Privacy Policy

Our Privacy Commitment

This API Client (Watchbook) uses YouTube API Services to sync your liked videos with your consent (youtube.readonly scope). By using the Extension you also agree to our data practices described in this Privacy Policy and to the YouTube Terms of Service.

Watchbook is designed with privacy as a core priority. Your liked video data—including titles, descriptions, and thumbnail links—remains stored locally in your browser and is never transmitted to our servers.

However, to provide Pro license validation and ensure the security of our licensing system, we do collect minimal information when you activate a Pro license. This privacy policy explains exactly what data is collected, how it's used, and your rights under GDPR, CCPA, and other privacy regulations.

This Privacy Policy is permanently available at https://sophyte.com/youtube-likes-search/privacy. The Extension requires you to review and accept a privacy disclosure (linking to this policy) before OAuth and sync features are available. Links also appear in the extension popup and at https://sophyte.com/youtube-likes-search/terms.

YouTube API Data We Access, Collect, Store, and Use

When you grant OAuth consent, this API Client accesses Authorized Data (API Data relating to you) from YouTube API Services using the read-only scope https://www.googleapis.com/auth/youtube.readonly. We do not request write scopes.

YouTube Data API v3 endpoints used

• channels.list — to locate your liked-videos playlist; and, only when you press Refresh on the Workbench Channels page, to read the public statistics fields (subscriber count when the channel makes it public, view count, public video count) for at most 100 channels from your liked videos per day
• playlistItems.list — to list items in your liked playlist
• videos.list — to fetch video metadata for those items

API Data fields we store locally

Video ID, title, description, channel name, channel ID, thumbnail URL, published date, date you liked the video, duration, view count, and status flags (e.g. deleted/private when returned by the API).

Channel statistics, only for channels you refresh: channel ID, subscriber count (or that the channel hides it), view count, public video count, and the date they were fetched. These are public numbers about other creators' channels; we keep them on your device for no more than 30 days, after which they are deleted.

How we use that API Data

• To build a local searchable index of your liked videos (Ctrl+K overlay on youtube.com)
• To filter/sort and, at your request, export a local copy of that index (Pro: any size; the free plan: one preview export of up to 50 videos)
• To show YouTube's own public numbers for the channels in your liked videos, each dated, only when you press Refresh. Nothing is calculated, ranked, or totalled from them
• To re-check stored video details in the background so none are more than 30 days old, and to delete them when that is not possible, as YouTube API Developer Policies require

We do not send YouTube API Data (video titles, descriptions, thumbnails, or liked-playlist contents) to Sophyte servers. License validation traffic to api.sophyte.com never includes YouTube API Data.

Information Stored on Your Device (Cookies & Similar Technology)

This API Client stores, accesses, and collects information directly on your device / browser using browser storage technologies that are similar to cookies (Chrome extension storage and IndexedDB). We do not place third-party advertising cookies, and we do not use cookies to track you across other websites for YouTube API Data.

