleapis.com/*: To communicate with YouTube Data API v3. Fetches liked videos list and video metadata. Your liked videos processed locally.
• https://*.youtube.com/*: To integrate with YouTube website. Displays search overlay, detects page context. Accesses YouTube page DOM to show extension UI.
• https://api.sophyte.com/*: To validate Pro licenses. Sends license key and device ID for verification. Only license data sent (no video data).

Permissions We Do NOT Request

• tabs: We don't track your browsing history
• webRequest: We don't intercept network traffic
• cookies: We don't read or write cookies
• downloads: We don't access your downloads folder
• geolocation: We don't track your location

Third-Party Services & Data Sharing

We share data with the following third-party services ONLY as necessary to provide the extension's functionality:

• Stripe (Payment Processor): Email, name (optional), order details. When: Only when you purchase a Pro license. Privacy policy
• Resend (Email Delivery): Email address, name (optional). When: Only when sending your license key after purchase. Privacy policy
• Cloudflare (Infrastructure): License keys, device IDs, validation timestamps, IP addresses. When: Only when activating or validating a Pro license. Privacy policy
• Google (YouTube API Services): OAuth consent, API requests. When: Only when you authorize and sync liked videos. Privacy policy: http://www.google.com/policies/privacy

We Do NOT:

• Sell your data to third parties
• Share data with advertisers or marketers
• Use your data for purposes other than providing the extension
• Share data with analytics providers (we use no analytics)

How to Delete Data & Revoke Access

In addition to the normal deletion procedures below, if this API Client accesses or uses Authorized Data, you can revoke the API Client's access to your data via Google's security settings pages:

• https://myaccount.google.com/connections?filters=3,4&hl=en
• https://security.google.com/settings/security/permissions

Find the entry for this Extension (e.g. "YouTube Likes Search" / "Likes Search for YouTube") and remove access. Revoking stops new API access. Deleting data stored by this Extension does not delete data stored by YouTube itself—use YouTube or Google Account tools for that.

Delete data stored by this Extension (local API Data)

• Use Disconnect in the extension popup — we revoke the OAuth token and purge locally stored liked-video API Data as soon as possible (typically immediately; always within 7 calendar days)
• Uninstall the Extension — removes local videos, settings, and license state from that browser profile
• If sync has been stale for more than 30 days and Google access remains unavailable, the Extension may automatically clear local YouTube API Data to comply with YouTube API Developer Policies
• While connected, the Extension refreshes stored liked-video API Data through sync so the local copy does not remain stale beyond the 30-day refresh requirement

Local Data Retention (In Your Browser)

• Retained until you Disconnect, uninstall the extension, or clear Chrome extension data
• Use Disconnect in the extension popup to clear your local liked-video cache while keeping a Pro license (if activated)

Backend Data (On Our Servers)

• License keys: Retained indefinitely to prevent reuse after refunds
• Device activations: Retained while license is active
• Validation logs: Retained for 90 days for fraud detection
• Customer email/name: Retained for customer support and refund processing
• Deactivated devices: Soft-deleted (marked inactive but retained for audit)
• YouTube API Data: Never stored on our servers

How to Request Backend Data Deletion

To request deletion of your Pro license and backend data, email sophytedigital@gmail.com from the email address associated with your purchase. Include your license key in the email. We will respond within 30 days and:

• Deactivate your license within 24-48 hours
• Mark your device activations as deleted
• Anonymize logs within 90 days
• Note: License keys cannot be fully deleted to prevent fraudulent reuse

OAuth Tokens After Revocation

• Revocable at any time via the Google security settings links above
• Revoking access will prevent the extension from syncing new videos
• Locally stored video API Data is removed when you Disconnect/uninstall, or when the 30-day staleness policy clears it after Google access stays unavailable

Uninstalling the Extension

• Removes all local data (videos, settings, device ID)
• Does NOT automatically deactivate your Pro license
• To deactivate, email sophytedigital@gmail.com with your license key

Your Rights & Controls

You have the following rights regarding your data:

Right to Access

• Browse your indexed liked videos in the search overlay and review sync status in the extension popup
• Request a copy of backend data (license activations) via sophytedigital@gmail.com

Right to Deletion

• Delete local liked-video data via Disconnect in the extension popup, or by uninstalling
• Request deletion of backend data via sophytedigital@gmail.com

Right to Revoke Consent

• Revoke YouTube access via Google Account connections or Google security settings
• Deactivate Pro license by contacting support

Right to Data Portability

• Your liked-video index is stored locally in your browser (not on our servers), so we cannot export a server-side copy of it
• Pro users can export their local library themselves (CSV, JSON, Markdown, or NotebookLM link lists); files are generated on-device and saved only to your computer
• For a copy of Pro license records associated with your purchase email, contact sophytedigital@gmail.com

Right to Object

• Opt out of auto-sync to prevent periodic API requests
• Deactivate license to stop backend validation

GDPR Rights (EU Residents)

If you are an EU resident, you have additional rights under GDPR:

• Right to rectification (correct inaccurate data)
• Right to restriction of processing
• Right to lodge a complaint with a supervisory authority

Contact us at sophytedigital@gmail.com to exercise any of these rights.

California Residents (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended effective January 1, 2026:

Categories of Personal Information Collected

• Identifiers: Email address, device ID (UUID), license key
• Internet Activity: OAuth access tokens, API request logs, browser version, platform
• Commercial Information: Purchase history, order details, refund status

Categories Shared with Service Providers/Contractors

• Stripe (Payment Processor): Email, name, order details
• Resend (Email Delivery): Email, name (optional), license key
• Cloudflare (Infrastructure): License keys, device IDs, IP addresses, validation timestamps
• Google (YouTube API): OAuth tokens, API requests

Your CCPA Rights

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to Delete: You can request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: We do NOT sell your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

No Sale of Personal Information

We do NOT sell, share, or rent your personal information to third parties for monetary or other valuable consideration.

How to Exercise Your CCPA Rights

To exercise your CCPA rights, email sophytedigital@gmail.com from the email address associated with your account. We will verify your identity and respond within 45 days.

Security Measures

We take the following measures to protect your data:

Local Data Security

• Stored in Chrome's isolated storage (protected from other extensions)
• Uses browser's native encryption for storage
• No plaintext passwords or sensitive credentials stored

Backend Security

• HTTPS/TLS encryption for all API requests
• JWT tokens for authenticated license validation
• Device IDs are randomly generated UUIDs (not tied to personal info)
• Cloudflare DDoS protection and rate limiting

OAuth Security

• OAuth tokens managed by Chrome's secure identity API
• Tokens encrypted and isolated by Chrome
• No manual token handling in extension code

Incident Response

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours via email. The notification will include: what data was affected, when it occurred, steps we're taking, and steps you should take.

Children's Privacy

The extension is not directed at children under 16. We do not knowingly collect personal information from children. If you are under 16, please do not use this extension. If you believe we have inadvertently collected information from a child under 16, please contact us immediately at sophytedigital@gmail.com.

International Data Transfers

Our backend servers (Cloudflare Workers) may process data in various regions globally. By using the extension, you consent to the transfer of your data to the United States and other countries where Cloudflare operates.

For EU users: We rely on Cloudflare's compliance with EU-US Data Privacy Framework and Standard Contractual Clauses for international data transfers.

Changes to This Policy

We may update this policy to reflect changes in functionality, legal requirements, or our data practices. Significant changes will be communicated via:

• Extension update notes in the Chrome Web Store
• In-extension notifications
• Email (if you are a Pro license holder)

Your continued use of the extension after changes constitutes acceptance of the modified policy.

Contact Us

If you have questions about this privacy policy or your data, contact us:

Sophyte Digital LLC
Sheridan, Wyoming, USA
Email: sophytedigital@gmail.com

For privacy-specific inquiries, use subject line: "Privacy - YouTube Likes Search"

Support page: https://sophyte.com/youtube-likes-search