Privacy policy

Data we collect

PodSwiper uses Google sign-in and YouTube API Services. We store your Google account ID, name, email, and profile picture. Connecting YouTube adds authorization credentials and granted permissions, your subscription list and the public metadata of videos from channels you select, your channel selection, your save and skip decisions, and the ID of the playlist PodSwiper creates. We never receive your Google password.

How we use it

We use this data to sign you in, build your feed, remember your decisions, and save videos to your private playlist. Essential cookies secure sign-in, keep you signed in for up to 30 days, and remember your theme. We do not collect device identifiers, location, or usage analytics.

Video titles, thumbnails, and channel names shown in PodSwiper are YouTube content served through YouTube API Services. Stored YouTube data is refreshed or deleted within 30 days. Playing a video opens it on YouTube, where Google’s policies apply.

Who we share data with

We do not sell Google user data, and we do not share, transfer, or disclose it to advertisers, data brokers, or anyone else for their own purposes. It is never used to train or improve AI or machine learning models, whether ours or anyone else’s. Google user data is disclosed only to the following parties, and only to the extent needed to run PodSwiper:

• Neon (Neon Inc.) hosts our Postgres database and therefore stores your profile, YouTube credentials, channel selection, video metadata, and decisions on our behalf.
• Vercel (Vercel Inc.) hosts and runs the PodSwiper application, so data passes through its infrastructure while your requests are processed.
• Google and YouTube receive the requests needed to sign you in, read your subscriptions and channel uploads, and add or remove videos in your PodSwiper playlist. Their handling of that data is governed by the Google Privacy Policy.

These providers act as processors under our instructions and may not use your data for anything else. Beyond them, we disclose data only when required by law, to enforce our terms, or to protect the security of the service, and we tell you when the law allows it. If PodSwiper is ever transferred to a new owner, your data would remain subject to this policy. Google API data use and transfer follow the Google API Services User Data Policy, including Limited Use requirements.

How we protect your data

YouTube authorization credentials are sensitive, and we treat them accordingly:

• Encryption in transit. Every connection between your browser and PodSwiper, between PodSwiper and Google, and between PodSwiper and our database uses TLS.
• Encryption at rest. The database is encrypted at rest by Neon. Credentials are stored only there, never in logs, browser storage, or backups outside the database.
• Minimal access. We request only the scopes PodSwiper needs, use short-lived access tokens that are refreshed on the server, and never expose credentials to your browser or to third parties. Credentials are used solely to perform the actions described above.
• Restricted staff access. Only the developer operating PodSwiper can access production systems, protected by multi-factor authentication and secrets kept out of the code base.
• Session security. Sign-in uses cryptographically signed, HTTP-only, same-site cookies, and every change to your account is checked against the origin of the request.
• Prompt deletion. Disconnecting YouTube revokes PodSwiper’s access with Google and deletes stored credentials within 7 days. Deleting your account removes them immediately.

If we ever learn of a breach affecting your data, we will notify you and the relevant authorities without undue delay, as required by applicable law.

Your control

From your account page you can disconnect YouTube, which revokes PodSwiper’s access and deletes stored credentials and your subscription data within 7 days while keeping your decisions, or delete your account, which revokes access and removes your profile, credentials, channel selection, and decisions immediately. Deleting your account does not remove videos or playlists from YouTube; manage those on YouTube. You can also revoke access in your Google account permissions.

Depending on applicable law, you may also access, correct, or export your data, restrict or object to processing, withdraw consent, or complain to a data protection authority.

Contact

For privacy questions, complaints, or data requests, email mail@kesch.dev or use the contact page.