• IndexedDB (Dexie): liked-video API Data, liked-playlist entry identifiers and ordering, durable sync checkpoints (current page and progress counters), any collections you create (the name you chose plus the IDs of the videos you added; a Smart Collection instead stores the search text and filter choices you saved, such as a date window, a view-count range, or the channels you included or excluded, with their names), and public channel statistics you fetched from the Channels page (deleted after 30 days), and your settings. Disconnect deletes these checkpoints, collections and channel statistics with the liked-video data; the automatic clearing described under Your Controls deletes collections too
• Notes (IndexedDB): Notes you write are stored on this device only and never sent to our servers. Disconnect removes each note's video link and title; your words stay until you delete them, and text you pasted may still mention or link the video. You can also keep one note per collection: if you delete the collection, or Disconnect or the automatic 30-day clearing removes your collections, its note stays on this device with the collection's name until you delete it. When the Extension clears its local YouTube data automatically, each note keeps its video link so a later sync can match the note to its video again, unless Google access has been missing for 28 days (described below). On a YouTube video page, Ctrl+K reads the video ID from the page address to offer a note for it. It reads the player's current time only when you click Insert time, and moves the player only when you click a time in your note; at that moment it also reads the video's length, so it never reads or moves an ad. If a video is fullscreen when you press Ctrl+K, it leaves fullscreen so the search panel can show.
• chrome.storage.local / session: mirrored video cache for the content-script overlay, a compact list of your collections (name and item count only) so the overlay can show them, pinned video/channel IDs (favorites you set in the Ctrl+K overlay; deleted by Disconnect and by the automatic clearing), a list of which videos have notes (video IDs and edit times only, never the text; Disconnect deletes it), privacy acknowledgment flags, license cache (Pro, including the time of the first failed re-check when a license is being served on trust while offline), a small record of whether the one free preview export has been used, whether the one 30-minute advanced-filter preview has been started or used, with the time it began, and whether the one free channel-numbers refresh has been used (no video or channel data; deliberately kept through Disconnect so reconnecting cannot reset it), and a small quota-safety record containing only the Pacific date, attempted/reserved API-unit counts (including today's stored-details re-checks), and whether today's channel refresh has finished. Disconnect clears the active reservation but retains the date, the already-spent count and that flag until the next Pacific-day rollover, so reconnecting cannot reset the safety accounting. If you start a Pro checkout from inside the extension, what you were doing (search text, the filters you had set, selected video IDs, or a collection name) is kept in session storage for up to 24 hours so it can be restored after payment; it never leaves your device, only a short label naming the button you pressed is sent with the checkout, and Disconnect or closing the browser removes it. The Stripe checkout session ID is kept in local storage for up to an hour and sent to api.sophyte.com to fetch your license key once payment completes; it is deleted as soon as the key arrives or the hour ends
• Chrome Identity token storage: OAuth authorization tokens managed by Chrome (see Authorization Tokens below)—not readable as ordinary cookies by our code, and never uploaded to our backend

Third parties that process non-YouTube data when you buy Pro (Stripe, Resend, Cloudflare) may set their own cookies or similar technology on their checkout/email/infrastructure domains under their own policies—not for storing your liked-video API Data on our behalf.

Information We Collect

1. Data Stored Locally in Your Browser

The following data is stored ONLY in your browser using Chrome's storage APIs and IndexedDB, and is NEVER transmitted to our servers:

• Video Metadata: Video ID, title, description, channel name, channel ID, thumbnail URL, published date, date you liked the video, duration, view count, and status flags (deleted/private)
• Extension Settings: Auto-sync preferences, sync interval, and display preferences (theme, hide deleted videos)
• Sync Metadata: Last sync timestamp, count of active/archived/total videos, and cached data for performance
• Starter tier users: The searchable view is limited to the 300 most recent likes; sync never deletes already-held rows merely because the tier changes
• Pro tier users: Unlimited videos

This data remains on your device until you use Disconnect in the extension popup, uninstall the extension, clear your browser's extension data, or use Chrome's "Clear browsing data" feature.

Notes you write are your own words, kept on this device until you delete them in the Workbench, uninstall the extension or clear its data. Disconnect removes each note's video link and title and keeps the words; a note about a collection keeps the collection's name.

Exports (user-directed data portability): When you choose Export (Pro, or the free plan's one preview export of up to 50 videos), files and clipboard contents (CSV, JSON, Markdown, or a list of links you can paste into NotebookLM) are generated entirely on your device from data already stored locally. Export does not call YouTube API Services again, does not send API Data to api.sophyte.com, and does not upload files to Sophyte. Exported files become copies under your control (similar to saving your own data). The Extension’s in-browser stored copy of API Data remains subject to Disconnect deletion and the 30-day refresh/purge rules below.

2. Data Sent to Our Backend (Pro License Validation Only)

If you purchase a Pro license, the following data IS transmitted to our backend servers (api.sophyte.com) for license validation:

• License Activation Data (sent once when activating):
  • License key (alphanumeric code in format YTL-XXXX-XXXX-XXXX)
  • Device ID (randomly generated UUID stored locally)
  • The word "Chrome" (no browser version number)
  • Your operating system platform as the browser reports it (e.g., "MacIntel", "Win32", "Linux x86_64")
  • Extension version (the version installed in Chrome)
• License Validation Data (sent hourly while extension is active):
  • Device ID
  • JWT token (issued after successful activation)
  • Extension version

IMPORTANT: Your video data, search queries, and browsing activity are NEVER sent to our backend servers.

