YouAskTube

Privacy Policy

Effective date: 9 July 2026 · Last updated: 9 July 2026 · Version 1.0

This Privacy Policy explains what personal data we process when you visit youasktube.com (the “Service”), why we process it, how long we keep it, who we share it with, and the rights you have under applicable data-protection law (including the EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK GDPR). It covers both the optional e-mail signup for product updates and the account-less chat-with-video service. We will update the “Last updated” field above and notify confirmed signups before any material change becomes effective.

1.Who We Are (Data Controller)#

The Service is operated by BitVibe Labs, the trading name of an individual operator established in Greece (in the European Union), who is the data controller for the processing described in this Policy and is personally responsible for it. Payments for paid plans are handled by Gumroad, Inc. as merchant of record (a separate controller for the checkout data you give it). All data-protection enquiries should be sent to john@bitvibelabs.com. Dated revisions of this Policy are listed under section 18 below.

EU representative (Article 27 GDPR). The controller is established in the European Union (Greece), so the Article 27 obligation to designate an EU representative — which applies only to controllers not established in the Union — does not arise. EU/EEA data subjects may lodge a complaint with the supervisory authority of their Member State of habitual residence (the EDPB member list at edpb.europa.eu/about-edpb/about-edpb/members_en indexes every national authority); the operator’s own lead authority is the Hellenic Data Protection Authority (see section 10).

2.What the Service Collects#

This Policy covers two distinct contexts, which collect different data:

• Product-update signup. An optional double-opt-in e-mail signup for occasional product updates. This is the only context in which we collect an e-mail address.
• Chat-with-video. The service at youasktube.com/watch?v=… — an embedded player, YouTube transcripts, and a multi-turn AI chat over those transcripts, with daily message quotas and optional paid plans. It uses no accounts and no e-mail login; identity is a first-party cookie plus, for paid users, a licence key.

3.Lawful Bases#

• Consent — Article 6(1)(a) GDPR + Regulation 22(2) PECR. Where we offer an e-mail signup for product updates, submitting it is an unambiguous affirmative action, and the visible fineprint at the point of submission explains exactly what you are agreeing to. We then send a confirmation e-mail and you only stay on the list if you click the link in that e-mail (double opt-in). Both timestamps are stored (consent_timestamp at submit, confirmed_at at link-click). Subsequent product-update e-mails are sent on the basis of that confirmed consent. Consent can be withdrawn at any time via the one-click unsubscribe link in every e-mail.
• Contract — Article 6(1)(b) GDPR. Delivering the chat-with-video service you request — and, if you buy one, activating and maintaining your Pro or Max plan — is processing necessary to perform that contract. This covers storing your chat history and your paid-plan entitlement record.
• Legitimate interests — Article 6(1)(f) GDPR. Cloudflare edge logs (IP address, URL, user-agent), per-IP daily counters in ip_records, and signed session cookies are processed under our legitimate interest in operating the Service securely, preventing abuse, and enforcing daily message quotas. We have weighed these interests against your interests, rights, and freedoms and consider the processing proportionate.

4.Data We Collect — Product-Update Signup#

Category	Specifics	Where stored
Product-update signup	Your e-mail address (lowercased), a server-generated double-opt-in token, a server-generated unsubscribe token, plus consent-demonstrability metadata captured at the moment of submission: consent_timestamp (ISO 8601), consent_ip (the raw CF-Connecting-IP header — we do not currently hash this), consent_user_agent (raw User-Agent string), consent_origin (the HTTP Origin header), and confirmed_at (set when you click the confirmation link).	Cloudflare Workers KV. Pending records under notify:pending:<token> auto-expire after 48 hours. Confirmed records stored persistently under notify:<email> until you unsubscribe.
Network metadata	IP address, URL, referrer (if sent), User-Agent, timestamp — the standard request data Cloudflare records at its edge. We do not run any custom log pipeline (no Logpush, no analytics provider).	Cloudflare edge logs, retained per Cloudflare’s policy (typically ≤30 days for raw logs; aggregated metrics longer but unlinkable to identifiable visitors).
Outbound-mail counters	Per-day count of confirmation e-mails sent (no personal data, no recipient list). Used to stay below our Migadu daily outbound cap.	Cloudflare Workers KV under migadu:out:<YYYY-MM-DD>, 48-hour TTL.
E-mail correspondence	If you e-mail us, we receive your e-mail address and message contents.	Migadu (our mailbox provider, established in Switzerland).

