Privacy Policy

1. Scope

This policy covers Gikidi Viral, an internal tool that Gia Kiệm Số ("we") uses to publish educational videos to YouTube channels we own. It explains what data the tool accesses through YouTube API Services, why, where it is stored, and how it is deleted. Gikidi Viral uses YouTube API Services; use of the tool is also subject to the YouTube Terms of Service, and Google's handling of data is governed by the Google Privacy Policy.

2. Data we access and collect

When a channel owner connects a YouTube channel, Gikidi Viral accesses only:

• OAuth tokens issued by Google for the scopes youtube.upload, youtube.readonly and yt-analytics.readonly.
• The connected channel's ID, to make sure videos are published to the right channel.
• IDs and links of videos the tool uploaded, and whether each upload succeeded.
• Performance reports for those videos from the YouTube Analytics API (views, watch time, average view percentage, audience retention).

We do not access other users' channels, subscriber lists, comments of viewers, or any data about individual viewers. Members of our team sign in to the tool's dashboard with an email address; the dashboard uses cookies only to keep that session signed in.

3. How we use the data

• To upload videos and their titles, descriptions and thumbnails to the connected channel.
• To check that the connection still works and to show the channel's connection status to our team.
• To measure which of our own videos viewers find useful, so we can improve future videos.

We do not sell data, use it for advertising, or use it to train AI models.

4. Storage and security

• OAuth tokens are encrypted with public-key encryption (libsodium sealed boxes) before they are written to our database. The key that decrypts them exists only on the internal servers that publish videos, never in the web dashboard.
• Data is stored with our infrastructure providers: Supabase (database) and Cloudflare R2 (video files). Access is limited to members of the Gia Kiệm Số team.

5. Sharing

We do not share data obtained from YouTube API Services with third parties, except with the infrastructure providers above that store it on our behalf, or when required by law.

6. Retention and deletion

• Data obtained from the YouTube Data API is kept for no longer than 30 days; after that it is refreshed from the API or deleted.
• Reports obtained from the YouTube Analytics API are kept while the channel remains connected.
• When a channel is disconnected, or access is revoked, the tokens stop being used immediately and all data obtained for that channel is deleted within 30 days.
• A request to delete data can be sent to the contact below at any time; we complete it within 7 days.

7. Revoking access

A channel owner can revoke Gikidi Viral's access at any time on the Google security settings page: https://security.google.com/settings/security/permissions. After revocation the tool can no longer upload videos or read reports for that channel.

8. Changes to this policy

We update this page when the tool's data practices change and show the date of the latest update above.