Privacy policy

Effective 12 September 2026 · Last updated 12 September 2026

1 Who this policy is from

vurctube is an independent open-source project maintained by Vurctne. In this policy, "vurctube" means the software, and "we" means the maintainers of that software. Contact: contact@vurctne.com.

This policy covers both the vurctube software and this website at vurctube.com.

2 What we collect

Nothing. We operate no service that could collect it. Specifically, vurctube does not send us your Google account details, your OAuth tokens, your channel or video data, your analytics, your comments, your captions, usage statistics, crash reports, or any other telemetry. There is no sign-up, so we do not hold an account record for you either.

3 How your Google data is handled

vurctube works through the official YouTube Data API, YouTube Analytics API and YouTube Reporting API. To use it, you create your own project in the Google Cloud console, create your own OAuth client inside that project, and authorize it against your own YouTube channel. That means:

• The OAuth client belongs to you, not to us. Google issues the tokens to your project.
• Your refresh token and client secret are written to a file on your computer, readable only by your user account. They are sent to Google when you first authorize the tool and each time it refreshes an access token, and to no one else. The maintainers of vurctube never receive them.
• Data the tool reads from YouTube (video metadata, comments, captions, statistics, analytics) travels between your machine and Google, and is then handed to the AI agent you chose to run vurctube with, such as Claude Code, Codex or another MCP client. What that agent does with it, including whether it sends it to a cloud model, is governed by that agent's own configuration and privacy policy, not by us. We are not in that path and cannot see it.
• Google's own handling of your account and of API traffic is described in the Google Privacy Policy.
• Copies the tool keeps on your machine, such as the backup it takes before changing a video's metadata so you can undo the change, are ordinary files in your own filesystem. Delete them whenever you like.

4 Limited Use

The software sends Google API data to no one except the agent you run it with, as described in section 3. It does not use your data for advertising, does not sell it, does not share it with any other third party, and does not use it to train any model. Google API data is used only to carry out the channel operation you asked for, on the machine you are sitting at.

5 What the software stores on your machine

• Credentials. Your OAuth client ID, client secret and refresh token, in a file created with owner-only permissions.
• Backups. The previous state of video metadata the tool changes, so a metadata edit can be put back. Some actions cannot be undone through the API, and the tool labels those before you approve them.
• A local database. A single file holding the records below, readable only by you. It is the only database in the product and it never leaves your machine.
• An audit log. A record of what the tool did, kept so you can review an agent's actions. The current prototype prints this to the terminal; a stored log is part of the planned release.

Retention. All of it lives in your filesystem, under your control. Today these files are kept until you delete them. Deleting local files changes nothing on YouTube.

The planned release treats three kinds of stored data differently, because Google's policies do:

• Content such as titles, descriptions, captions and comments: kept at most 30 days, then refreshed from Google or deleted.
• Statistics from the Analytics and Reporting APIs: may be kept longer, on condition that the tool periodically confirms your authorization still stands and that the video still exists.
• Your credentials: kept until you revoke or delete them.

These sweeps run when the tool runs, or on a schedule you install. On a machine that is switched off, nothing sweeps until it comes back, and the tool reports when a sweep is overdue.

6 Revoking access

You can disconnect vurctube from your Google account at any time at myaccount.google.com/permissions, and delete the local credential file. Because the OAuth client is inside your own Google Cloud project, you can also delete the client or the whole project, which revokes everything issued under it. Revoking access does not remove local backups or the audit log; delete those files too if you want them gone.

7 This website

vurctube.com is a set of static pages. It sets no cookies, runs no analytics and has no tracking scripts. It is served by Cloudflare, which handles the request as part of serving it under Cloudflare's privacy policy; we add no logging or analytics of our own on top of that. The pages load fonts from Google Fonts, which means your browser makes a request to Google's font servers when you visit, and we receive nothing from that request.

One more thing that is technically a server: when you authorize the tool for the first time, it briefly runs a tiny web server on your own computer, reachable only from that computer, to receive Google's authorization code. It shuts down as soon as the code arrives.

8 Children

vurctube is a developer tool for people who operate YouTube channels. It is not directed at children, and we do not knowingly collect anything from anyone, including children.

9 Changes to this policy

If this policy changes, the new version will be published on this page with a new "last updated" date. Because the software is open source, the change will also be visible in the project's history. If a future version collects a new kind of data, uses Google data for a new purpose, or shares it in a new way, the software will tell you and ask for your consent before doing so.

10 Contact

Questions about this policy: contact@vurctne.com.