3. Data Collected by Third-Party Services

Stripe (Payment Processing)

When you purchase a Pro license, Stripe (our payment processor) collects:

• Your name and email address
• Payment information (credit card, Apple Pay, Google Pay, etc.)
• Billing address
• Order details and transaction history

We receive from Stripe: your email address, your name (optional, if provided), payment intent ID, and payment status (paid, refunded, etc.). We do not have access to your full payment card details.

How we use your email:

• Storage: We store your email address in our secure database (Cloudflare D1, encrypted at rest)
• License Key Delivery: We send you an automated email with your license key immediately after purchase (via Resend)
• Customer Support: We may use your email to respond to support requests or refund notifications
• Marketing (opt-in only): During Stripe Checkout you may see an optional checkbox to receive product updates. We only send promotional email if you explicitly opt in. Transactional emails (license key delivery, refund/support replies) are always allowed and do not require that checkbox.
• No Sharing: We do NOT share your email with third parties (except Resend for email delivery and Stripe for payment processing)
• Data Deletion: You can request deletion of your email at any time by contacting sophytedigital@gmail.com

Stripe's privacy policy: https://stripe.com/privacy

Google (OAuth Authentication & YouTube Data API)

When you authorize the extension to access your YouTube liked videos, Google collects:

• Your consent to grant access to the youtube.readonly scope
• Authentication tokens (managed by Chrome, never visible to us)
• API usage logs (managed by Google)

The extension requests the following OAuth scope:

• https://www.googleapis.com/auth/youtube.readonly - Read-only access to your YouTube account data

This scope allows the extension to:

• Fetch your list of liked videos
• Access video metadata (title, description, thumbnail, duration, view count, etc.)

Google's privacy policy: http://www.google.com/policies/privacy · https://policies.google.com/privacy

Cloudflare (Infrastructure)

Our backend API is hosted on Cloudflare Workers. Cloudflare may collect:

• IP address (for DDoS protection and performance)
• Request timestamps and HTTP headers

Cloudflare does NOT have access to your video data (it remains local in your browser).

Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

How We Use Your Information

Local Video Data (Stored in Browser)

• To search your liked videos, including matches in the notes you wrote
• To filter and sort that library, and to keep the collections and Smart Collections you create on this device
• To show YouTube's public channel numbers when you press Refresh, without calculating, ranking, or totalling them
• To re-check stored video details in the background, and to delete local YouTube data when a sync cannot finish, as described under Your Controls
• To export a local copy when you ask (CSV, JSON, Markdown, or a list of links)
• To sync your liked videos when you press Sync, and, on Pro, on a schedule you choose. Pressing Sync on Pro also removes likes you took back on YouTube; automatic sync does not

License Validation Data (Sent to Backend)

• To verify the authenticity of Pro license keys
• To enforce device limits (Pro licenses allow up to 3 devices)
• To prevent unauthorized sharing or resale of licenses
• To provide customer support and process refunds
• To detect and prevent fraud or abuse

OAuth Tokens (Managed by Chrome)

• To authenticate API requests to YouTube Data API v3
• To fetch your liked videos, to re-check their stored details, and, only when you press Refresh, to read public channel numbers
• Tokens are managed by Chrome's identity API and never sent to our backend

We Do NOT Use Your Data For:

• Advertising or selling your data to third-party brokers
• Marketing emails unless you explicitly opt in at Stripe Checkout
• Building user profiles or behavioral analytics
• Training AI/ML models
• Any purpose other than providing the extension's core functionality (and optional opted-in product updates)

Google API Services & YouTube Data

YouTube Data API v3 Usage

The extension uses Google's YouTube Data API v3 to access your liked videos. Here's how it works:

1. Authentication: You click "Sync Liked Videos" → Chrome displays Google's OAuth consent screen → You grant permission → Chrome securely stores an OAuth token
2. Data Fetching: The extension requests your liked videos from YouTube's servers using the OAuth token. This happens entirely in your browser.
3. Local Storage: Video metadata is stored in your browser's IndexedDB. YouTube's API responses never touch our backend servers.

