Privacy Policy

Our Privacy Commitment

Likes Search for YouTube is designed with privacy as a core priority. Your liked video data—including titles, descriptions, and thumbnails—remains stored locally in your browser and is never transmitted to our servers.

However, to provide Pro license validation and ensure the security of our licensing system, we do collect minimal information when you activate a Pro license. This privacy policy explains exactly what data is collected, how it's used, and your rights under GDPR, CCPA, and other privacy regulations.

Information We Collect

1. Data Stored Locally in Your Browser

The following data is stored ONLY in your browser using Chrome's storage APIs and IndexedDB, and is NEVER transmitted to our servers:

• Video Metadata: Video ID, title, description, channel name, channel ID, thumbnail URL, published date, date you liked the video, duration, view count, and status flags (deleted/private)
• Extension Settings: Auto-sync preferences, sync interval, display preferences (theme, hide deleted videos), and keyboard shortcuts
• Sync Metadata: Last sync timestamp, count of active/archived/total videos, and cached data for performance
• Starter tier users: Limited to 300 videos
• Pro tier users: Unlimited videos

This data remains on your device until you uninstall the extension, clear your browser's extension data, or use Chrome's "Clear browsing data" feature.

2. Data Sent to Our Backend (Pro License Validation Only)

If you purchase a Pro license, the following data IS transmitted to our backend servers (api.sophyte.com) for license validation:

• License Activation Data (sent once when activating):
  • License key (alphanumeric code in format YTL-XXXX-XXXX-XXXX)
  • Device ID (randomly generated UUID stored locally)
  • Browser name and version (e.g., "Chrome 120.0.0.0")
  • Operating system platform (e.g., "MacOS", "Windows", "Linux")
  • Extension version (e.g., "1.0.1")
• License Validation Data (sent hourly while extension is active):
  • Device ID
  • JWT token (issued after successful activation)
  • Timestamp of validation request

IMPORTANT: Your video data, search queries, and browsing activity are NEVER sent to our backend servers.

3. Data Collected by Third-Party Services

Stripe (Payment Processing)

When you purchase a Pro license, Stripe (our payment processor) collects:

• Your name and email address
• Payment information (credit card, Apple Pay, Google Pay, etc.)
• Billing address
• Order details and transaction history

We receive from Stripe: your email address, your name (optional, if provided), payment intent ID, and payment status (paid, refunded, etc.). We do not have access to your full payment card details.

How we use your email:

• Storage: We store your email address in our secure database (Cloudflare D1, encrypted at rest)
• License Key Delivery: We send you an automated email with your license key immediately after purchase (via Resend)
• Customer Support: We may use your email to respond to support requests or refund notifications
• No Marketing: We do NOT use your email for marketing, newsletters, or promotional purposes
• No Sharing: We do NOT share your email with third parties (except Resend for email delivery)
• Data Deletion: You can request deletion of your email at any time by contacting support@sophyte.com

Stripe's privacy policy: https://stripe.com/privacy

Google (OAuth Authentication & YouTube Data API)

When you authorize the extension to access your YouTube liked videos, Google collects:

• Your consent to grant access to the youtube.readonly scope
• Authentication tokens (managed by Chrome, never visible to us)
• API usage logs (managed by Google)

The extension requests the following OAuth scope:

• https://www.googleapis.com/auth/youtube.readonly - Read-only access to your YouTube account data

This scope allows the extension to:

• Fetch your list of liked videos
• Access video metadata (title, description, thumbnail, duration, view count, etc.)

Google's privacy policy: https://policies.google.com/privacy

Cloudflare (Infrastructure)

Our backend API is hosted on Cloudflare Workers. Cloudflare may collect:

• IP address (for DDoS protection and performance)
• Request timestamps and HTTP headers

Cloudflare does NOT have access to your video data (it remains local in your browser).

Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

How We Use Your Information

Local Video Data (Stored in Browser)

• To provide instant search functionality across your liked videos
• To enable filtering by channel, date, duration, and other attributes
• To sync your video index when you enable auto-sync
• To preserve your archive and organizational preferences

License Validation Data (Sent to Backend)

• To verify the authenticity of Pro license keys
• To enforce device limits (Pro licenses allow up to 3 devices)
• To prevent unauthorized sharing or resale of licenses
• To provide customer support and process refunds
• To detect and prevent fraud or abuse

OAuth Tokens (Managed by Chrome)

• To authenticate API requests to YouTube Data API v3
• To fetch your liked videos list on your behalf
• Tokens are managed by Chrome's identity API and never sent to our backend

We Do NOT Use Your Data For:

• Advertising or marketing purposes
• Selling to third-party data brokers
• Building user profiles or behavioral analytics
• Training AI/ML models
• Any purpose other than providing the extension's core functionality

Google API Services & YouTube Data

YouTube Data API v3 Usage

The extension uses Google's YouTube Data API v3 to access your liked videos. Here's how it works:

1. Authentication: You click "Sync Liked Videos" → Chrome displays Google's OAuth consent screen → You grant permission → Chrome securely stores an OAuth token
2. Data Fetching: The extension requests your liked videos from YouTube's servers using the OAuth token. This happens entirely in your browser.
3. Local Storage: Video metadata is stored in your browser's IndexedDB. YouTube's API responses never touch our backend servers.

Scopes Requested

• youtube.readonly - Read-only access to your YouTube account

Why This Scope Is Necessary

This scope is required to fetch your list of liked videos and their metadata. Without it, the extension cannot function. We request the narrowest scope possible—we do NOT request write access, upload access, or access to private information beyond liked videos.

Token Security

• OAuth tokens are stored in Chrome's secure token storage
• Tokens are encrypted and isolated from other extensions
• Tokens can be revoked at any time via Google Account settings
• We NEVER send tokens to our backend servers

Chrome Extension Permissions Explained

The extension requests the following Chrome permissions. Here's why each is necessary:

Required Permissions

• identity: To use Chrome's OAuth flow for Google authentication. Triggers Google sign-in and manages YouTube API tokens. Data accessed: OAuth tokens (managed by Chrome, not accessible to us).
• storage & unlimitedStorage: To save your video index and preferences locally. Pro users can index unlimited videos, which exceeds Chrome's default 5MB quota. All data stored locally in your browser.
• alarms: To enable auto-sync and periodic license validation. Triggers background tasks at scheduled intervals. No data access (scheduling only).
• contextMenus: To provide right-click "Search in Likes" functionality. Adds custom menu item when right-clicking on YouTube. Selected text processed locally.

Host Permissions

• https://www.googleapis.com/*: To communicate with YouTube Data API v3. Fetches liked videos list and video metadata. Your liked videos processed locally.
• https://*.youtube.com/*: To integrate with YouTube website. Displays search overlay, detects page context. Accesses YouTube page DOM to show extension UI.
• https://api.sophyte.com/*: To validate Pro licenses. Sends license key and device ID for verification. Only license data sent (no video data).

Permissions We Do NOT Request

• tabs: We don't track your browsing history
• webRequest: We don't intercept network traffic
• cookies: We don't read or write cookies
• downloads: We don't access your downloads folder
• geolocation: We don't track your location

Third-Party Services & Data Sharing

We share data with the following third-party services ONLY as necessary to provide the extension's functionality:

• Stripe (Payment Processor): Email, name (optional), order details. When: Only when you purchase a Pro license. Privacy policy
• Resend (Email Delivery): Email address, name (optional). When: Only when sending your license key after purchase. Privacy policy
• Cloudflare (Infrastructure): License keys, device IDs, validation timestamps, IP addresses. When: Only when activating or validating a Pro license. Privacy policy
• Google (YouTube Data API): OAuth consent, API requests. When: Only when you click "Sync Liked Videos". Privacy policy

We Do NOT:

• Sell your data to third parties
• Share data with advertisers or marketers
• Use your data for purposes other than providing the extension
• Share data with analytics providers (we use no analytics)

Data Retention & Deletion

Local Data (In Your Browser)

• Retained indefinitely until you uninstall the extension or clear data
• You can delete all local data at any time via extension settings
• Clearing Chrome's extension data will also delete all indexed videos

Backend Data (On Our Servers)

• License keys: Retained indefinitely to prevent reuse after refunds
• Device activations: Retained while license is active
• Validation logs: Retained for 90 days for fraud detection
• Customer email/name: Retained for customer support and refund processing
• Deactivated devices: Soft-deleted (marked inactive but retained for audit)