The landing and signup page sets no cookies, runs no analytics, embeds no third-party tracking pixels, uses no fingerprinting, and does not write to localStorage or sessionStorage. Cookies are used only on the chat-with-video pages (see Section 7).

5.Data We Collect — Chat-with-Video#

The chat-with-video service is account-less: we do not ask for your name, e-mail, or a password to use it. The data below is what we store to run the chat, enforce quotas, and maintain paid entitlements.

Data	Fields	Purpose / where stored
Anonymous session cookie	yat_anon — a random, unsigned token. Not linked to any identity.	Chat continuity (grouping your messages in one conversation). First-party cookie.
Paid-plan entitlement	The Gumroad licence key you activate, its SHA-256 hash, the plan tier (Pro / Max), and re-verification timestamps. A signed first-party cookie (yat_ent) carries the key hash between requests.	Recognising your paid tier and re-verifying it with Gumroad. Cloudflare Workers KV, keyed on the key hash (ent:<hash>). No e-mail or name is stored.
Quota counters	Per-day paid-usage counts keyed on the licence-key hash (keyed_quota); a global model-call counter (gen_quota, no personal data); per-IP daily counters (ip_records: raw IP, day, chat count, cooldown).	Enforcing daily message quotas and short-circuiting abuse. Cloudflare D1.
Chats & messages	chats (anonymous session id, video_id, video_title, timestamps) and messages (role, content — the full text of your prompts and the AI’s replies, model, timestamp).	Your chat history for a video. Cloudflare D1.
Transcript cache	transcripts — the timestamped caption JSON for a video, plus title, channel, language, and fetch time. No personal data about you; shared across everyone who chats over the same video.	Avoiding a re-fetch on every chat. Cloudflare D1; re-fetched after 90 days.
Network metadata	IP address, URL, referrer (if sent), User-Agent, timestamp — the standard request data Cloudflare records at its edge.	Security and abuse prevention. Cloudflare edge logs, retained per Cloudflare’s policy.

We do not collect an e-mail address, name, password, or payment-card data for the chat service. Payment-card data is handled entirely by Gumroad (see Section 9); we never see it.

6.How We Use the Data#

• Signup → confirmation e-mail. We send a single double-opt-in confirmation message; you only stay on the list if you click the link within 48 hours.
• Confirmed e-mail → occasional launch updates. Low frequency (a handful per year), exclusively about the Service or other BitVibe Labs products. One-click unsubscribe in every e-mail.
• Chat input → AI response. Your prompt and the cached transcript are sent to our LLM provider (OpenRouter, which serves the GLM-5.2 model developed by Z.ai); the response is stored in messages and returned to your browser.
• IP + per-IP counters → quota and abuse prevention. IPs are checked against ip_records to enforce daily message limits and to short-circuit obvious abuse (denial-of-service, automated scraping).
• Aggregate operational metrics (request volumes, error rates, slow paths) — for capacity planning and reliability. These metrics are not linked back to identifiable individuals.
• Responding to enquiries sent to john@bitvibelabs.com.
• Compliance. Responding to lawful requests from supervisory authorities, courts, or law enforcement; enforcing our Terms.

7.Cookies & Similar Technologies#

The landing and signup page sets no cookies and writes nothing to localStorage, sessionStorage, IndexedDB, or any client-side identifier. The chat-with-video pages set up to two first-party cookies:

Name	Type	Purpose	Lifetime
yat_anon	First-party, unsigned random token.	Chat continuity only — grouping your messages in one conversation. Never used for quota or identity.	Up to 30 days.
yat_ent	First-party, HMAC-signed.	Carries your paid-plan entitlement (the licence-key hash and tier) between requests, so a paid tier cannot be forged.	Up to 30 days.