Scopes Requested

• youtube.readonly - Read-only access to your YouTube account

Why This Scope Is Necessary

This scope is required to fetch your list of liked videos and their metadata. Without it, the extension cannot function. We request the narrowest scope possible—we do NOT request write access, upload access, or access to private information beyond liked videos.

Token Security & Retention (YouTube Developer Policies §III.E.4a)

• OAuth authorization tokens are stored by Chrome’s Identity API in Chrome’s secure token storage—not on Sophyte servers
• Tokens are used only for purposes consistent with your consent: authenticating read-only requests to YouTube API Services to sync your liked videos and, when you press Refresh on the Channels page, to fetch public statistics for the channels in them
• We store tokens only as long as necessary while you remain connected; on Disconnect we revoke the token with Google and remove it from Chrome’s cache
• Tokens are encrypted/isolated by Chrome from other extensions
• You can revoke access anytime via Google’s security settings (links in “How to Delete Data & Revoke Access” below)
• We NEVER send authorization tokens to our backend servers

Chrome Extension Permissions Explained

The extension requests the following Chrome permissions. Here's why each is necessary:

Required Permissions

• identity: To use Chrome's OAuth flow for Google authentication. Triggers Google sign-in and manages YouTube API tokens. Data accessed: OAuth tokens (managed by Chrome, not accessible to us).
• storage & unlimitedStorage: To save your video index and preferences locally. Pro users can index unlimited videos, which exceeds Chrome's default 5MB quota. All data stored locally in your browser.
• alarms: To enable auto-sync and periodic license validation. Triggers background tasks at scheduled intervals. No data access (scheduling only).
• contextMenus: Adds a "Search Liked Videos" item to the right-click menu on YouTube pages. It only opens the search panel; it does not read selected text or anything else on the page.

Host Permissions

• https://www.googleapis.com/*: To communicate with YouTube Data API v3. Fetches your liked videos and their details, re-checks stored details in the background, and, only when you press Refresh, reads public channel numbers. Your liked videos are processed locally.
• https://*.youtube.com/*: To show the Ctrl+K search panel on YouTube pages. On a video page it reads the video ID from the page address to offer a note for that video, reads the player's current time only when you click Insert time, and moves the player only when you click a time in your note; at that moment it also reads the video's length, so it never reads or moves an ad. If a video is fullscreen when you press Ctrl+K, it leaves fullscreen so the search panel can show. It reads nothing else from the page.
• https://api.sophyte.com/*: To validate Pro licenses and start a Pro checkout. Activation sends the license key and device ID; the hourly check sends the device ID, extension version and token; a checkout sends only which button you pressed, then the Stripe checkout session ID to fetch your key. No video data.

Permissions We Do NOT Request

• tabs: We don't track your browsing history
• webRequest: We don't intercept network traffic
• cookies: We don't read or write cookies
• downloads: We don't access your downloads folder
• geolocation: We don't track your location

Third-Party Services & Data Sharing

We share data with the following third-party services ONLY as necessary to provide the extension's functionality:

• Stripe (Payment Processor): Email, name (optional), order details. When: Only when you purchase a Pro license. Privacy policy
• Resend (Email Delivery): Email address, name (optional). When: Only when sending your license key after purchase. Privacy policy
• Cloudflare (Infrastructure): License keys, device IDs, validation timestamps, IP addresses. When: Only when activating or validating a Pro license. Privacy policy
• Google (YouTube API Services): OAuth consent, API requests. When: Only when you authorize and sync liked videos. Privacy policy: http://www.google.com/policies/privacy

We Do NOT:

• Sell your data to third parties
• Share data with advertisers or marketers
• Use your data for purposes other than providing the extension
• Share data with analytics providers (we use no analytics)

How to Delete Data & Revoke Access

In addition to the normal deletion procedures below, if this API Client accesses or uses Authorized Data, you can revoke the API Client's access to your data via Google's security settings pages:

• https://myaccount.google.com/connections?filters=3,4&hl=en
• https://security.google.com/settings/security/permissions

Find the entry for this Extension and remove access. Google lists it as "Likes Search for YouTube" until the sign-in name changes, and as "Watchbook" after that. Revoking stops new API access. Deleting data stored by this Extension does not delete data stored by YouTube itself—use YouTube or Google Account tools for that.

