Privacy Policy
This policy explains what data The Untold Hour accesses, how it is used, and how it relates to Google user data accessed through the YouTube Data API.
Who operates this project
The Untold Hour is an independently operated content project. For any question about this policy or how the project handles data, contact support@courses4everyone.com.
What this application does
This application uses the YouTube Data API v3, authorized via Google OAuth, to upload video content to a single YouTube channel that the operator owns and controls. The application is used exclusively by its operator to publish that operator's own content — it is not distributed to, or used on behalf of, any other person or channel.
Google API Services User Data Policy. The Untold Hour's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What data is accessed
- An OAuth authorization token scoped only to uploading videos to the operator's own YouTube channel (the
youtube.uploadscope). - No other Google account data — contacts, email content, files, location, or any other Google service — is requested or accessed.
What is not collected
This application does not collect data from viewers of its videos. It does not use analytics or advertising trackers, and it does not sell or share any data with third parties.
Data protection and security
The OAuth client secret and refresh token used to authorize uploads are stored exclusively as encrypted secrets in our CI/CD provider's (GitHub Actions) secret store. They are encrypted at rest, are never written to source control, logs, or any database, and are only decrypted transiently in memory during an automated publishing run.
- Encryption in transit: All communication with Google's OAuth and YouTube Data API endpoints occurs exclusively over HTTPS/TLS.
- Encryption at rest: Credentials are stored using GitHub Actions' encrypted secrets storage, which uses libsodium sealed-box encryption; they are not stored in any other system.
- Access control: Only the project operator has access to these credentials. No third party, contractor, or additional service has access.
- No persistent user data storage: This application does not operate a database of Google user data. The only credential retained is the operator's own OAuth refresh token, used solely to re-authorize the operator's own upload requests.
- Revocation: The refresh token can be revoked immediately and at any time from the operator's Google Account permissions page, which immediately stops all future access.
Data retention
The OAuth refresh token used to publish videos is retained only for as long as the channel remains active and the automated publishing pipeline continues to run. It is not retained beyond that operational need, and is deleted/rotated if the pipeline is decommissioned. It can also be revoked at any time from the operator's Google Account permissions page.
Changes to this policy
This policy may be updated as the project evolves. The version in effect at any given time applies to that period.