Privacy

Privacy Policy

Last updated: October 20, 2026.

What we collect

  • Account info: email, display name, hashed password (or Google sign-in claim), and an optional self-reported channel-size range from signup (used only to measure which ad campaigns reach established creators; never taken from your YouTube data).
  • YouTube data: channel metadata, channel ids, video ids, video titles, video descriptions, and scan results derived from the descriptions for channels you connect.
  • Amazon Associates data (optional): if you connect your own Amazon Creators API credentials, we use them to ask Amazon about the products and tracking IDs found in your description links, and store the answers (product availability, and whether a tracking ID belongs to your Associates account) with your scan results.
  • OAuth refresh tokens: stored encrypted at rest using ASP.NET Data Protection. Never logged.
  • Billing: Stripe handles all payment data. We store the customer + subscription ids only.
  • Email: your email preferences and a record of which product update emails we have sent you, so nobody gets the same one twice. Product update emails don't use open tracking or per-person click tracking; their links carry a campaign label (UTM parameters) so we can count visits from an email in aggregate. You can turn them off in Settings or with the unsubscribe link in each one. On the free plan, that same setting covers the email we send after a monthly scan that finds possible issues; it states how many, and we keep the date we last sent one so they stay about a month apart.
  • Last visit: the date and time you last opened the app while signed in, rounded to about an hour, so we can tell whether the product is being used. We don't record which pages you open, your IP address or your device with it, and using the Fix Assist extension doesn't update it. Deleted with your account.
  • App preferences: settings you choose in the app, such as your time zone, revenue assumptions, and when you last dismissed an in-app prompt (so it stays hidden). Deleted with your account.
  • Fix Assist browser extension (optional): if you install it, what it reads in your browser, stores there and sends to us is described in Fix Assist browser extension below.
  • Free channel report (/scan, no account needed): when someone asks for a report on a channel, we read that channel's public details (id, title, handle, picture, video and subscriber counts) and the public titles, descriptions, dates and view counts of its most recent videos through the YouTube Data API, check the links in those descriptions, and keep the results with the report for 30 days. We also keep a one-way fingerprint (never the address) of the requesting IP to limit how often one visitor can run reports. If you ask for the full report by email, we keep that address with the report, send one email with the link, and delete it with the report. If you arrived from an ad or a post, the src code in the link is kept with the report and in a 90-day cookie so we know which campaign brought you. Anyone with a report's link sees its counts; the list of affected links and videos is shown only to the channel's owner after they connect the channel with read-only YouTube access. Reports never rank channels against each other, and we don't use anything in them for advertising.

Google user data

Channel Workbench uses Google OAuth and the YouTube Data API only after you choose to connect a YouTube channel. We request the https://www.googleapis.com/auth/youtube.readonly scope so we can read your channel list, video list, and video descriptions. We use that read-only data to scan description links, identify broken or risky links, display findings in your dashboard, and generate scan/export/report views. We never request scopes that allow us to upload, edit, delete, comment on, or manage your YouTube content.

We store the minimum Google user data needed to provide the service: connected channel metadata, video metadata, descriptions needed for link scans, scan history, findings, and encrypted OAuth tokens. OAuth access and refresh tokens are encrypted at rest and are not written to logs. Access is limited to systems and personnel needed to operate, secure, and support Channel Workbench.

Channel Workbench's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data and other sensitive data

We use administrative, technical, and organizational safeguards designed to protect Google user data and other sensitive data against unauthorized access, use, disclosure, alteration, loss, or destruction.

  • Encryption in transit: Channel Workbench is served over HTTPS/TLS so account, OAuth, and YouTube API data are encrypted while moving between your browser, our application, and service providers.
  • Encryption at rest: OAuth access and refresh tokens, Amazon API credentials, and other stored integration secrets are encrypted at rest using ASP.NET Data Protection before being saved.
  • Access controls: production data access is limited to authorized systems and personnel who need access to operate, secure, or support Channel Workbench.
  • Logging controls: OAuth tokens, refresh tokens, and integration secrets are not written to application logs.
  • Least-privilege OAuth: we request only the read-only YouTube scope needed for the product and do not request permissions to upload, edit, delete, comment on, or manage YouTube content.
  • Account protection: passwords are stored as salted hashes through ASP.NET Identity, session cookies use secure authentication controls, and email confirmation is required for new accounts.