Delete data stored by this Extension (local API Data)

• Use Disconnect in the extension popup — we revoke the OAuth token and purge locally stored liked-video API Data, your collections, your pins, channel statistics, and durable sync checkpoints as soon as possible (typically immediately; always within 7 calendar days), and remove each note's video link and title (the note's words stay; a note about a collection keeps the collection's name). The local date/units quota-safety record remains only until its Pacific-day rollover
• Uninstall the Extension — removes local videos, settings, and license state from that browser profile
• If the Extension can't use your Google connection for 48 hours (for example, you removed its access in your Google Account), it deletes the liked-video data stored on this device, with your collections and pins. If access is still missing after 28 days, it also removes the links between your notes and videos; the words you wrote stay. To time this, it keeps a small record on this device of when access was first found missing (a date only, never video data), removed as soon as access works again or you disconnect. A note about a collection keeps its words and the collection's name.
• If the Extension has not been able to finish a sync for 30 days while you're connected, it keeps trying, and if syncing still fails 48 hours later it clears local YouTube API Data, your collections and your pins to comply with YouTube API Developer Policies (each note keeps its video link through this clearing, so a later sync can match it again). To time this, it keeps a date on this device, removed when a sync succeeds.
• While you're connected, the Extension re-checks the stored details of your liked videos in the background, oldest first, so none are more than 30 days old, and it deletes them if it cannot sync for 30 days. It re-checks at most about 1,000 videos a day, and only while Chrome is open, so some details can be older than 30 days for a while in three cases: a library above about 25,000 liked videos; after days when Chrome was closed or open only briefly; and during the first re-check after this update, which takes about one day per 1,000 videos. It marks a video that YouTube no longer returns as unavailable.

Local Data Retention (In Your Browser)

• Retained until you Disconnect, uninstall the extension, or clear Chrome extension data
• Use Disconnect in the extension popup to clear your local liked-video cache while keeping a Pro license (if activated)
• Notes you write are kept until you delete them or uninstall the extension; Disconnect removes only each note's video link and title, and a note about a collection keeps the collection's name

Backend Data (On Our Servers)

• License keys: Retained indefinitely to prevent reuse after refunds
• Device activations: Retained while license is active
• Request logs: Our server host (Cloudflare) keeps brief request logs for troubleshooting and abuse prevention; our own log lines never contain a full license key
• Customer email/name: Retained for customer support and refund processing
• Deactivated devices: Soft-deleted (marked inactive but retained for audit)
• YouTube API Data: Never stored on our servers

How to Request Backend Data Deletion

To request deletion of your Pro license and backend data, email sophytedigital@gmail.com from the email address associated with your purchase. Include your license key in the email. We will respond within 30 days and:

• Deactivate your license within 24-48 hours
• Mark your license as deleted and retire every device bound to it, so it stops working on every device, and replace the email address and name we hold with an anonymous placeholder
• Note: License keys cannot be fully deleted to prevent fraudulent reuse

OAuth Tokens After Revocation

• Revocable at any time via the Google security settings links above
• Revoking access will prevent the extension from syncing new videos
• Locally stored video API Data (with your collections and pins) is removed when you Disconnect/uninstall, or automatically when Google access stays unavailable for 48 hours or the Extension cannot finish a sync for 30 days (after a further 48 hours of trying) (a note's video link is removed by Disconnect, uninstall, or Google access missing for 28 days)

Uninstalling the Extension

• Removes all local data (videos, settings, device ID)
• Does NOT automatically deactivate your Pro license
• To deactivate, email sophytedigital@gmail.com with your license key

Your Rights & Controls

You have the following rights regarding your data:

Right to Access

• Browse your indexed liked videos in the search overlay and review sync status in the extension popup
• Request a copy of backend data (license activations) via sophytedigital@gmail.com

