Privacy
Last updated 13 September 2026
The short version
Runsheet stores your email, the metadata of videos you plan or publish, and a daily count of views on your own videos. It does not store your video files, it does not sell or share your data with anyone, and it does not use your YouTube data to train any model.
What we hold
- Your account. Email address and a hashed password, handled by Supabase Auth.
- Your channel connection. Your channel name, handle, avatar URL and public totals, plus OAuth tokens that let Runsheet act on your behalf.
- Your videos. Titles, descriptions, tags, schedule times, thumbnails URLs and YouTube video ids.
- Daily counts. One row per video per day recording views, likes and comments, so the product can show a trend rather than a lifetime total.
- Billing. If you subscribe, a customer and subscription identifier from Dodo Payments. Card details never reach Runsheet.
What we never hold
Your video files. When you publish through Runsheet, the file is uploaded from your browser directly to YouTube using a resumable upload session. The bytes do not pass through our servers and no copy is retained anywhere by us.
Google user data
Runsheet requests three YouTube permissions, and uses each of them only for the stated purpose:
- youtube.readonly to read your channel and videos, so the library, the runsheet and the analytics can show your own content back to you.
- youtube.upload to publish the videos you queue.
- youtube to set thumbnails and add your videos to your own playlists.
Runsheet’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google user data is never sold, never transferred to third parties except as needed to provide the product, and never used for advertising or to develop or improve generalised machine learning models.
How tokens are protected
Your OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, using a key held only in the server environment. They are decrypted in memory, for the duration of a single request, when Runsheet acts on your behalf. Every database table is row level secured so one account cannot read another’s rows even if it tried.
Deleting your data
Disconnecting a channel in Settings deletes its tokens and everything Runsheet recorded about it, immediately. You can also revoke Runsheet’s access at myaccount.google.com/permissions. To delete your whole account, email the address below and it is done within seven days. Your videos on YouTube are never touched by any of this.
Processors
Supabase hosts the database and authentication. Vercel hosts and serves the application. Dodo Payments handles payments. Resend delivers transactional email. Google receives the API calls that publish and read your channel. Nobody else.