Both are strictly-necessary cookies, exempt from the consent requirement under PECR Regulation 6(4) and Article 5(3) ePrivacy Directive: they are essential to deliver the chat continuity and the paid tier you explicitly requested. We do not use advertising, analytics, fingerprinting, or any other non-essential client-side identifier.

8.Retention#

Data	Retention
Pending signup tokens (notify:pending:<token>)	48 hours, then auto-expire from KV.
Confirmed signup records (notify:<email>)	Until you unsubscribe via the one-click link or e-mail us to be removed. May be deleted earlier as part of periodic re-permission checks for long-inactive subscribers, per ICO direct-marketing guidance.
Migadu outbound counters	48 hours.
Cloudflare edge logs	Per Cloudflare’s retention policy (typically ≤30 days for raw logs).
Migadu mailbox logs (transactional + inbox)	Per Migadu’s policy; transactional message envelopes are typically purged within 30 days.
Paid-plan entitlement (ent:<hash>, KV)	While your plan is active and during the re-verification window; removed once the subscription lapses and can no longer be verified with Gumroad.
Chat history (chats + messages)	Anonymous chat history is auto-purged after 30 days.
Quota counters (keyed_quota, ip_records, gen_quota)	Rolling daily windows; rows older than 30 days are purged.
Transcript cache (transcripts)	Up to 90 days per video, then re-fetched on next chat.
OpenRouter API call logs	Per OpenRouter’s policies, prompts and responses may be retained by OpenRouter and the model provider (Z.ai) for a limited period for abuse-monitoring. See openrouter.ai/privacy.

9.Subprocessors#

The Service relies on the following third parties. Each operates under its own privacy notice and (where applicable) a data-processing agreement with us:

• Cloudflare, Inc. (USA) — hosts the static pages and Workers Functions, terminates TLS, stores KV records and D1 rows at the edge, and provides edge logging plus WAF / Bot Fight Mode. Cloudflare’s Data Processing Addendum (current version 6.3, 20 June 2025) is incorporated by reference into our Cloudflare service agreement. Cloudflare Privacy Policy · Cloudflare DPA.
• Migadu-Mail GmbH (Switzerland) — SMTP for the double-opt-in and unsubscribe e-mails on our product-update list, and our inbound mailbox. Switzerland benefits from an EU adequacy decision, so EU/UK–Switzerland transfers do not require a separate instrument. Migadu Privacy Policy.
• OpenRouter, Inc. (USA) — routes your chat messages plus the cached transcript to the AI model that generates replies. The model is GLM-5.2, developed by Z.ai. We send OpenRouter your prompt and the transcript text; we do not send it your name or e-mail (we hold none). OpenRouter Privacy Policy.
• Supadata (supadata.ai) — our primary third-party transcript provider, called server-side to retrieve a video’s publicly-available captions. We send it only the public video identifier; we do not send it any information about you. Governed by its own terms and privacy notice.
• TranscriptAPI (transcriptapi.com) — our fallback transcript provider, called server-side when Supadata cannot return a transcript. As with Supadata, we send it only the public video identifier and no information about you. Governed by its own terms and privacy notice.
• Gumroad, Inc. (USA) — our merchant of record for the Pro and Max plans. Gumroad processes your payment and issues and verifies the licence key; we never receive or store your payment-card details. The personal data you give Gumroad at checkout is processed under Gumroad’s own privacy policy. Gumroad Privacy Policy.
• YouTube / Google LLC (USA) — the video page embeds YouTube’s privacy-enhanced player (youtube-nocookie.com). When you press play, your browser contacts Google/YouTube directly, and Google may receive your IP address and player-interaction data under Google’s own privacy policy — a browser-to-Google flow we do not mediate (see Section 16). We do not otherwise send user-identifying information to YouTube. Google Privacy Policy.