How we share data

We do not sell your personal information or Google user data. We share data only with service providers that help us operate Channel Workbench, such as hosting, database, email delivery, observability, and payment processing providers, and only as needed for those services. Stripe processes payment details directly; we store Stripe customer and subscription ids rather than card numbers. If you connect your own Amazon Creators API credentials, we also send Amazon, under those credentials and only for the features that use them, the product and tracking IDs found in your description links and any product words you type into a replacement search. We may also disclose information if required by law, to protect users, or to investigate abuse or security issues.

What we don't do

  • We do not sell your data.
  • We do not transfer Google user data to advertising platforms, data brokers, or information resellers.
  • We do not use Google user data for ads, retargeting, or interest-based advertising.
  • We do not edit, post, or delete videos on your channel.
  • We do not use raw, derived, aggregated, or anonymized Google user data to train generalized AI or machine learning models.

How long we keep data

Connected channel data, scan history, and findings are retained while your workspace is active so you can review results over time. When you disconnect a channel, we revoke OAuth tokens at Google, stop scanning that channel, and automatically delete its stored channel, video, and description data within 30 days. When you delete your account, all workspace data, findings, and tokens are purged within 30 days, except where limited records must be retained for legal, security, or billing compliance. A minimal deletion record (used for fraud prevention and support) keeps your email address for at most 90 days, after which it is replaced by a non-reversible cryptographic fingerprint that cannot be turned back into your address. Free channel reports (/scan) and everything stored with them, including any email address typed to receive one, are deleted 30 days after the scan.

Your rights

You can disconnect any channel from Channels, manage your account from Account, and export findings as CSV from the dashboard. For a full data export or deletion request, email [email protected].

Fix Assist browser extension

Fix Assist is our optional browser extension for YouTube Studio. It shows your Channel Workbench findings beside the video you're editing and, only when you click, places a corrected link in the description box for you to review. Nothing changes on YouTube until you click Save in Studio yourself: the extension has no YouTube permissions, never clicks Save or any other Studio button, and makes no requests to YouTube. It runs only on studio.youtube.com.

Before its first request to Channel Workbench, Fix Assist shows a card that lists what it reads, stores and sends. It sends nothing until you click Agree. You can reopen the card at any time from the "What Fix Assist sends" link in the panel and click Turn off, which stops all requests until you agree again. If we change what the extension reads, stores or sends, it shows the updated card and waits for you to agree again before sending anything.

What it reads, in your browser only

  • The address of the Studio page you're on, to tell a video's edit page from other Studio pages and to know which video is open. This happens on every Studio page, including before you agree, only to decide what the panel shows.
  • The text of the description box on a video's edit page, to highlight flagged links, check that the text still matches your last scan, show a before-and-after preview of a fix, and confirm that a saved description kept the fix. The description text is never sent to Channel Workbench or anyone else.
  • Whether Studio's Save button is active, to notice when you have saved a fix you applied and to warn you about unsaved changes before a rescan.

What it sends to Channel Workbench

Only after you agree, only to app.channelworkbench.com over HTTPS, and signed in with your existing Channel Workbench session:

  • The YouTube video ID of the edit page you open, to get that video's findings, its last scanned description and the next videos in your fix queue. While a rescan you started is running, the extension asks again every few seconds, for up to five minutes.
  • A request for your fix-queue summary when you're on any other Studio page. It carries no details of the page.
  • The actions you click (Mark fixed, Ignore, Snooze, Undo, Rescan and Find replacements), with the ID of the finding or video they apply to. When you apply a fix and then save it in Studio, the extension also marks that finding fixed for you.
  • Product words you type into the replacement search, if you use it (up to 120 characters).
  • Standard request information: your Channel Workbench session cookie, so we know it's you; your IP address and browser user agent, as with any web request; and a header that marks the request as coming from the extension, which protects you against cross-site request forgery.

