Privacy Policy

Applies to: Unfold and its Google OAuth application OrbitUnfold Uploader.
Last updated: 13 November 2026

1. Who operates Unfold

Unfold is a private, non-public system operated by Thibault Cabuy, Belgium ("the operator", "we"). It is used exclusively to manage the operator's own YouTube channels OrbitUnfold, EverydayUnfold and NatureUnfold. Unfold has no other users and offers no accounts or services to the public.

2. Use of YouTube API Services

Unfold uses YouTube API Services (the YouTube Data API v3 and the YouTube Analytics API). By authorizing OrbitUnfold Uploader, the channel owner agrees to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy (www.google.com/policies/privacy).

3. Which data is accessed

Unfold only accesses data of the YouTube channel that was explicitly authorized through Google's consent screen. It does not request the Google account's e-mail address, contacts or any other Google product data.

Data	Examples
Channel identity	The channel ID and title of the authorized channel, used to confirm that Unfold is connected to the expected channel.
Videos uploaded by Unfold	The video file, title, description, privacy status, "made for kids" and "altered or synthetic content" declarations, and the upload/processing status returned by YouTube.
Public channel and video statistics	Subscriber, view and video counts of the channel; titles, publication times, status and view counts of the channel's own videos.
Aggregated YouTube Analytics reports	For the channel's own videos: views, engaged views, estimated minutes watched, likes, comments (counts only), shares, subscribers gained and lost, and views broken down by traffic source type, country, device type and content type.

YouTube Analytics data is aggregated by YouTube. Unfold does not receive information about individual viewers, does not read the content of comments and does not access other people's channels.

4. Permissions (OAuth scopes)

OrbitUnfold Uploader asks for the following Google OAuth scopes. Each channel is authorized separately by its owner.

Scope	Why it is needed
`https://www.googleapis.com/auth/youtube.upload`	Upload reviewed videos to the authorized channel.
`https://www.googleapis.com/auth/youtube.force-ssl`	Confirm the channel identity, read the status of the channel's own uploads and change their privacy status from private to public at the scheduled time.
`https://www.googleapis.com/auth/youtube.readonly`	Read public statistics and the list of the channel's own videos (read-only).
`https://www.googleapis.com/auth/yt-analytics.readonly`	Read aggregated YouTube Analytics reports for the channel's own videos (read-only).

Consent works through Google's standard OAuth 2.0 flow: the channel owner signs in on Google's own page, chooses the channel and approves the listed permissions. Unfold receives an access token and a refresh token from Google; it never receives the Google password.

5. How the data is used

To upload and publish the operator's own videos on the correct channel, and to verify that each upload was accepted and processed.
To prevent duplicate uploads (each upload is recorded and a second attempt for the same video is refused).
To monitor publication and channel performance on the operator's private dashboards.
To make private, descriptive comparisons (for example, which video formats are watched longer) that the operator may use when planning future videos.

The data is not used for advertising, is not sold, and is not used to build profiles of viewers.

6. Where and how data is stored

OAuth tokens are stored on the operator's private home server, in one directory per channel that is readable only by the operator's own system account (file mode 700). The upload program runs in an isolated container that cannot read other parts of the system's state.
Upload records (video ID and upload status per video) are stored in the same per-channel directories, to prevent duplicate uploads.
Statistics and analytics reports are stored in local files and a local SQLite database on the same home server, and are shown on the operator's private dashboards inside the operator's home network (including a copy for the operator's Home Assistant dashboard, which follows the same retention rules).
Backups of the operator's private monitoring database, which contains copies of these statistics and aggregated analytics, are kept on the operator's own devices (the home server's disks and the operator's own computer).

No Google or YouTube data is stored in, or synchronized to, any cloud storage service.

7. Who can access the data

Only the operator. The data is stored on the operator's own equipment and is not accessible to the public.

