Privacy policy

SubPulse uses Google OAuth and the YouTube Data API v3. With your permission, it may access your YouTube channel identity, subscription list and subscription identifiers, and video and channel metadata needed to build your feed. It uses the YouTube scope shown on Google's consent screen so it can display subscriptions and perform a subscription change only when you explicitly request and confirm it.

Google presents the authorization screen directly. SubPulse never receives or stores your Google password.

Google user data is used only to authenticate your account, retrieve your subscriptions, retrieve recent uploads and related metadata, display your SubPulse feed and subscription information, refresh that information, and complete a user-requested subscription-management action. SubPulse does not use Google user data for advertising, credit decisions, profiling, or unrelated purposes.

SubPulse does not sell, rent, trade, or share Google user data with advertisers, data brokers, analytics providers, or other unrelated third parties.

• Google LLC and YouTube: SubPulse sends OAuth and YouTube API requests to Google only as necessary to authenticate you, retrieve the data you request, refresh authorization, revoke authorization, and perform features you initiate.
• SubPulse OAuth service: The SubPulse-operated service at oauth.subpulse.myreadygo.com transiently processes authorization codes, PKCE verifiers, refresh tokens, and Google token responses only to complete or refresh OAuth authorization. It does not store this Google user data in a database or use it for another purpose. The application code does not log OAuth tokens.

SubPulse may disclose information only when required by applicable law or a valid legal process. It does not otherwise transfer or disclose Google user data.

• All OAuth-service, Google OAuth, and YouTube API traffic uses HTTPS/TLS encryption in transit.
• Authorization uses OAuth 2.0 Authorization Code with PKCE (S256), cryptographically random state values, signed time-limited server state, and an allowlist of approved Chrome and Firefox extension redirects.
• The Google OAuth client secret is kept only as a protected server-side environment secret and is never embedded in the extension.
• OAuth access and refresh tokens are stored in the browser extension's isolated local storage for the user's browser profile. They are not placed in browser sync or SubPulse backup exports.
• SubPulse requests only the Google scope needed to provide the feed and user-initiated YouTube subscription-management features.
• Disconnecting SubPulse attempts to revoke Google authorization and removes locally stored OAuth tokens, pending authorization data, cached subscription data, and account state.

The extension may store settings, cached feed and subscription data, watched and manually removed video history, appearance preferences, notification state, and Google OAuth tokens in browser extension storage. Supported compact settings or history may be synchronized by the browser if browser sync is enabled. User-created JSON backups stay under the user's control and exclude OAuth credentials and tokens.

The OAuth service does not persist Google user data after completing an individual token-exchange or token-refresh request. Data held by the extension remains until the user disconnects, clears it, or uninstalls the extension, subject to the browser's own storage and sync behavior.

SubPulse does not operate its own advertising, analytics, telemetry, behavioral-tracking, or profiling service. It does not maintain a developer-operated database of users' YouTube feeds or subscription lists.

You can disconnect SubPulse, revoke its access in your Google Account, clear locally stored SubPulse information, remove or restore videos, export or import supported non-credential data, or uninstall the extension at any time.