Privacy Policy

GGAnalytics (the “Service”) is operated by Marchant Technologies LLC (“we,” “us,” or “our”). We provide analytics and planning tools for gaming YouTube creators. This Privacy Policy describes how we handle information when you use our website, dashboards, Chrome extension, and tools.

The Service uses YouTube API Services. By using features that connect your YouTube channel, you also agree to the YouTube API Services Terms of Service and Google's applicable policies, including the Google Privacy Policy.

We use Google user data only to provide and improve user-facing features you request. We do not use Google user data for advertising, and we do not sell Google user data.

Depending on how you use the Service, we may collect or process:

• Account data from Google Sign-In via Supabase Auth (for example, email address, display name, profile identifier, and session tokens stored in HTTP-only cookies).
• YouTube channel and analytics data you authorize through Google OAuth. The exact scopes we request are listed in the “Google OAuth scopes” section below.
• Workspace data you create inside GGAnalytics, such as Content Planner ideas and series, Subscriber Optimization (SPM) CTA strategy notes (category and custom text per video), and related productivity metadata stored in our database.
• Derived analytics snapshots we cache in our database to reduce YouTube API quota usage (for example, SPM reports, Series Optimizer diagnostics, Series Valuator summaries, Collaboration Matchmaker recommendations, and playlist catalogs), typically refreshed on a rolling basis.
• Keyword Lab queries you submit. Keyword research may use our server-side YouTube Data API key. Normalized keyword results may be stored in a shared cache (fresh for approximately 24 hours, with stale fallback up to approximately 7 days) to improve performance.
• Billing and subscription data when you purchase Creator Pro: Stripe customer ID, subscription status, plan interval, and billing period dates. Payment card numbers are collected and processed by Stripe; we do not store full card numbers on our servers.
• First-party product analytics for signed-in users (for example, upgrade modal impressions and clicks) to understand feature usage and improve the Service.
• Website usage analytics through Google Analytics 4 (GA4) on our web app, including pages visited, approximate location derived from IP address, device and browser type, referral source, and interaction events. GA4 may set cookies or use similar technologies to measure traffic and usage patterns.
• Technical logs from our hosting provider (for example, request timestamps, IP address, and error diagnostics) necessary to operate and secure the Service.

We do not sell your personal information. We do not use third-party advertising networks in the Service, and we do not use Google Analytics for cross-site advertising or retargeting.

Our Chrome extension runs on YouTube Studio pages you open in your browser. When you connect the extension to your GGAnalytics account, it may store a session handoff token in extension storage, call our authenticated API endpoints (for example, to confirm your account and load SPM summaries), and help you apply bulk edits you initiate inside YouTube Studio (such as descriptions, pinned comments, and Shorts related-video settings).

The extension does not run on sites other than those required for YouTube Studio productivity features and connection to our app. Edits you make through the extension are performed in your YouTube Studio session under your control; we do not upload your video files to our servers.

• Authenticate you and maintain your session.
• Display channel, video, playlist, and analytics insights in dashboards and tools you request.
• Save your planner content, CTA annotations, and cached analytics snapshots tied to your linked channel.
• Process subscriptions, deliver paid features, and manage billing through Stripe.
• Measure website traffic and product usage (including Google Analytics 4 and first-party analytics) to improve reliability and UX.
• Improve reliability, debug errors, prevent abuse, and comply with legal obligations.
• Respond to support or privacy requests you send us.

When you sign in with Google or grant YouTube access, we request the following OAuth scopes. These must match what is configured on our Google Cloud OAuth consent screen and in our app verification submission:

• OpenID Connect

  openid

  Authenticate your Google account and establish a secure session.

• Email address

  email

  Identify your account and send service-related communications.

• Basic profile

  profile

  Display your name and profile information in the Service.

• YouTube read-only

  https://www.googleapis.com/auth/youtube.readonly

  Read your channel metadata, playlists, and public video details to power dashboards and tools.

• YouTube Analytics read-only

  https://www.googleapis.com/auth/yt-analytics.readonly

  Read your channel analytics (views, subscribers gained, watch time, retention, thumbnail reach metrics) for creator insights.

• YouTube monetary analytics read-only

  https://www.googleapis.com/auth/yt-analytics-monetary.readonly

  Read estimated revenue metrics for revenue-related tools such as Series Valuator.

We request these scopes only to provide the features you use. We do not request write access to your YouTube channel, and we do not use these permissions for advertising or resale.

Certain data we process is sensitive, including Google OAuth refresh and access tokens, YouTube Analytics metrics (including estimated revenue where you grant monetary scope), billing identifiers linked to your subscription, and workspace content tied to your channel. We apply the following data protection mechanisms:

• Encryption in transit: All communication between your browser, our application servers, and third-party APIs uses HTTPS (TLS). We do not transmit OAuth tokens or analytics payloads over unencrypted channels.
• Encryption at rest for OAuth tokens: YouTube OAuth refresh and access tokens are encrypted using an application-managed encryption key (AES-256-GCM) before being stored in our database. Tokens are decrypted only on the server when needed to call YouTube APIs on your behalf.
• Access control and least privilege: Database tables that store user, channel, and workspace data are protected by Supabase Row Level Security (RLS) so authenticated users can access only data associated with their own account and linked channel(s). Administrative access to production data is limited to authorized operators and used only for support, security, and operations.
• Separation of credentials: Payment card data is collected and processed directly by Stripe; we do not store full card numbers on our servers. Stripe is PCI-DSS compliant.
• Data minimization: We request only the OAuth scopes needed for features you use, cache analytics snapshots only as long as needed for performance and quota management, and do not sell or use Google user data for advertising.
• Secure session handling: Authentication sessions use HTTP-only cookies managed by Supabase Auth. We do not expose long-lived OAuth refresh tokens to client-side JavaScript in the web application.
• Logging discipline: We avoid logging OAuth tokens, refresh tokens, or full analytics payloads in application logs. Operational logs may include request metadata (timestamps, error codes) necessary to secure and maintain the Service.
• Retention and deletion: Cached YouTube analytics payloads are refreshed on rolling schedules (typically fresh windows of approximately 24 hours, with stale fallback up to approximately 48 hours for most tools; Collaboration Matchmaker recommendations refresh approximately every 14 days). When you revoke Google access or request deletion, we delete or de-identify associated stored API and workspace data within seven (7) days where applicable under YouTube API policies, subject to legal retention requirements for billing records.
• Infrastructure providers: Application hosting (Render), database and authentication (Supabase), payments (Stripe), and analytics (Google Analytics) are used under their respective security and privacy programs. We select providers appropriate for handling creator account and analytics data.
• Incident response: If we become aware of a security incident affecting your personal information, we will investigate, mitigate, and notify affected users or regulators as required by applicable law. Report security concerns to [email protected].

No security measure is perfect. You are responsible for keeping your Google account secure, reviewing third-party access in your Google Account settings, and using the Service on trusted devices.

Application data is stored in a Supabase (PostgreSQL) database. The web application is hosted on Render. Sensitive protections—including OAuth token encryption, RLS policies, and deletion practices—are described in the “Protection of sensitive data” section above.

Row Level Security (RLS) policies in Supabase restrict workspace data so authenticated users can access data associated with their own account and linked YouTube channel(s). Authorized administrators may access limited operational data as needed to run and support the Service.

We share information only as needed to operate the Service:

• Google / YouTube — when you connect a channel or when our servers call YouTube Data API or YouTube Analytics API on your behalf using your authorized tokens.
• Google Analytics — website traffic and usage measurement on our web application. Google may process device, usage, and online identifier data as described in Google's analytics policies.
• Stripe — payment processing, subscription management, and fraud prevention. See Stripe's privacy policy for how Stripe handles payment data.
• Supabase — authentication, database hosting, and related infrastructure.
• Render — application hosting.

Stripe's privacy practices are described at stripe.com/privacy.

We may disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition with appropriate safeguards.

California residents: We do not sell personal information as defined under the California Consumer Privacy Act (CCPA).

We use Google Analytics 4 (measurement ID G-WQDX8FGPRF) on our website to understand how visitors find and use the Service (for example, page views, session duration, and general traffic sources). This helps us improve performance, content, and product decisions.

Google Analytics may collect information such as your IP address (which Google may use to derive approximate location), browser type, device information, pages viewed, and referring URL. Google may set first-party cookies or use similar technologies to provide these analytics. We do not use Google Analytics for advertising, remarketing, or selling visitor data.

You can learn how Google uses data from sites that use its services in How Google uses information from sites or apps that use our services. You may also install the Google Analytics Opt-out Browser Add-on or use browser controls to block or delete cookies.

We use essential cookies and similar storage mechanisms to keep you signed in (Supabase session cookies). The Chrome extension may use browser extension storage for connection state. These are necessary for authenticated features.

We also use analytics cookies and similar technologies through Google Analytics 4 to measure website traffic and usage. We do not use cookies for cross-site advertising or sell cookie data to third parties.

We retain account and workspace data while your account is active. Cached YouTube analytics payloads are refreshed periodically and may be retained for a limited window (for example, fresh cache windows on the order of 24 hours, with stale fallback windows up to approximately 48 hours) before being replaced by newer data. Collaboration Matchmaker peer recommendations may be cached for up to approximately 14 days. Keyword research cache entries may be retained up to approximately 7 days in stale form.

Billing records may be retained as required for tax, accounting, and dispute resolution after cancellation.

If you disconnect YouTube or delete your account, we will delete or de-identify associated data within a reasonable period, and in any event within seven (7) days of confirmed revocation or deletion request where applicable under YouTube API policies.

You can stop our access to your Google / YouTube data at any time by revoking GGAnalytics in your Google Account security settings:

Google security settings (third-party access)

Revoking access stops new API calls using your tokens. To request access, correction, or deletion of data we already stored, email [email protected]. We will respond to verified requests within a reasonable time and delete applicable stored API and workspace data within seven (7) days where required, subject to legal retention requirements.

If you are in the European Economic Area, United Kingdom, or other regions with data protection laws, you may have additional rights (such as portability or objection). Contact us at the email above to exercise those rights.

Some tools (for example, AdSense Calculator, Brand Deal Calculator, and Keyword Lab) can be used without signing in. Signed-in workspace features require a Google account. Subscriptions require you to be at least 18 years old (or the age of majority in your jurisdiction).

The Service is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

If you access the Service from outside the United States, your information may be processed in the United States or other countries where our providers operate. Those countries may have different data protection laws than your jurisdiction.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may be communicated through the Service where appropriate.

Marchant Technologies LLC — GGAnalytics

Questions or complaints about privacy practices: [email protected]