We can only read, never write. The only Google permission we ever request is
youtube.readonly. We cannot upload, edit, delete, or change anything on your channels.
Your tokens are encrypted (AES-256-GCM) and used for exactly one thing: fetching your own channels' statistics for display to you.
We don't sell, share, rent, or transfer your data to anyone. No advertising, no analytics brokers, no third parties. Your estate data exists to be shown to you and to no one else.
From Google, with your explicit consent per channel: an OAuth refresh token (encrypted at rest), and your channels' public-facing data — title, handle, thumbnail, subscriber, video, and view counts.
From you, if you choose to enter it: estate records — notes, domains, registrar names, phone number lists, license locations, business names, and similar organizational data. You control every field; all of it is optional.
What we never collect: passwords, Google account credentials, private video content, viewer data, or anything about your audience members.
For exactly one purpose: showing you your own estate — its structure, statistics, history, and integrity. We do not use your data to train models, build profiles, serve ads, or derive any product beyond the one you're looking at.
Transferkeep's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used only to provide user-facing features of Transferkeep, is never sold, never used for advertising, and never read by humans except with your consent, for security, or as required by law.
Data is stored in Cloudflare's D1 database infrastructure. OAuth refresh tokens are encrypted with AES-256-GCM before storage; the encryption key is held as a separate secret, never alongside the data. Exports you generate (the "go-bag") deliberately contain no tokens or secrets.
Revoke at any time: every grant is visible and instantly revocable at myaccount.google.com/permissions — that master switch is Google's and yours, not ours.
Delete your data: contact us (below) and we delete your account's stored data — tokens, records, snapshots, all of it. Google-side revocation plus our deletion leaves nothing behind.
Export your data: the go-bag button gives you a complete machine-readable copy of your records at any time.
If this policy changes materially, we'll say so plainly on this page with a new effective date, and notify active users before the change applies to them.
Questions, deletion requests: hello@transferkeep.com