Privacy Policy

What this product does

Video To Blog MCP is a hosted service that lets a user sign in with Google, connect a YouTube channel, and use supported AI clients to read from and write to that channel through the official YouTube APIs.

Data we collect

• Basic account session data needed to keep a user connected inside the website.
• YouTube channel identifiers, channel titles, and connection records tied to the authenticated user session.
• Encrypted OAuth credentials needed to call the YouTube APIs on behalf of the connected channel.
• OAuth authorization records, access tokens, and refresh tokens needed to let ChatGPT and other supported MCP clients call the hosted service on behalf of the user.
• Operational logs needed to debug failures, secure the service, and understand product usage.

How we use data

• Authenticate a user and keep the connected channel available for future MCP requests.
• Call the official YouTube APIs to read and write channel data when the user or their MCP client asks us to.
• Secure the service, prevent abuse, and investigate operational issues.
• Improve the product and documentation.

OAuth credentials and tokens

Google OAuth credentials are used only to access the connected YouTube account. OAuth tokens are stored encrypted at rest. Browser sessions and MCP access tokens are used to authenticate the user and supported MCP clients to the hosted service.

How we protect sensitive Google and YouTube data

We protect Google OAuth tokens and connected-channel data with technical and organizational safeguards designed for the sensitivity of that information. Google OAuth access and refresh tokens are encrypted before they are written to the application database using AES-256-GCM authenticated encryption with a fresh initialization value for each encryption operation. The encryption secret is kept in server-side configuration and is not stored in the OAuth-token database records.

Connections are bound to the authenticated user who created them. The service checks that relationship before using a channel connection, and OAuth credentials are decrypted only in server memory immediately before a requested Google API call. They are not sent to MCP clients or exposed in the website interface. Application session and MCP authorization credentials are stored as one-way hashes, and website session cookies are HTTP-only, secure in production, and use a same-site policy.

Data is transmitted between a user's browser, our hosted service, and Google over HTTPS. Access to production infrastructure and server-side secrets is limited to the personnel and systems that need it to operate, secure, or support the service. We review and restrict access as part of normal operations and investigate suspected unauthorized access or security incidents.

Google user data sharing and disclosure

We do not sell, rent, or disclose Google user data to advertisers, data brokers, or other users. We share or transfer it only with the service providers required to operate Video To Blog MCP on the user's behalf: Google, to authenticate the user and make the requested YouTube API calls; Supabase, to securely store encrypted connection records and OAuth credentials; and Vercel, to host the service and process security and operational logs. These providers may process data only as needed to provide those services to us. We do not use Google user data for advertising, creditworthiness, or training unrelated models.

We may also disclose information when required by law or to protect the security, integrity, and rights of the service and its users. We never give another YouTube MCP user access to a connected channel's Google user data.

Retention and deletion

Connection records, OAuth authorization metadata, and operational records may be retained as long as reasonably necessary to operate and secure the service. A user can disconnect a channel at any time; this deletes its stored Google OAuth tokens and connection record. A user can also delete their account from the connection page; this deletes the account's stored connections, OAuth tokens, application sessions, API credentials, uploaded assets, and associated operational records.

Contact

Privacy requests and questions can be sent through the contact form.