Policy

Privacy Policy

This policy explains how WasNowForward Publisher, operated by WasNowForward, handles information when the authorized operator uses the local publisher application and this public validation site.

Effective: July 27, 2026 Version: 2026.07.27-1

1. Scope and application identity

WasNowForward Publisher is a private, single-operator desktop and command-line application. It helps the authorized operator prepare original media and upload selected videos and thumbnails to an authorized YouTube channel. It is not a public user-upload service and does not provide public account registration.

The application uses YouTube API Services and Google OAuth 2.0. It is not made, endorsed, sponsored, or operated by Google or YouTube.

2. Information the application accesses

Google OAuth authorization data

The local application receives and stores an OAuth authorized-user token. Depending on what Google issues, that file can contain an access token, refresh token, granted scopes, token endpoint information, OAuth client identity information, and expiry metadata. The application does not request, receive, or store the operator's Google password.

YouTube channel information

Using the youtube.readonly permission, the application retrieves the authenticated YouTube channel ID and channel title through channels.list(mine=true). It uses those values only to confirm that the authenticated channel exactly matches the destination channel configured for the release.

Media and release metadata supplied by the operator

The operator supplies or generates the video file, thumbnail, title, description, tags, category, language, audience designation, subscriber-notification setting, visibility, and any future publication timestamp. The application sends the selected fields and media to YouTube only after the operator confirms an upload.

Upload response and local output

YouTube returns an upload response that includes a video identifier and status information. The currently installed release displays the authorized channel identity and resulting video identifier in terminal output. It does not maintain a server-side database or a public user profile.

3. OAuth permissions

Scope	Purpose
`https://www.googleapis.com/auth/youtube.upload`	Upload the operator-selected video with metadata and set the selected custom thumbnail.
`https://www.googleapis.com/auth/youtube.readonly`	Read the authenticated channel ID and title solely to enforce the destination-channel identity check.

The current implementation does not request general YouTube account-management, analytics, comments, subscriptions, or content-download permissions.

4. How information is used

Authorize the local application to call YouTube API Services on behalf of the operator.
Verify the exact destination channel before an upload.
Upload operator-selected original media, metadata, and thumbnails.
Report upload progress, success, or failure to the operator.
Maintain security, diagnose errors, and preserve operator-selected audit evidence.

Authorized data is not used for advertising, sale, unrelated profiling, or unrelated analytics.

5. Storage and security

The OAuth client configuration and authorized-user token are stored locally on the operator's computer under the application's configuration directory. The token file is restricted to the local operating-system account with file mode 0600. The current application does not add application-level encryption to that file. Protection also depends on the operating system, local account security, disk protection, and physical security of the computer.

Rendered media, thumbnails, presets, metadata, logs, and terminal output are local files under operator control. This public site contains no OAuth client secret, access token, refresh token, API key, scheduler secret, or Cloudflare credential.

Credentials, tokens, passwords, and private keys must never be sent to the support address.

6. Retention

OAuth token: retained locally until it is revoked, becomes unusable, or is deleted by the operator.
Channel ID and title: retrieved during authorized operations and returned in terminal output; the current application does not create a dedicated channel database.
Video identifier and status: returned in terminal output. Retention depends on whether the operator preserves that output or related audit evidence.
Local media and metadata: retained until the operator deletes or archives them.
Support messages: retained under the operator's email-account settings for as long as reasonably needed to address the request, protect the service, or document completion.

Authorized YouTube API data under WasNowForward's control will be deleted when it is no longer needed, when authorization is revoked, or when a valid deletion request is completed, within the applicable YouTube API policy period.

7. Revocation and deletion

The operator can revoke Google access through Google Account permissions. The local token can then be deleted from:

~/.config/wasnowforward-binaural/youtube-token.json

Detailed steps are available on the support page. A request to delete locally retained authorized API data may be sent to wasnowforward@gmail.com.

The currently installed engine uses Google Account revocation plus local token deletion. Programmatic in-application revocation and authorized-data cleanup are release gates before production public or scheduled API publishing and before the YouTube compliance-audit submission.

Deleting local application data or revoking OAuth access does not delete videos or other data stored by YouTube. YouTube-hosted content must be managed through YouTube Studio or another authorized client that supports the requested action.

8. Sharing and service providers

Information is sent to Google and YouTube only as necessary to authorize the application, verify the channel, and complete operator-requested upload and thumbnail operations. Google and YouTube process that information under their own terms and privacy practices.

This validation site is hosted through Cloudflare Pages. Cloudflare may process ordinary connection and security information, such as IP addresses and request headers, to deliver and protect the site. WasNowForward has not added analytics, advertising, session replay, fingerprinting, or tracking scripts.

Support email is processed by the operator's email provider. Authorized data is not sold or shared with advertisers or unrelated third parties.

9. Cookies and browser storage

This static site does not intentionally set application cookies, local-storage identifiers, advertising identifiers, or analytics identifiers. Cloudflare or external sites reached through links may apply their own necessary security technologies and policies.

10. Children

The publisher application is an operator tool and is not directed to children. It does not offer public accounts or invite children to authorize YouTube write actions. The operator separately selects the made-for-kids designation for each uploaded video.

11. External policies

12. Contact

Questions, complaints, revocation assistance, and deletion requests may be sent to wasnowforward@gmail.com. Include “WasNowForward Publisher” in the subject line and do not include credentials or tokens.

13. Changes to this policy

Material changes will be posted here with a revised effective date. If the application begins to access, collect, store, or use YouTube API data in a materially different way, the operator must review and accept the updated policy before using the affected functionality.