Privacy Policy
Last updated: 12 October 2026
This policy explains how Decode (“Decode”, “we”, “us”) accesses, uses, stores, shares and deletes information, including data we obtain from Google and YouTube on your behalf, and public YouTube data about channels that are not Decode customers.
Decode tells YouTube creators what each video cost to make, what it earned, and when it paid back. It reads your own channel’s analytics and earnings, combines them with the production costs and outside income you enter, and shows you the result. If you do not agree with this policy, do not connect your Google account to Decode.
1. Who we are
Decode LLC, an Arizona limited liability company. 1155 S Power Rd, Ste 114 PMB 303, Mesa, AZ 85206, United States. Contact: support@decodevideo.com. We are the controller of the personal data described here.
2. Information we collect
2.1 Account information
Your name and email address, used to sign you in. When a teammate accepts an invitation we also hold their name, email address and profile picture. Sign-in is handled by Clerk. You can sign in with an email and password or with your Google account. Google sign-in shares your name, email address and profile picture with Decode. It is separate from connecting a YouTube channel and gives Decode no access to your channel.
If you invite a teammate, we collect the email address you invite.
2.2 YouTube data (Google user data)
When you connect a YouTube channel, Decode asks for your explicit consent to the following permissions. You can only connect a channel you own or manage.
- youtube.readonly: your channel details and your uploaded videos. We store titles, thumbnails, durations, publish dates, privacy status and view counts, and whether a video is a Short, a livestream or a regular upload. Descriptions are read to tell those apart but are not stored.
- yt-analytics.readonly: YouTube Analytics reports for your own channel, including views, watch time, average view duration, audience retention, impressions, click-through rate and traffic sources. To read impressions and click-through rate, Decode creates a reporting job in your YouTube account and tries to delete it when you disconnect. If your authorization has already been revoked or stopped working, we can no longer reach it, and the job stays in your YouTube account for you to remove.
- yt-analytics-monetary.readonly: YouTube’s estimated revenue for your own channel, per video and by month, and the revenue per thousand views (RPM) derived from it. We do not read payment details, AdSense account information or payouts.
- youtube.force-ssl: the caption tracks on your published videos, read regularly to keep transcripts current. Google defines this permission as read and write. Decode uses it only to read captions, because YouTube offers no read-only permission for them. Decode never writes to your channel.
Decode does not upload, publish, edit or delete anything on your YouTube channel.
2.3 Information you enter
- Production costs: what you pay editors, AI tools, software and other production expenses, by video or by month. Where you give us a rate rather than an actual amount, Decode works out a figure from it, and an actual amount you record later replaces that figure.
- Income outside YouTube’s own revenue: deals you log for sponsorships, affiliate income, merch and other income — who each is from, its category, its total, a note you write, and either the videos it covers (with any amount you set for a single video) or the month it was earned for your channel. For each video in a deal, Decode records the month the video went public and the share of the deal it counted for, and it records any later change to a deal as a correction. Super Chat and channel memberships are not logged here, because they are already in YouTube’s revenue.
- Workspace content: editor briefs and the scripts you paste into them, drafts, thumbnails you upload, brand-voice documents, the cards on your production board with their comments and links, answers you give to Decode’s questions, feedback you leave, and how you describe your niche.
2.4 Billing information
Payments are processed by Stripe. Decode never receives or stores your card details. We send Stripe your email address and an internal customer ID. If you are on a paid plan, we store your Stripe customer and subscription IDs, your subscription status and your renewal date.
2.5 Usage and technical information
Log data, IP address, browser and device information. We use PostHog to record which pages you visit and which actions you take in the app, linked to an internal user ID. PostHog never receives your name, email, video titles or YouTube IDs, and we have turned off its location lookup and told it to discard IP addresses. We use Sentry for error reports: reports from the app carry the same internal ID, and reports from our servers carry no user identifier at all. Sentry receives the browser type but no cookies, request contents or IP address. Before a report is sent, YouTube identifiers, email addresses and database values are removed from it, and the same is done to the error text our own servers write to their logs. An unexpected error’s message could still contain other text, which is why reports carry no more than an internal ID and are kept only for Sentry’s retention period. Neither service is sent your earnings or the costs you enter.
