Privacy Policy

1. Who is responsible

The controller responsible for the data described here, within the meaning of the EU General Data Protection Regulation (GDPR), is:

Daniel Oberlechner
Email: [email protected]
Full postal address and further details: danobe.dev/imprint

2. What data we process, and why

2.1 Account data (Google sign-in)

When you sign in, Google sends us your Google account ID, email address and name. We store these together with the time of your last login and last activity. Your profile picture is shown in the dashboard during your session but is not stored in our database.

Purpose: to identify your account and link it to the playlists you monitor.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — providing the account-based service you signed up for.

2.2 Playlist monitoring data

For each playlist you choose to watch, we store its YouTube ID, URL and title, the list of video titles from each scan (snapshots), and a record of videos that have disappeared (title, channel name and a cached thumbnail image). We also keep technical scan settings and any scan error messages. This data comes from YouTube’s public API, not from your private Google account.

Purpose: to detect when a video is removed, deleted or set to private, and to show you its history.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.3 Email notifications

If you enable monitoring, we use your email address to send you a message when a video disappears from one of your playlists, or when a scan fails. We do not use your email for advertising or newsletters. Every email contains a one-click link to pause monitoring and stop all future emails.

Purpose: to deliver the notifications that are the core of the service.
Legal basis: consent (Art. 6(1)(a) GDPR), which you give by enabling monitoring and can withdraw at any time.

2.4 Technical access data

To protect the service from abuse and stay within YouTube’s API limits, our server temporarily processes your IP address for rate limiting. This happens in memory and is not written to a permanent user profile. Standard server logs may record technical request data for security and troubleshooting.

Purpose: security, abuse prevention and stable operation.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in running the service securely.

2.5 Analytics

We use Rybbit, a privacy-friendly analytics tool that we host ourselves on our own infrastructure. It collects aggregated usage statistics (such as page views and which buttons are clicked) without cross-site tracking and without selling data to third parties.

Purpose: to understand how the site is used and improve it.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving our service.

2.6 Session cookie

After you sign in we set a single encrypted cookie to keep you logged in. It is strictly necessary for the service to work and stores no tracking information. We do not use advertising or third-party tracking cookies.

3. Who we share data with

We do not sell your data. We share it only with the service providers we rely on to run PlayVault, each acting as a processor on our behalf:

• Google (Google Ireland Ltd. / Google LLC) — handles sign-in and provides the YouTube Data API we use to read your public playlists.
• Resend (Resend, Inc., USA) — delivers the notification emails. Your email address and the message content pass through Resend to reach your inbox.
• Hetzner Online GmbH (Germany) — hosts PlayVault on a virtual private server located in Germany, within the European Union.

4. International data transfers

Some of our providers (Google and Resend) are based in or process data in the United States. Where data is transferred outside the European Economic Area, it is protected by appropriate safeguards such as the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

5. How long we keep data

We keep your account and playlist data for as long as your account exists. When you delete your account, all of it — your user record, watched playlists, scan history, records of removed videos and cached thumbnails — is permanently and immediately deleted from our database and server. Temporary technical data (such as IP-based rate-limiting state) is held only briefly and then discarded.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting past processing.

You can act on several of these directly in the app: pause email notifications from any email’s unsubscribe link or from your dashboard, and permanently delete your account and all associated data from the dashboard. For anything else, contact us at [email protected].

7. Right to lodge a complaint

If you believe we have handled your data unlawfully, you may complain to a data protection authority. Our supervisory authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it). You may also contact the authority in your own EU country of residence.

8. Changes to this policy

We may update this policy as the service evolves. The “last updated” date at the top always reflects the current version.