Privacy

The short version

Runsheet stores your email, the metadata of videos you plan or publish, and a daily count of views on your own videos. It does not store your video files, it never sells your data, and it does not use your YouTube data to train any model. It shares data only with the services that run the product, listed under Processors, and with AI apps you connect to it yourself.

The writing and thumbnail tools, and Cue, send what they need to Google’s Gemini API to produce an answer: the text you give them, and for Cue the parts of your channel data it reads to reply. Both are covered below, and neither is ever your video files.

What we hold

• Your account. Email address and a hashed password, handled by Supabase Auth.
• Your channel connection. Your channel name, handle, avatar URL and public totals, plus OAuth tokens that let Runsheet act on your behalf.
• Your videos. Titles, descriptions, tags, schedule times, thumbnails URLs and YouTube video ids.
• Daily counts. One row per video per day recording views, likes and comments, so the product can show a trend rather than a lifetime total.
• Billing. If you subscribe, a customer and subscription identifier from Dodo Payments. Card details never reach Runsheet.
• How you found Runsheet. The first page you opened here, the site that sent you (its address only, like instagram.com) and any campaign tag in the link, saved with your account when you sign up. See Cookies and tracking.
• How you use it. Which days you opened the app, when you hit a plan limit, when connecting YouTube did not go through and at which step, when a video already on YouTube was given its publish time, and when you opened a checkout, so we can see whether Runsheet is useful and where it gets in the way.

What we never hold

Your video files. When you publish through Runsheet, the file is uploaded from your browser directly to YouTube using a resumable upload session. The bytes do not pass through our servers and no copy is retained anywhere by us.

Google user data

Runsheet uses YouTube API Services. It requests up to four Google permissions, and uses each of them only for the stated purpose:

• youtube.readonly to read your channel and videos, so the library, the runsheet and the analytics can show your own content back to you.
• youtube.upload to publish the videos you queue.
• youtube to make the changes you ask for on your own channel: set thumbnails, add videos to your playlists, update a video’s title, description, tags and translations, publish a video now when you choose to, and delete a video from YouTube when you confirm it by typing its title, after a ten minute undo.
• yt-analytics.readonly, optional and asked for only when you connect YouTube Analytics, to read your own channel’s watch time, retention and click-through.

Connecting a channel means YouTube’s own terms apply alongside these: the YouTube Terms of Service and the Google Privacy Policy, which describes how Google handles your data.

Runsheet’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google user data is never sold, never transferred to third parties except as needed to provide the product, and never used for advertising or to develop or improve generalised machine learning models.

How tokens are protected

Your OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, using a key held only in the server environment. They are decrypted in memory, for the duration of a single request, when Runsheet acts on your behalf. Every database table is row level secured so one account cannot read another’s rows even if it tried.

Deleting your data

Disconnecting a channel in Settings deletes its tokens and everything Runsheet recorded about it, immediately. You can also revoke Runsheet’s access at myaccount.google.com/permissions. To delete your whole account, email the address below and it is done within seven days. Your videos on YouTube are never touched by any of this.

One record outlives an account, on purpose: that a YouTube channel has already unlocked the Free plan’s credits, so the same channel cannot unlock them again from a new account. It holds the channel’s YouTube id and nothing that identifies you.

The writing and thumbnail tools

Runsheet uses Google’s Gemini API for the tools that draft copy and the one that draws a thumbnail. When you use one, the text you give it is sent to Gemini to produce the answer. Inside the app that text can be your real video title, description or tags, because that is what you are asking it to work on.

What is recorded here is that a generation happened and what it cost in credits, so your balance can be kept. The text you typed is not stored. Thumbnails the designer draws are stored, on purpose, so you can attach one to a video later instead of paying to draw it twice. They are deleted with your account, and to have one removed sooner, email the address at the bottom of this page.

Nothing generated here decides anything about your channel. Every number Runsheet reports about your videos is measured from the YouTube API, not written by a model.

YouTube Analytics

If you connect YouTube Analytics, Runsheet reads your own channel’s watch time, average view duration, audience retention, subscribers gained and lost, and thumbnail impressions and click-through, and stores them to draw your charts and your Growth score. It reads only your channel, never your viewers’ identities, and the data is deleted when you disconnect the channel or delete your account.