We use this only to provide Fix Assist: to return your findings, record status changes in your fix queue exactly as the web app does, queue a rescan (which re-reads the description through our read-only YouTube access), and, if you have connected your own Amazon Creators API credentials, ask Amazon for replacement products on your behalf. Product words you type are sent to Amazon as that search and are not stored with your account. Extension requests don't create a new kind of stored data: status changes are the same fix-queue records the web app keeps. Like every request to our servers, extension requests appear in our server logs, which record the address requested (including the video or finding ID and, for a replacement search, the words you typed), the response status and timing. We use those logs only for security and troubleshooting. They never contain your description text or tokens.

What it stores in your browser

  • The panel's position, size, zoom and tucked state.
  • Your answer to the disclosure card: agreed or declined, the card's version, and when you answered.

Both stay in your browser's extension storage on your device and are never sent to us. The extension keeps no copy of your findings: what Channel Workbench returns stays in the open tab's memory and is gone when you leave the page or close the tab.

What else happens in your browser

  • Product photos in replacement suggestions load straight from Amazon's image servers, so Amazon receives your IP address and browser details, as with any image on the web. The extension sends no referrer with those requests, and nothing about them goes to Channel Workbench.
  • Copy puts a link on your clipboard, only when you click it.
  • The extension's toolbar icon shows a count of open findings or videos, taken from Channel Workbench's answers.
  • Any Amazon link Fix Assist places in your description carries the Associates tag from your own connected Amazon account or from your original link. Channel Workbench adds no tag or affiliate code of its own.

What it never does

  • It never saves changes to your channel, clicks Save, or presses any other button in YouTube Studio.
  • It never sends your description text or other page content anywhere, and it doesn't run on, read or report any website other than YouTube Studio.
  • It contains no analytics, advertising or tracking code, and it runs no code downloaded from the internet.

Retention, deletion and sharing

Uninstalling Fix Assist deletes everything it stored in your browser. The fix-queue changes you make through it are part of your workspace data: they are kept while your workspace is active and deleted with the rest of it when you disconnect a channel or delete your account, as described in How long we keep data.

We do not sell data from Fix Assist, use it for advertising, or use or transfer it for anything other than providing Fix Assist, and never to decide creditworthiness or for lending. We share it only with the service providers that help us run Channel Workbench (see "How we share data"), with Amazon when you ask for replacement products (a search made under your own Creators API credentials), or when the law requires it. People at Channel Workbench don't read it, except when you ask us for help, when it's needed to investigate security issues or abuse, or to comply with the law.

The use of information received from the Fix Assist browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Fix Assist is the same extension whether you install it from Microsoft Edge Add-ons or the Chrome Web Store, and this section applies to both.

Cookies

We use first-party cookies for authentication, session security, CSRF protection, and remembering interface preferences such as your light/dark theme choice. A visit to the free channel report from a link that names its source (an ad, a post, an email) sets a cw-src cookie holding that source code for 90 days.

If you reach us from one of our ads or a tagged link, a first-party cookie (cw-ad-attribution, 90 days) remembers the ad click identifier in that link (Google's gclid, gbraid or wbraid, Microsoft's msclkid), the campaign tags (utm_source, utm_medium, utm_campaign) and the page you landed on. If you then create an account, we store those values with it, and the answer you give to "how many videos are on your channel?", so we can tell which ads bring in creators who actually use the product. We never use information from your YouTube channel for this.

To measure our own advertising, our website loads the Google tag (Google Ads) and the Microsoft Advertising Universal Event Tracking (UET) tag. These let Google and Microsoft set or read cookies and receive information about your visit, such as the pages you view, the ad you clicked to reach us, and conversion events like signing up, connecting YouTube or starting a paid plan (with its value). When you sign up, the Google tag also receives a hashed (SHA-256) form of the email address you entered, so Google can match the signup to the ad click ("enhanced conversions"); Google does not receive the address itself. When you start or renew a paid plan, we may report that purchase to Google Ads with the stored click identifier and the same hashed form of your email address. We use this to learn which of our ads work. You can limit personalized ads in your Google ad settings and Microsoft ad settings.

We do not use Google user data from the YouTube Data API for advertising, retargeting, or interest-based ad targeting, and the Fix Assist extension contains no advertising or analytics tags.

Contact

Questions about privacy? [email protected].

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please retry or reload the page.