We do not currently use any analytics provider (no Google Analytics, no Plausible, no Cloudflare Web Analytics, no Mixpanel), no behavioural-advertising network, and no fingerprinting service. If we introduce any new subprocessor we will update this section and, for material additions, notify confirmed signups before the change takes effect.

10.Your Rights#

Subject to certain exceptions, you have the following rights under the GDPR and the UK GDPR:

• Access — obtain confirmation of whether we process your personal data and a copy of it (Art. 15).
• Rectification — have inaccurate data corrected (Art. 16).
• Erasure — have your data deleted where one of the listed grounds applies (Art. 17).
• Restriction — restrict processing in certain situations (Art. 18).
• Data portability — receive structured, machine-readable data and have it transmitted to another controller (Art. 20). Your chat history is visible in the browser for your current session identity, and you can request a machine-readable copy of the limited data we hold about you by e-mailing us; we fulfil such requests manually.
• Objection — object to processing based on our legitimate interests (Art. 21).
• Withdraw consent — for marketing e-mails, use the one-click unsubscribe link in any e-mail. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Lodge a complaint — with your local supervisory authority. The controller is established in Greece, so the lead supervisory authority is the Hellenic Data Protection Authority (dpa.gr/en). In the United Kingdom, the Information Commissioner’s Office (ico.org.uk); elsewhere in the EU/EEA, the authority of your habitual residence — see the EDPB member list above.

To exercise any right, e-mail john@bitvibelabs.com. We aim to respond within the one-month period set by Article 12(3) GDPR. If you receive no acknowledgement within seven days, or if e-mail to that address is bouncing, a postal address for correspondence is available on request, and the supervisory authority of your habitual residence will accept a complaint addressed to BitVibe Labs. Because the Service is account-less and collects very little that is linked to your identity — typically only your e-mail plus signup metadata if you joined the product-update list — identifying which records (if any) relate to you may require you to provide minimal identifying information (for example, the licence key or session identifier you used).

11.International Transfers#

Some processors are located outside the European Economic Area and the United Kingdom:

• Cloudflare (USA) relies on the European Commission Standard Contractual Clauses (Decision 2021/914) for transfers from the EEA, Switzerland, and the United Kingdom, and is certified under the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework, and the UK Extension to the EU-US DPF. For UK personal data, Cloudflare additionally relies on the UK International Data Transfer Addendum (version B1.0) issued by the ICO under section 119A of the UK Data Protection Act 2018.
• OpenRouter (USA) — routes chat prompts to the GLM-5.2 model; transfers rely on the Standard Contractual Clauses (Decision 2021/914) or another lawful transfer mechanism offered by the provider.
• Gumroad (USA) — payment processing for paid plans; transfers rely on the Standard Contractual Clauses or another lawful transfer mechanism offered by the provider.
• Supadata (primary) and TranscriptAPI (fallback) — each receives only the public video identifier and no personal data about you, so no personal-data transfer arises from our server-side calls to them.
• Migadu (Switzerland) — covered by the European Commission’s Swiss adequacy decision, so no separate transfer instrument is required for EU/UK–Switzerland transfers.

12.Security#

We take security seriously. Concretely:

• All traffic is served over TLS 1.2 or higher (the Cloudflare zone enforces min_tls_version=1.2 + always_use_https=on).
• Data at rest on Cloudflare is encrypted with AES-256 (KV, D1, R2) by default.
• Environment variables (SMTP credentials, API tokens) are stored as Cloudflare Pages secret_text values — encrypted at rest, never logged.
• No plaintext credentials are committed to source control. The Cloudflare API token used by tooling is scoped to non-catastrophic actions (no transfer, no billing, no token-create, no tunnel mutation).
• Strict security headers on every response: HSTS with preload, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a tight Content-Security-Policy, and a hardened Permissions-Policy.
• Bot Fight Mode is enabled at the Cloudflare edge.
• Access to operational systems follows the principle of least privilege.

No system can be guaranteed perfectly secure, and we make no warranty to that effect.

13.Breach Notification#

If we become aware of a personal-data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority within 72 hours of becoming aware of it (Article 33 GDPR). If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay (Article 34 GDPR), using the e-mail address on file.