Channels you watch, and rival alerts

When you watch a channel, Runsheet reads its public figures from YouTube with your own connection: its uploads, their view counts and its subscriber count. Those figures, and the breakout alerts made from them, are deleted after 30 days unless a refresh reads them again. A breakout alert can also be emailed to you; that email is on by default and switched off in Settings.

Cue, the assistant

When you ask Cue something, your message and the parts of your channel data it reads to answer (your schedule, your videos’ titles and view counts, your findings, and the public figures of channels you watch) are sent to Google’s Gemini API to write the reply.

Your conversations are kept so you can pick one up later, and you can delete any of them from Cue’s history at any time; all of them are deleted with your account. Figures about channels you watch are cleared from them after 30 days. Cue changes nothing on your channel by itself: every change it suggests waits as a card until you press Approve.

AI apps you connect

If you connect an AI app to Runsheet, such as Claude, ChatGPT or Cursor, that app receives the channel data its tools read, and it handles that data under its own privacy policy. You choose the channel and what the app may do on the approval screen, publishing now and deleting are never switched on for you, and you can disconnect an app in Settings at any time. Runsheet keeps only a hashed copy of each connection’s tokens and API keys, never the keys themselves.

IP addresses

The public thumbnail maker works without an account and allows a small number of exports a day. Counting them needs something to count against, so an export made without an account records the IP address it came from. It is used for that count and nothing else: not for analytics, not for location, not for building any profile.

The AI writing tools give a few free runs a day without an account, and counting those records a keyed hash of the network a run came from rather than the address itself. It is used for that count and nothing else.

Those records are deleted automatically after two days, which is longer than the daily count needs and short enough that nothing is kept for its own sake. Signing in replaces the IP floor with a real per-account allowance and no address is recorded at all.

Cookies and tracking

Runsheet sets the session cookie that keeps you signed in. It is strictly necessary, in the sense the law uses, because without it the app cannot tell who you are and there is no product.

Runsheet also uses Google Analytics to count visits and see which pages are useful. It sets its own cookies (named _ga) and tells Google the pages you open, the page that sent you, and your device, browser and approximate location, which Google works out from your IP address. It is never sent your name, your email, your channel data or anything you type. Advertising features are switched off, so none of it is used to show you ads. Google Analytics keeps this data for two months, then deletes it.

Runsheet itself remembers, in your browser’s local storage rather than a cookie, the first page you opened here, the site that sent you (just its address, such as instagram.com) and any campaign tag in the link. If you sign up, that is saved with your account once, so we can see which posts and videos bring people who stay. It is never your name, your email or anything about your channel, and nothing is sent anywhere if you do not sign up.

To stop it, install Google’s Google Analytics opt-out add-on or block cookies from google-analytics.com in your browser. The product works the same either way.

The footer of the public pages shows two badges, from Product Hunt and ShowMyProduct. They are images your browser loads from those sites, so each one learns your IP address and browser, and that the page asking is on this site (its address, not the page you are reading). Product Hunt’s host currently sets a short lived security cookie, named __cf_bm, that it uses to tell people from bots. Neither site is sent your name, your email or anything about your account.

There is no advertising pixel, no session recording and no other third-party script. The two typefaces are served from this domain rather than from Google, so loading a page does not tell Google that you did.

Processors

Supabase hosts the database and authentication. Vercel hosts and serves the application. Dodo Payments handles payments. Resend delivers transactional email. Google receives the API calls that publish and read your channel, and Google’s Gemini API receives the text you give the writing and thumbnail tools and what Cue reads to answer you. Google Analytics receives visit data (see Cookies and tracking). Beyond these, data goes only to AI apps you connect yourself.

Who holds this data

Runsheet is a Buildify product, operated as a sole proprietorship by Mahida Kalpesh Jayantilal. That is who is accountable for everything above.

Contact

Using the product, or a request about your data: kalpesh@buildifyapp.in
Billing, or a complaint you want escalated: kalpesh@buildifyapp.in