Privacy Policy

Last updated: September 28, 2026

Who we are and what this covers

VidGate ("we", "us"), operated by vsaasify.com, is an approval-gated collaboration workspace for YouTube channels, available at vidgate.vsaasify.com. Channel owners connect their YouTube channel; editors propose metadata changes (titles, descriptions, tags, thumbnails) and upload video cuts for review; owners review every proposal as a diff, and nothing reaches YouTube except through the owner's explicit approval. This policy explains exactly what data VidGate collects, why we collect it, how it is used, stored, protected, shared, retained, and deleted — including the Google user data we access through Google's APIs — and the choices you have.

1. Information we collect

Account information

For every user (owner or editor) we store an email address, a display name, an optional avatar image URL, and the user's role in each workspace they belong to. Editors can be invited by email and sign in with a one-time email link — no password, and no Google account required.

Google user data — channel owners

When a channel owner connects their channel with Google sign-in, we request four OAuth scopes. Here is each scope and precisely what we do with it:

  • openid and userinfo.email — your Google account id and email address, used only to identify your VidGate account and sign you in.
  • userinfo.profile — your display name and profile picture, shown to your collaborators in review discussions and activity history so changes are attributed to a recognizable person instead of an email prefix.
  • youtube.force-ssl — used exclusively for: reading your channel's id, title, and avatar and the metadata (title, description, tags, category) of videos you choose to import (cached in our database so we never poll YouTube); updating a video's metadata and thumbnail — executed only when the channel owner clicks "Approve & Push", always as a full read-then-merge write so nothing is unintentionally overwritten; and uploading an owner-approved video cut to the owner's own channel — executed server-side only after the owner locks an approval that binds the exact file and publish settings.

We never access your revenue or monetization data, channel analytics, subscriber or member lists, comments, community posts, or private messages. We request no Google scopes beyond the four above.

Google user data — editors (optional sign-in)

Invited editors may optionally sign in with Google for identity only. That flow requests just openid, userinfo.email, and userinfo.profile — we receive the editor's name, email, and profile picture, and nothing else. No YouTube scope is ever requested from an editor, we receive no standing access token for them, and an editor's Google grant carries no power over any channel. Editors never hold YouTube credentials through VidGate.

Content you provide

  • metadata drafts and their full revision history;
  • proposed thumbnail images uploaded for review (up to 2 MB each);
  • video files (cuts) uploaded to a project's working vault for review;
  • review discussion: timestamped comments, replies, resolutions, and on-video pen annotations;
  • workspace activity events (who submitted, approved, pushed, published, or deleted what, and when) — kept so owners can audit exactly what happened on their channel.

Beta access requests

If you request beta access, we store the email address and optional channel link you submit, together with where you first arrived from: the page you landed on, the site that linked you (if your browser reported one), and any campaign tags in that link. Your browser keeps this first-arrival note in its own local storage and sends it only when you submit the form — it is never sent otherwise.

Technical data

A session cookie keeps you signed in and a short-lived cookie protects Google sign-in against request forgery. Our infrastructure providers keep standard operational logs (such as request timestamps and status codes) to run the service. We use Cloudflare Web Analytics to count page visits in aggregate; it sets no cookies, does not identify individual visitors, and does not record the query string of the pages you visit. We run no advertising trackers.

2. How we use information

We use the data above for exactly one purpose: operating the approval workflow you see — authenticating you, showing drafts and diffs to the right workspace members, playing uploaded cuts back to reviewers, attributing comments and approvals, executing the YouTube API calls the channel owner explicitly approves, and emailing you transactional notices (sign-in links, invites, publish results). We do not use your data for advertising, do not build profiles, do not sell or rent data to anyone, and do not use Google user data to train machine-learning or AI models.

3. Limited Use disclosure

VidGate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. YouTube API Services

VidGate uses YouTube API Services. By using VidGate you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke VidGate's access to your Google account at any time via Google security settings — revocation takes effect immediately.

5. How we store and protect data

  • OAuth tokens are encrypted at rest with AES-256-GCM, decrypted only for the moment an API call the owner triggered requires them, and never written to logs.
  • Account records, drafts, revision history, comments, annotations, and activity events live in our PostgreSQL database, hosted by Supabase.
  • Uploaded video files and proposed thumbnails are stored in Cloudflare R2 object storage, encrypted at rest by Cloudflare. Uploads and playback use short-lived, per-file signed URLs — the storage bucket is never publicly listable or readable.
  • All traffic is encrypted in transit (TLS).
  • We keep a daily backup of the database (in which token columns remain AES-256-GCM ciphertext) in Cloudflare R2; each backup is automatically deleted after 30 days.
  • Access is workspace-scoped: editors see only the projects of workspaces they were invited to, and never a channel's data beyond the videos under review there.

6. Sharing and service providers

We do not sell your data, use it for advertising, or share it with third parties for their own purposes. Data is processed only by the service providers that run VidGate on our behalf, each bound to process it solely for us:

  • Supabase — database hosting;
  • Cloudflare — application hosting, content delivery, file storage (R2), and aggregate page-visit counts (Web Analytics);
  • Resend — transactional email (sign-in links, invites, notifications);
  • Google / YouTube — receives exactly the metadata, thumbnail, or video file that a channel owner explicitly approves and pushes to their own channel.

We would disclose data if required by law, and only after verifying the request is valid.

7. Cookies

VidGate sets two cookies, both strictly necessary: a session cookie that keeps you signed in, and a short-lived state cookie during Google sign-in that prevents request forgery. No analytics, advertising, or cross-site tracking cookies — which is why you see no cookie banner.

8. Retention and deletion

  • Disconnecting your channel — or revoking access from Google security settings — immediately invalidates our tokens; we mark the channel disconnected and stop all API access.
  • Superseded video cuts (older uploads not bound to an approval) are automatically and permanently purged 30 days after a project is published; owners can also clear them at any time with one click.
  • When an owner deletes a project, its video files, thumbnails, drafts, comments, and annotations are permanently removed from storage.
  • To delete your account and all stored data, email support@vsaasify.com from your account address — we complete deletion within 30 days. Deleted data also ages out of backups within a further 30 days.

9. Children

VidGate is a professional tool for channel owners and their editors. It is not directed at children, and we do not knowingly collect personal information from anyone under 13 (or the higher minimum age of your country). If you believe a child has provided us data, contact us and we will delete it.

10. Your rights

You can access the data you have stored in VidGate from your dashboard, correct your account details, export your drafts and revision history, disconnect your channel, and request full deletion (section 8). Depending on where you live you may have additional statutory rights (such as access, rectification, erasure, and portability); to exercise any of them, email support@vsaasify.com.

11. Changes and contact

We will update this page when our practices change and note the date above; material changes will also be announced in-app or by email. Questions about this policy or our data practices: support@vsaasify.com.