GDPR Art. 13 · YouTube API Services
Privacy Policy
This policy explains how personal data is processed by two separate things that share the name MindHafen YouTube Copilot:
- the public website at
mindhafen.orkaid.de, which you are reading now; and - the MindHafen YouTube Copilot application, which connects to a YouTube channel through Google OAuth and YouTube API Services.
The application is not publicly available. It currently runs on its operator's own computer and is connected only to the operator's own YouTube channel, MindHafen. If access is ever extended to other people, this policy will be updated before that happens.
1. Controller and contact
The controller under the EU General Data Protection Regulation (GDPR) is:
Mihai-Adrian Mateescu (ORKAID)Bahnhofstraße 65b
21218 Seevetal
Germany
Email: kontakt@orkaid.de
Phone: +49 170 4740121
Write to this address with any question or complaint about privacy, including questions about Google user data. No data protection officer has been appointed, as none is legally required.
2. The public website
This website is a static information site. It has no user accounts, no forms, no comments and no sign-in. It does not set cookies, does not use local browser storage, and contains no analytics, advertising, tracking pixels or embedded third-party content. Fonts are served from this website, not from an external font service.
Hosting by Cloudflare
The website is delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, through its DNS, content delivery and Cloudflare Pages services. To deliver pages and protect the service against abuse, Cloudflare processes technical connection data such as your IP address, the date and time of the request, the requested address, browser and operating system information, and the referring page.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the website securely and reliably. Cloudflare is certified under the EU-U.S. Data Privacy Framework. More information: Cloudflare Privacy Policy.
External links
Links to other websites, such as Google or YouTube, are ordinary links. No connection to those services is made until you follow one; from then on their own privacy policies apply.
3. The application and YouTube API Services
MindHafen YouTube Copilot uses YouTube API Services. When the application is connected to a YouTube channel, data from that channel is also processed by Google in accordance with the Google Privacy Policy (www.google.com/policies/privacy). Use of YouTube through the application is subject to the YouTube Terms of Service.
The application is connected through Google's OAuth consent flow. The channel owner sees the requested permissions on Google's own consent screen and decides whether to grant them. New authorizations request these read-only scopes:
https://www.googleapis.com/auth/youtube.readonly— view the YouTube account;https://www.googleapis.com/auth/yt-analytics.readonly— view YouTube Analytics reports.
An earlier authorization granted by the operator also includes the broader https://www.googleapis.com/auth/youtube scope. It is used only when the operator manually saves a change to the title, description, tags, category or language of the operator's own channel or videos. The application does not upload, delete or publish videos, and it does not post comments.
4. Google user data the application accesses
The application accesses only data about the connected channel:
- Channel information: channel ID, title, uploads playlist and branding description and keywords.
- Video information: video IDs, titles, descriptions, tags, category, language, duration, publication date, visibility, and public view, like and comment counts.
- Analytics reports: aggregated metrics for the channel and its videos, such as views, engaged views, watch time, average view duration, subscribers gained, audience retention, traffic sources and search terms, related videos, device types, subscription status, and age group, gender and country distributions.
- Reporting API metadata: lists of available report types and reporting jobs.
YouTube Analytics reports are aggregated by YouTube. They do not identify individual viewers, and the application does not request comments or any personal profile data about viewers.
This data is used only to show the operator dashboards and evidence about their own channel, to prepare AI-assisted editorial drafts at the operator's request, and to apply metadata changes the operator explicitly saves.
Legal basis, insofar as this data relates to an identifiable person: Art. 6(1)(a) GDPR (the authorization given on Google's consent screen) and Art. 6(1)(b) GDPR (providing the functions the connected account holder has asked for).
5. Where data is stored and how long
OAuth credentials
OAuth access and refresh tokens are stored in an HttpOnly browser cookie set by the application on the operator's own computer, with a lifetime of up to 30 days, and are refreshed by the application when needed. They are never part of this public website. Using the application's disconnect function deletes that cookie; it does not by itself revoke the Google authorization (see section 8).
YouTube data
Channel, video and analytics data is stored in a local SQLite database on the operator's computer. It is not uploaded to a server operated by MindHafen or ORKAID. Each synchronisation replaces the stored values for the same report and time window. Data is kept until it is replaced by a later synchronisation, deleted by the operator, or deleted after authorization is revoked as described in section 8. Automated time-based deletion is not yet implemented and is part of the Intelligence Core work in progress.
Editorial records created in the application, such as saved insights, drafts and experiments, may contain video titles and metric values and are stored in the same local database.
6. Recipients, including AI services
Google user data is not sold and is not used for advertising. It leaves the operator's computer only in these cases:
- Google LLC (YouTube API Services) — every request to YouTube's APIs is, by its nature, processed by Google.
- Google Gemini API — when the operator explicitly asks the application to generate insights or editorial drafts, a selection of channel data (for example video titles, aggregated metrics and the MindHafen brand guidelines) is sent to Google's Gemini API to produce that output.
- AI assistants connected by the operator through MCP — when the operator uses an AI assistant connected to the application's Model Context Protocol server, such as Claude (Anthropic) or ChatGPT or Codex (OpenAI), the results of the tools the assistant calls are sent to that provider. Remote access from ChatGPT runs through OpenAI's secure MCP tunnel.
These providers process the data under their own terms and privacy policies, which describe where they process data, the safeguards they use for transfers outside the EU, in particular to the United States, and whether submitted content may be used to improve their services. MindHafen and ORKAID do not use Google user data to develop, improve or train AI or machine-learning models.
Data may also be disclosed where required by law.
7. Limited Use
MindHafen YouTube Copilot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the YouTube API Services Developer Policies.
8. Revoking access and deleting data
- You can revoke the application's access to your Google data at any time on the Google security settings page: security.google.com/settings/security/permissions.
- To request deletion of stored data, write to kontakt@orkaid.de. Stored YouTube API data will be deleted as soon as possible and within 7 days of the request.
- If access is revoked through Google's security settings, stored YouTube API data will be deleted within 30 days.
These deletions are currently carried out manually by the operator; the application does not yet delete data automatically after revocation.
9. Security
The application runs as a local service bound to the operator's own computer and is not exposed as a public web application. New OAuth authorizations use state validation and PKCE. Credentials are kept in HttpOnly cookies and are not exposed to page scripts. Write actions on YouTube require an explicit action by the operator. No credentials or API keys are contained in this public website.
No system is perfectly secure. If you believe you have found a security issue, please report it to kontakt@orkaid.de.
10. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)).
You also have the right to lodge a complaint with a supervisory authority (Art. 77). The authority responsible for the controller is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany — lfd.niedersachsen.de.
11. Changes
This policy will be updated when the website or the application changes, in particular before the application is offered to anyone other than its operator. The effective date at the top shows the current version.