2.6 Email
Clerk sends sign-in emails and team invitations. Decode itself sends no email today. If that changes, we will update this policy and ask you to agree to it before we start.
3. How we use your information
- To show what each video cost, what it earned, and whether and when it paid back.
- To compare each video’s earnings with what it cost to make, and to show totals across your channel.
- To work out when a video paid back what it cost, and what it would take to break even. These are Decode’s own figures, labeled as such.
- To compare each video with your own similar videos: similar length, published around the same time.
- To write analysis of your videos, such as retention moments, editor briefs and your brand voice, using Anthropic’s models.
- To notify you in the app, for example when your authorization to YouTube needs renewing.
- To operate, secure and support the service, and to bill for it if you are on a paid plan.
We use Google user data only for the purposes above. We do not use it for advertising, and we do not sell it. We do not use your Google user data, or anything derived from it, to train generalized artificial intelligence or machine learning models. Decode’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who has access to your data
We do not sell your data and we do not share it with advertisers or data brokers.
4.1 Your team
The account owner, and any teammate they make an admin, can invite and remove teammates. Teammates see video-level figures, including each video’s YouTube revenue and RPM. Costs, the income deals you log, channel totals, payback and profit are visible only to the account owner, not to teammates. Decode administrators can see your revenue totals in our own admin tools, as section 4.3 describes. You control who is on your team and can remove anyone at any time.
4.2 Service providers
These providers process data on our behalf, under contract, only to run Decode:
| Provider | What it does | What it receives |
|---|---|---|
| Railway | Backend hosting and database | All data Decode stores |
| Vercel | Web app and site hosting | Requests to the app and site |
| Clerk | Sign-in, sessions, sign-in and invitation emails | Name, email, session data, and invitees’ email addresses |
| Stripe | Payments and subscriptions | Your email, an internal customer ID, and billing details you give Stripe directly |
| Anthropic | Written analysis of your videos | Video titles and durations, retention figures and your channel’s typical watch-through, the titles and average watch time of your other videos, transcripts (whole for structural analysis, in excerpts elsewhere), scripts and brand-voice documents you provide (long scripts are cut), and notes you type. We never add your name, email, earnings or costs to a request, though anything you wrote or said in a transcript, script or note goes as you wrote it. Not sent: images, view counts, click-through rate, tags, descriptions or comments |
| PostHog | Product analytics | Pages visited and actions taken, linked to an internal user ID |
| Sentry | Error reporting | Technical error details, with YouTube identifiers, emails and database values removed. App reports carry an internal user ID; server reports carry none |
| Website icons for links you attach to workspace cards | Only the link’s domain, requested by Decode’s server, never your browser. Google may redirect that request to its own image servers | |
| Google Workspace | Support email | Your correspondence with us |
Anthropic does not use content we send it to train its models. Until 6 October 2026, OpenAI was configured as a backup provider and processed video titles, view counts, retention figures, traffic-source shares, one script with a brand-voice document, and audio for transcription. It last received anything on 2 October 2026, and no earnings or cost data was ever sent to it when it was used. OpenAI no longer receives any data from Decode.
4.3 Decode personnel
Authorized Decode personnel may open your account to reproduce and fix a reported problem, investigate a security issue or prevent abuse, seeing it as its owner sees it. Every such session is recorded: who opened it, when, why, which parts of your account were opened, and every change made. The reason is chosen from a fixed list, and any note typed alongside it is removed after 30 days, along with any YouTube identifier. The records themselves are deleted after 12 months, counted from the end of the session and from the date of each recorded action. What is recorded is the kind of change made, not the values before and after. When a session is opened to reproduce a problem you reported, we also record a reference to your request, such as a support ticket number or the date you contacted us, and that reference is kept for the full 12 months. Separately from these sessions, Decode administrators can see account details in our own admin tools, including names, email addresses, channel identifiers and links, video titles, revenue totals and error messages. Access is limited to those with a business need and covered by confidentiality obligations.