Right to Deletion

• Delete local liked-video data via Disconnect in the extension popup, or by uninstalling
• Delete notes you wrote from the Notes tab in the Workbench, or by uninstalling
• Request deletion of backend data via sophytedigital@gmail.com

Right to Revoke Consent

• Revoke YouTube access via Google Account connections or Google security settings
• Deactivate Pro license by contacting support

Right to Data Portability

• Your liked-video index is stored locally in your browser (not on our servers), so we cannot export a server-side copy of it
• You can export your local library yourself (CSV, JSON, Markdown, or NotebookLM link lists; the free plan gets one preview export of up to 50 videos, Pro has no limit); files are generated on-device and saved only to your computer
• Every user can copy or download their notes as Markdown from the Workbench; the file is generated on-device and saved only to your computer
• For a copy of Pro license records associated with your purchase email, contact sophytedigital@gmail.com

Right to Object

• Opt out of auto-sync to prevent periodic API requests
• Deactivate license to stop backend validation

GDPR Rights (EU Residents)

If you are an EU resident, you have additional rights under GDPR:

• Right to rectification (correct inaccurate data)
• Right to restriction of processing
• Right to lodge a complaint with a supervisory authority

Contact us at sophytedigital@gmail.com to exercise any of these rights.

California Residents (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended effective January 1, 2026:

Categories of Personal Information Collected

• Identifiers: Email address, device ID (UUID), license key
• Internet Activity: OAuth access tokens (held by Chrome on your device), brief server request logs, operating system platform, extension version
• Commercial Information: Purchase history, order details, refund status

Categories Shared with Service Providers/Contractors

• Stripe (Payment Processor): Email, name, order details
• Resend (Email Delivery): Email, name (optional), license key
• Cloudflare (Infrastructure): License keys, device IDs, IP addresses, validation timestamps
• Google (YouTube API): OAuth tokens, API requests

Your CCPA Rights

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to Delete: You can request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: We do NOT sell your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

No Sale of Personal Information

We do NOT sell, share, or rent your personal information to third parties for monetary or other valuable consideration.

How to Exercise Your CCPA Rights

To exercise your CCPA rights, email sophytedigital@gmail.com from the email address associated with your account. We will verify your identity and respond within 45 days.

Security Measures

We take the following measures to protect your data:

Local Data Security

• Stored in Chrome's isolated storage (protected from other extensions)
• No plaintext passwords or sensitive credentials stored

Backend Security

• HTTPS/TLS encryption for all API requests
• JWT tokens for authenticated license validation
• Device IDs are randomly generated UUIDs (not tied to personal info)
• Cloudflare DDoS protection and rate limiting

OAuth Security

• OAuth tokens managed by Chrome's secure identity API
• Tokens encrypted and isolated by Chrome
• No manual token handling in extension code

Incident Response

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours via email. The notification will include: what data was affected, when it occurred, steps we're taking, and steps you should take.

Children's Privacy

The extension is not directed at children under 16. We do not knowingly collect personal information from children. If you are under 16, please do not use this extension. If you believe we have inadvertently collected information from a child under 16, please contact us immediately at sophytedigital@gmail.com.

International Data Transfers

Our backend servers (Cloudflare Workers) may process data in various regions globally. By using the extension, you consent to the transfer of your data to the United States and other countries where Cloudflare operates.

For EU users: We rely on Cloudflare's compliance with EU-US Data Privacy Framework and Standard Contractual Clauses for international data transfers.

Changes to This Policy

We may update this policy to reflect changes in functionality, legal requirements, or our data practices. Significant changes will be communicated via:

• Extension update notes in the Chrome Web Store
• Email (if you are a Pro license holder)

Your continued use of the extension after changes constitutes acceptance of the modified policy.

Contact Us

If you have questions about this privacy policy or your data, contact us:

Sophyte Digital LLC
Sheridan, Wyoming, USA
Email: sophytedigital@gmail.com

For privacy-specific inquiries, use subject line: "Privacy - Watchbook"

Support page: https://sophyte.com/youtube-likes-search