14.Children#

The Service is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age. If you are a parent or guardian and believe a child has provided personal data to us, please contact john@bitvibelabs.com and we will erase it.

15.Automated Decision-Making#

We do not use your personal data to make any legally-significant or similarly-significant automated decisions about you (Article 22 GDPR). The chat is an advisory AI feature: replies generated by the model are informational only, do not constitute legal, medical, financial, or professional advice, and are not used to grant or deny you any service, benefit, price, or treatment. We do not profile visitors, do not perform behavioural advertising, and do not score users for risk or eligibility.

16.YouTube & Third-Party Content#

Transcripts shown on the video page originate from YouTube and remain the copyright of the original video author. We retrieve them server-side via our transcript providers (Supadata as primary, TranscriptAPI as fallback), passing only the public video identifier with no information about you, and act as a transient cache of those publicly-available captions; we do not host the underlying video, and we do not publish, monetise, or rebroadcast the underlying creative work. Cached transcript rows are refreshed every 90 days against the public source.

Embedded player. The video page also embeds YouTube’s privacy-enhanced player from youtube-nocookie.com. This is a direct connection between your browser and Google/YouTube: when the player loads, and especially when you press play, Google may receive your IP address, the identity of the video you are watching, and player-interaction data, and may set cookies, under Google’s own privacy policy. The nocookie variant defers personalisation cookies until you interact with the player, but it does not eliminate this browser-to-Google data flow. We do not control, and are not responsible for, Google’s processing of that data.

The Service is independent and not affiliated with YouTube, LLC or Google LLC. “YouTube” is a trademark of Google LLC; we use the term solely to describe interoperability with publicly-available YouTube features. Rights-holders who believe transcript content surfaced through our Service infringes their rights may send a takedown request, including the elements required by 17 U.S.C. §512 (DMCA) and Article 17 of the EU Digital Single Market Directive (Directive (EU) 2019/790), to john@bitvibelabs.com. We will respond within a commercially reasonable time and, where the request is well-founded, will remove or restrict access to the offending content.

17.Marketing E-mails#

If you confirm your product-update subscription, we will e-mail you occasional updates from BitVibe Labs — a handful per year at most, exclusively about youasktube or directly-adjacent BitVibe Labs products. We do not sell, rent, share, or trade subscriber e-mail lists with any third party.

Unsubscribe. Every e-mail we send includes a one-click unsubscribe link (the URL pattern is https://youasktube.com/api/notify/unsubscribe/<token>). Clicking the link deletes both the notify:<email> record and its reverse-index notify:unsub:<token> from KV, removing you from the list immediately. You may also e-mail john@bitvibelabs.com with subject “unsubscribe” for the same effect.

18.Changes to This Policy#

We may update this Policy from time to time. The “Last updated” date at the top of the page reflects the most recent revision. For non-material changes (clarifications, typo fixes, formatting), we update the page silently. For material changes — new subprocessors, new data categories, new lawful bases, new retention periods that meaningfully expand processing — we will give at least 30 days’ notice by e-mailing confirmed signups before the change takes effect, and by displaying a banner on the home page during that window. Continued use of the Service after a revision becomes effective constitutes acknowledgement of the revised Policy.

19.Contact & DPO#

We have not appointed a statutory Data Protection Officer because our processing does not meet the Article 37(1) GDPR thresholds (no core-activity large-scale monitoring, no core-activity special-category processing, no public-authority status). The natural-person operator named in section 1 above acts as the single point of contact for all privacy matters.

Questions, requests, or complaints about privacy may be sent to:

BitVibe Labs — an individual operator based in Greece
Attn: Privacy — john@bitvibelabs.com
E-mail: john@bitvibelabs.com
Postal address: available on request by e-mail.

For complaints, you may contact the Hellenic Data Protection Authority (operator’s habitual residence) at dpa.gr/en, the UK Information Commissioner’s Office at ico.org.uk, or your own EU/EEA Member State’s supervisory authority.

← Back to YouAskTube