How to Request Data Deletion

To request deletion of your Pro license and backend data, email sophytedigital@gmail.com from the email address associated with your purchase. Include your license key in the email. We will respond within 30 days and:

• Deactivate your license within 24-48 hours
• Mark your device activations as deleted
• Anonymize logs within 90 days
• Note: License keys cannot be fully deleted to prevent fraudulent reuse

OAuth Tokens

• Revocable at any time via Google Account settings
• Revoking access will prevent the extension from syncing new videos
• Locally stored video data will remain until you manually delete it

Uninstalling the Extension

• Removes all local data (videos, settings, device ID)
• Does NOT automatically deactivate your Pro license
• To deactivate, email sophytedigital@gmail.com with your license key

Your Rights & Controls

You have the following rights regarding your data:

Right to Access

• View all locally stored data via extension settings
• Request a copy of backend data (license activations, validation logs)

Right to Deletion

• Delete local data via extension settings or by uninstalling
• Request deletion of backend data via sophytedigital@gmail.com

Right to Revoke Consent

• Revoke YouTube access via Google Account settings
• Deactivate Pro license by contacting support

Right to Data Portability

• Export your video index as JSON or CSV (feature in development)

Right to Object

• Opt out of auto-sync to prevent periodic API requests
• Deactivate license to stop backend validation

GDPR Rights (EU Residents)

If you are an EU resident, you have additional rights under GDPR:

• Right to rectification (correct inaccurate data)
• Right to restriction of processing
• Right to lodge a complaint with a supervisory authority

Contact us at sophytedigital@gmail.com to exercise any of these rights.

California Residents (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended effective January 1, 2026:

Categories of Personal Information Collected

• Identifiers: Email address, device ID (UUID), license key
• Internet Activity: OAuth access tokens, API request logs, browser version, platform
• Commercial Information: Purchase history, order details, refund status

Categories Shared with Service Providers/Contractors

• Stripe (Payment Processor): Email, name, order details
• Resend (Email Delivery): Email, name (optional), license key
• Cloudflare (Infrastructure): License keys, device IDs, IP addresses, validation timestamps
• Google (YouTube API): OAuth tokens, API requests

Your CCPA Rights

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to Delete: You can request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: We do NOT sell your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

No Sale of Personal Information

We do NOT sell, share, or rent your personal information to third parties for monetary or other valuable consideration.

How to Exercise Your CCPA Rights

To exercise your CCPA rights, email sophytedigital@gmail.com from the email address associated with your account. We will verify your identity and respond within 45 days.

Security Measures

We take the following measures to protect your data:

Local Data Security

• Stored in Chrome's isolated storage (protected from other extensions)
• Uses browser's native encryption for storage
• No plaintext passwords or sensitive credentials stored

Backend Security

• HTTPS/TLS encryption for all API requests
• JWT tokens for authenticated license validation
• Device IDs are randomly generated UUIDs (not tied to personal info)
• Cloudflare DDoS protection and rate limiting

OAuth Security

• OAuth tokens managed by Chrome's secure identity API
• Tokens encrypted and isolated by Chrome
• No manual token handling in extension code

Incident Response

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours via email. The notification will include: what data was affected, when it occurred, steps we're taking, and steps you should take.

Children's Privacy

The extension is not directed at children under 16. We do not knowingly collect personal information from children. If you are under 16, please do not use this extension. If you believe we have inadvertently collected information from a child under 16, please contact us immediately at sophytedigital@gmail.com.

International Data Transfers

Our backend servers (Cloudflare Workers) may process data in various regions globally. By using the extension, you consent to the transfer of your data to the United States and other countries where Cloudflare operates.

For EU users: We rely on Cloudflare's compliance with EU-US Data Privacy Framework and Standard Contractual Clauses for international data transfers.

Changes to This Policy

We may update this policy to reflect changes in functionality, legal requirements, or our data practices. Significant changes will be communicated via:

• Extension update notes in the Chrome Web Store
• In-extension notifications
• Email (if you are a Pro license holder)

Your continued use of the extension after changes constitutes acceptance of the modified policy.

Contact Us

If you have questions about this privacy policy or your data, contact us:

Sophyte Digital LLC
Sheridan, Wyoming, USA
Email: sophytedigital@gmail.com

For privacy-specific inquiries, use subject line: "Privacy - YouTube Likes Search"

Support page: https://sophyte.com/youtube-likes-search