4.4 Other disclosures
We may disclose information where the law requires it, to enforce our Terms of Service, or in connection with a merger or acquisition. If Decode is acquired, this policy continues to apply to data collected under it until you are notified otherwise.
5. Public data about channels that are not Decode customers
Decode will use public YouTube data about channels that have not signed up, for the two purposes below. Neither is in operation yet. We are describing them here so that nothing starts before it is disclosed.
Free teardown. Decode offers a public page showing a channel’s published videos with figures built from public data: titles, publish dates, durations and view counts, read through the YouTube Data API. Pages may be built in advance, for example before we email a creator a link to their own, and are deleted within 30 days. Decode has no access to a non-customer’s earnings. Any revenue shown on a teardown is an estimate from an RPM the visitor sets, labeled as an estimate.
Contacting creators. We may email creators whose channels look like a fit for Decode. To do that we hold the channel’s public statistics and a business contact name and email address, obtained from a third-party creator database and sent through an email service. We will name both here before we send anything. Every email includes a way to opt out, and you can ask us to delete everything we hold about you at support@decodevideo.com.
We may also monitor public statistics of channels we might contact, to notice when a channel is growing or changing. This is not in operation yet either. Public YouTube data about non-customer channels is kept for no more than 30 days. Contact details are kept in our customer records. If you opt out, we stop emailing you; if you ask us to delete your details, we delete them. This data is never combined with any customer’s private data.
6. How long we keep data, and how it is protected
| Data | How long we keep it |
|---|---|
| YouTube Analytics and earnings for your own videos | While your channel is connected. We work through your catalogue checking that your authorization and each video still exist, and delete data for any video that no longer does. If your authorization stops working, see the paragraph below this table |
| Video titles, thumbnails and captions | Refreshed from YouTube or deleted within 30 days |
| The brand voice Decode writes from your videos | Refreshed or deleted within 30 days. A brand voice you edit yourself is kept as your content |
| Your channel ID and video IDs | While your channel is connected. Disconnecting removes them from our usage and support records straight away; our record that the data was deleted keeps the video ID for 30 days as proof, then removes it |
| Costs, income and workspace content you enter | While your account is active. Anything tied to one channel, such as the income deals you logged for it with their videos and corrections, a cost you set for a single video, or a production type you assigned, is deleted when you disconnect that channel |
| Public data on non-customer channels | See section 5 |
| Account and billing records | While your account is active. When you delete your account Decode keeps none of them; Stripe keeps its own record of your payments under its terms |
| Records of support access and of actions Decode staff took on your account | 12 months, counted from the end of a support session and from the date of any other recorded action, then deleted. The reason is chosen from a fixed list. Any note typed alongside it, and any YouTube identifier, is removed after 30 days |
| Usage records (what each feature cost Decode to run) | YouTube video IDs removed after 30 days; the rest kept as our operating records |
| Our record that a video’s YouTube data was deleted | Kept as proof of deletion; the video ID is removed after 30 days |
| A removed teammate’s name and email | Removed 30 days after they leave the workspace, including from notifications they triggered |
If you revoke Decode’s access, all YouTube data for that channel is deleted once we confirm the revocation, 30 days after we last confirmed the access worked. If access stops working for some other reason, we keep trying to establish whether it has been revoked, and delete the data once we can confirm it; we do not delete on an error we cannot explain. Either way, Decode warns you in the app before the deletion date.
If we later let you pause an account, we will set out here what happens to your data while it is paused.
Data is sent over HTTPS and stored on access-controlled infrastructure. OAuth tokens are stored encrypted. No system is perfectly secure, and we cannot guarantee absolute security.
7. Your choices and rights
Revoke access. You can revoke Decode’s access to your Google and YouTube data at any time at security.google.com/settings/security/permissions. Revoking stops all further retrieval, and the data is deleted as described in section 6.
