Privacy Policy

Last updated: 2026-10-23 (test operation) · 한국어

1. Information we collect

• Email and name from Google sign-in (to identify your account)
• Your YouTube subscription list, read through the YouTube Data API, and the public information of those channels (title, description, recent upload titles, subscriber count, thumbnail, country, topic categories)

We do not read watch history, comments or likes. The only permission requested is youtube.readonly; we never add or remove subscriptions on your behalf.

2. How we use it

Only to categorize your subscribed channels into a taste code and interest tags, and to show shared interests and recommended channels with other users. The taste code, categories and tags are chchu’s own analysis, not data provided by YouTube.

3. Retention and deletion

• Your subscription list (authorized data) is deleted immediately when you disconnect the YouTube account or delete your account (“Delete account” at the bottom of the dashboard). Account deletion also erases your email, name, recommended channels and profile (YouTube API Services Terms III.D.2.3.a — within 7 days).
• If you revoke access from your Google Account settings instead, the connection and subscription data are deleted within 7 days.
• Public channel information is refreshed or deleted every 30 days (III.E.4.d).
• OAuth tokens are stored encrypted; on disconnect or account deletion we send a revocation request to Google and delete them.
• Database backups for disaster recovery are stored encrypted in the AWS Seoul region and used only for recovery. Deleted data disappears from backups within 14 days at most, when those backups expire.
• We may count views of a public profile link as daily totals only (currently only the operator’s own public profile). We do not store who viewed it (no IP, cookie or device information), and the counts are deleted within 30 days, or immediately when the link is turned off or the account is deleted.

4. Third parties

Channel categorization and interest-tag translation use an external language-model API (Anthropic Claude). Only public channel information (title, description, recent upload titles) and tag words derived from it are sent — never your email, your full subscription list or tokens. The API is used under terms where request data is not used for model training.

Parental-consent emails for children under 14 (§8) are sent through an email delivery service (Resend). Only the recipient’s (the guardian’s) email address and the message body containing the consent link are passed to it; the child’s and guardian’s names are not included. We do not otherwise share or sell data.

Service data (accounts, subscription snapshots and encrypted tokens) is stored on Amazon Web Services servers in the Seoul region (Lightsail). AWS provides hosting only.

5. Google API Services User Data Policy (Limited Use)

chchu’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We also comply with the YouTube Terms of Service and the Google Privacy Policy. You can also revoke access at the Google Account permissions page.

6. How we protect your data

Information received from your Google account (email, name, subscription list, OAuth tokens) is protected as follows.

• Encryption in transit: all traffic between your browser and our servers, and between our servers and Google APIs, is sent over HTTPS (TLS) only.
• Encryption at rest: OAuth access and refresh tokens are encrypted on the server with symmetric authenticated encryption (AES-128-CBC + HMAC, Fernet) before being written to the database; they are never stored in plain text. The encryption key is kept only as a server environment variable, separate from the database.
• Access control: the database lives on an internal network that is not reachable from the internet, and each user’s data can only be read through that user’s own signed session (JWT). The operator dashboard is restricted to designated admin accounts and does not expose any individual user’s subscription list or tokens.
• Data minimization: we request a single read-only scope and delete data without delay after the periods in §3, on disconnect, or on account deletion.
• Incident response: if we become aware of a data breach, we notify affected users by email without undue delay, ask Google to revoke the affected tokens, and delete them.

7. Cookies and device storage

chchu places cookies and browser local storage (localStorage) on your device only for the purposes below. We use no advertising or tracking cookies and no third-party analytics scripts.

• Sign-in session cookie (chchu.session-token, httpOnly): keeps you signed in; removed on sign-out or expiry. During sign-in, Auth.js briefly sets CSRF and callback protection cookies.
• Language cookie (lang, 1 year): remembers your display language.
• Local storage: display preferences such as dark mode (theme), sidebar collapse (sidebar) and an admin-panel collapse state. These stay on your device and are never sent to our servers.

Clearing cookies and site data in your browser signs you out and resets display preferences; it does not affect data held on our servers. We never store your subscription list, email or tokens in these browser storages.

8. Children under 14

• Since October 17, 2026 we are not accepting new users under 14, and we do not collect a guardian’s name or email. YouTube blocks access to subscription data for supervised accounts, so the service cannot be used with them. The procedure below applies if we start accepting them again.
• Children under 14 may use the service only with the consent of a legal guardian (such as a parent), as required by Article 22-2 of the Korean Personal Information Protection Act. We ask for age before Google sign-in, and for children under 14 we accept neither Google sign-in nor a YouTube connection until consent is confirmed.
• To ask for consent we collect only the guardian’s name and email from the child, used solely to send the consent request and confirmation emails.
• Verification: we email the guardian a one-time consent link; when the guardian confirms on that page that they are the legal guardian and presses [I agree], we record the time, IP address and browser information and send a confirmation email. If the child’s Google account email is the same as the guardian’s email, we do not accept it as consent and delete the request.
• The guardian may refuse consent. If they refuse, the child cannot use the service; there is no other disadvantage.
• Retention: the guardian’s name and email are deleted immediately if consent is declined, or once 7 days pass without consent or without the child signing in after consent. The consent record is kept as evidence while the child’s account exists and is deleted with the account.
• The guardian can withdraw consent at any time from the link in the confirmation email; withdrawal immediately deletes the child’s account and data (§3). Requests to access, correct or delete the child’s information can be sent to the contact address below.
• During this process we briefly set an age-check cookie (chchu.age, 5 minutes, httpOnly) and a consent-request cookie (chchu.guardian-request, 7 days, httpOnly).
• Google accounts of children under 14 in Korea are usually supervised (Family Link) accounts, and YouTube may block access to their subscription data. In that case YouTube cannot be connected even after consent, and no subscription data is received.

9. Contact

prod.wtkim@gmail.com