Privacy Policy
Wersja polska →Last updated: 17 August 2026
This document explains what data Kanalytics (kanalytics.wieniu.com) collects, why it collects it, and how it is protected. It is written in plain language on purpose.
1. Who controls your data
The data controller is the owner of the Kanalytics service, based in Poland (European Union). For any question about your data, write to wieslawbiuro04@gmail.com.
2. What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | Creating and running your account, signing in, service-related contact | Performance of a contract (Art. 6(1)(b)) |
| Password (as an irreversible hash) | Protecting access to your account | Performance of a contract |
| IDs of the YouTube channels you add | Fetching and displaying statistics | Performance of a contract |
| YouTube access token (if you connect a channel) | Uploading videos and replying to comments at your instruction | Consent (Art. 6(1)(a)) |
| IP address and timestamps in server logs | Security, abuse detection, diagnostics | Legitimate interest (Art. 6(1)(f)) |
We do not collect: your name, home address, phone number, or any special-category data. We do not profile users and we make no automated decisions about them.
3. YouTube data — exactly what each permission is used for
When you connect a channel, Google asks you to grant three permissions. Here is precisely what each one does in our service, and what it does not do:
| Scope | How we use it |
|---|---|
yt-analytics.readonlyread statistics |
We fetch your channel's statistics (watch time, subscriber change, traffic sources, per-video retention) to display them in the dashboard and in reports. Read-only — this scope cannot change anything. |
youtube.force-sslcomments |
We display comments on your videos and — only when you click "Reply" yourself — publish your reply. We never post anything automatically, never delete comments, and never change channel settings. |
youtube.uploadvideo upload |
We upload the video file you select in the dashboard, with the title and description you type, at the visibility you choose. Nothing is sent without your click. |
We do not store your videos. The file passes through our server only while being transferred to YouTube and is not retained afterwards. Statistics are stored as daily snapshots, solely so we can draw trend charts — that is the only reason we keep them beyond the moment of display.
We do not use YouTube data to train artificial intelligence models and we do not pass it to any AI tools.
4. Google API Services Limited Use disclosure
Kanalytics's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- we use Google API data only to provide user-facing features within the dashboard;
- we do not transfer this data to third parties, except infrastructure providers necessary to operate the service;
- we do not use it for advertising or to build advertising profiles;
- we do not allow humans to read this data, unless you give explicit consent, it is necessary for security purposes, or it is required by law;
- we do not sell this data.
You can review and revoke our access at any time at myaccount.google.com/permissions.
5. Payment data
Payments are handled by Stripe. Card details (number, expiry, CVV) are entered directly on Stripe's side and never reach our servers — we have no access to them and do not store them. On our side we keep only a Stripe customer identifier and the subscription status (paid / unpaid).
6. How we protect data
- All traffic is encrypted (HTTPS); insecure connections are redirected automatically.
- We do not store passwords. The database holds only an irreversible hash (scrypt) — recovering the password from it is not possible, including for us.
- YouTube access tokens are encrypted at rest, with the encryption key stored separately from the database.
- The database and configuration files are readable only by the server's administrative account.
- Sign-in is protected against automated password guessing — after several failed attempts the account is temporarily locked.
- We take daily database backups, retained for 14 days.
7. Who we share data with
We share data only with providers essential to running the service:
- Hostinger — the server the service runs on (hosting, European Union).
- Google (YouTube Data API, YouTube Analytics API) — fetching channel statistics and, at your request, publishing videos and replies.
- Stripe — payment processing.
We do not sell data and do not share it with advertisers or any third party for marketing purposes.
Our servers are located in the European Union. If you use the service from outside the EU, your data is transferred to and processed in the EU.
8. How long we keep data
Account data is kept for as long as you use the service. After you delete your account the data is erased immediately and disappears from backups within 14 days at the latest. Server logs are rotated on the operating system's schedule.
9. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your data.
Two of these you can exercise yourself, instantly, in the dashboard (the ⚙ button in the top-right corner):
- Download my data — all of your data in a downloadable file.
- Delete account — permanent removal of the account and associated data.
For anything else, write to the address in section 1. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (uodo.gov.pl).
10. Withdrawing YouTube access
You can disconnect a channel at any time in the dashboard, and independently revoke our access on Google's side at myaccount.google.com/permissions.
11. Cookies
We use exactly one cookie — a technical session cookie that keeps you signed in. We use no analytics, marketing, or tracking cookies. Your language preference (PL/EN) is stored locally in your browser and never sent to the server.
12. Changes to this policy
We will notify registered users by email, at the address given at sign-up, about any material change to this policy.
← Back to app