Disconnect a channel. Only the account owner can disconnect a channel. Doing so deletes the YouTube data Decode holds for it immediately, including anything derived from it, the income you logged against that channel’s videos or that channel’s months, any cost you set for one of its videos, and the production types you assigned; it then revokes Decode’s access. Your general costs and rates, your workspace cards and the scripts in your editor briefs stay with your account, with the YouTube details in them removed. The coaching text in a brief stays as written. Disconnecting removes the channel’s identifiers from our usage and support records straight away; our record that the data was deleted keeps the video identifiers for 30 days as proof, then removes them.
Pause. Decode is in closed beta and free of charge, so there is nothing to pause or cancel. If paid plans arrive, our Terms will set out how to pause or cancel one.
Delete your account. The account owner can delete the account from settings, or by emailing support@decodevideo.com; a teammate asks the owner or emails us. Deletion is immediate. It removes your channels’ YouTube data, everything you entered, and your workspace. It cancels any subscription with Stripe and removes your profile from our product analytics; if either service cannot be reached at that moment, we keep trying until it is done. Decode keeps no billing records of its own, though Stripe keeps its record of your payments under its terms. A few things outlast the account by design: a one-way hash of an internal Decode identifier with the deletion date, as proof the deletion happened; records of actions Decode staff took on your account, for 12 months, holding our own internal identifiers and no YouTube data; a short-lived record of the instructions to Stripe and our analytics provider, kept only until those are carried out; usage records of what features cost us to run, with YouTube identifiers removed after 30 days; and server logs. Error reports already sent to Sentry carry only an internal ID and expire on Sentry’s schedule. Deleting data in Decode does not affect anything stored by YouTube.
Access, correction and other rights. You may ask for a copy of the personal data we hold about you, ask us to correct it, or object to or restrict certain processing. Depending on where you live, you may have more rights under the GDPR, UK GDPR or CCPA/CPRA, including the right not to be discriminated against for using them. Email support@decodevideo.com and we will respond within the period the law requires. If you are in the UK, EU or EEA, you may complain to your local data protection authority.
8. Cookies and similar technologies
In the Decode app, we use cookies that are strictly necessary to keep you signed in and the service secure. PostHog, which records which pages you visit and which actions you take, also sets a cookie and uses your browser’s storage; that one is analytics rather than strictly necessary. One short-lived cookie, lasting a minute, carries a channel title when a channel is already connected to another account. Your browser also stores your own settings: your theme, your chosen view, which banners you have dismissed, which channel you are looking at, and a count of how many times you have asked Decode to write a brand voice in this session. When a Decode administrator opens your account for support, a cookie in their own browser marks that session; nothing is set in yours. Video thumbnails load directly from YouTube’s image servers. There are no advertising or attribution cookies in the app.
On decodevideo.com, our public site carries no advertising pixels today. We plan to add pixels from Reddit, Google (YouTube) and Meta to measure our ads and to show ads to people who have visited the site. They will never be placed inside the Decode app and will never receive your YouTube data. Where the law requires consent before an advertising pixel runs, we will ask for it before we add them.
9. Children
Decode is not directed to children and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
10. International transfers
Decode is operated from the United States. If you use Decode from elsewhere, your information is transferred to and stored in the United States under appropriate safeguards. Pages may be served to you from a provider’s servers closer to where you are.
11. Decode’s figures and YouTube’s figures
Figures in Decode carry a label saying where each came from: from YouTube, Decode’s calculation, Decode estimate, or you entered. Charts and written analysis carry one label for the section rather than one per number, and simple counts of things on the page carry none. Decode’s calculations and estimates are not provided or approved by Google.
12. YouTube and Google
Decode uses YouTube API Services. By using Decode you also agree to the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy. Decode is not affiliated with, endorsed by or sponsored by YouTube or Google.
13. Changes to this policy
If we change how we access, use, store or share your Google user data, we will update this policy and ask you to accept it again, in the app, before the new processing begins. Material changes will be announced in the product. You agree to this policy and our Terms when you sign up, and again each time either one changes; we record the date you agreed.
14. Contact
Questions about this policy or your data: support@decodevideo.com.