Google and YouTube data obtained through YouTube API Services is never sold, rented or used for advertising. It is shared only in the following ways:

Recipient	What and why
Google / YouTube	Through the official APIs, to perform the functions described above.
OpenAI (Codex)	Unfold's video production is assisted by OpenAI's Codex AI assistant, used through the operator's own ChatGPT subscription. To plan future videos, each production run includes, for the channel concerned, only channel totals for a recent period exactly as returned by the YouTube Analytics API (such as views, engaged views, watch time and subscribers gained) and Unfold's own editorial experiment plan. No video IDs, video titles or figures calculated by Unfold are sent. OpenAI processes this data under its own privacy policy.
Anthropic (Claude)	The operator uses Anthropic's Claude AI assistant to maintain and monitor the system. While doing so it can see stored statistics and system status (for example channel view counts). Anthropic processes this data under its own privacy policy.
Windsor.ai and vidIQ	The operator has historically used these third-party reporting services, which are connected to the channels with their own Google authorization, for analyses of the operator's own channels (for example in early November 2026, through the operator's AI assistant: daily and per-video views, engaged views, watch time, subscribers gained and lost, video titles). The automated Unfold production has never used these services. The retrieved results are stored on the operator's home server, used only for the operator's own editorial research, and handled according to section 9. The connections have not been removed: as of 13 November 2026, Windsor.ai lists all three channels as connected YouTube accounts, and vidIQ lists all three channels and can retrieve their channel statistics. The exact status of Windsor.ai's Google OAuth permission has not been tested separately. Each service processes data under its own privacy policy (Windsor.ai, vidIQ).

Figures such as ratios, per-day rates and medians are calculated by Unfold itself; they are not provided by YouTube. The operator may disclose information if required by law.

9. How long data is kept

Retention follows the YouTube API Services Developer Policies (section III.E.4):

OAuth tokens are kept for as long as they are needed to operate the authorized channel, and only for the purposes described above, until access is revoked or the authorization is replaced.
Statistics and YouTube Analytics reports (view, subscriber and video counts, and aggregated analytics) are kept for as long as they are needed for the channel's performance history, and only while Unfold's authorization keeps working: in normal operation Unfold uses it every hour to refresh these statistics.
Other YouTube data, such as video titles and publication times, is refreshed while the channel is authorized; stored copies older than 30 days are deleted.
If authorization cannot be confirmed for 30 days (for example after access was revoked), all stored YouTube data of that channel is deleted.
Upload records (video ID and upload status) are kept to prevent duplicate uploads. A monthly check that re-confirms the authorization and re-reads the status of each uploaded video (removing the ID of any video that no longer exists) has been built but is not yet active; this section will be updated when it is.
Backups on the home server are rotated after 30 daily copies. Backup copies on the operator's own computer, if made, are kept for at most 30 days.

These rules are applied automatically by a daily retention job in Unfold (active since 13 November 2026, including the operator's Home Assistant dashboard copy) and in the operator's monitoring system (active since 13 November 2026).

10. Revoking access

The channel owner can revoke OrbitUnfold Uploader's access at any time on the Google security settings page (also reachable via myaccount.google.com/permissions). After revocation, Unfold can no longer upload videos or read data for that channel, and all stored YouTube data of that channel is deleted within 30 days (see section 9).

11. Deletion requests

To request deletion of data stored by Unfold, contact the operator at the address below. Requests are handled, and the data deleted, as soon as possible and at the latest within 7 calendar days, including the copies in the operator's dashboards, monitoring system and backups. Deleting data in Unfold does not delete any data stored by YouTube; videos on YouTube are managed in YouTube Studio.

12. Cookies and tracking

This website sets no cookies, contains no scripts, analytics, advertising or tracking, and loads no third-party content. Unfold itself has no public web interface. There is no third-party content or advertising in Unfold.

13. Changes to this policy

Changes are published on this page with a new "Last updated" date. Material changes in how Google or YouTube data is used will be described at the top of this page before they take effect.

14. Contact

Questions, complaints or deletion requests about Unfold and OrbitUnfold Uploader: thibault.cabuy@hotmail.com.