1. Overview
YTT AI helps businesses manage their own social media presence. This policy
explains what data we access through Google APIs, how we use it, and with whom we
share it. Where we connect to non-Google platforms, the same principles apply
and are described in Section 10.

​

2. Google / YouTube data we access
We connect to YouTube through two separate features of the product. Each is
authorized independently, and you may grant or revoke them separately. We never
access a channel you do not own or control.

​

2.1 Comment inbox — read access
youtube.readonly
Used to identify the connected channel and to retrieve the comments published
on that channel's videos, so that they appear in your inbox. We retrieve:
channel id, title and thumbnail; and, for each comment and reply, its text,
author display name, publication time, like count, reply count, and moderation
status. The comments we retrieve include comments left by viewers on your
videos, because that is what the inbox displays. This data is shown back to you
in the same account's inbox and is not used for any other purpose.

​

2.2 Comment inbox — reply access (requested separately)
youtube.force-ssl
This scope is requested in a second, separate authorization, and only at the
moment you choose to enable replying. Users who only read comments never grant
it. It is the narrowest scope YouTube provides for posting a comment: the
YouTube Data API offers no comment-only write scope, and comments.insert
requires youtube.force-ssl. We use it for exactly one operation — inserting a
public reply, in the exact text you typed, to the specific comment thread you
selected. A reply is published only after you press send. Although this scope
technically permits broader actions, we do not use them: we do not edit or
delete videos, ratings, comments or captions, and we do not modify any channel
setting.

​

2.3 Scheduled publishing and analytics
youtube.upload — to upload the videos you schedule, to your own channel. Videos
are uploaded as private by default and are published only according to your
scheduling.
yt-analytics.readonly — to retrieve daily views and subscriber metrics for the
performance dashboards and weekly reports you request. This scope is required
by the YouTube Analytics API and returns data only for your own channel.

​

3. Storage and retention
We store the OAuth tokens (encrypted at rest) needed to act on your behalf,
together with the comments we retrieve and the replies you send. Comment content
is retained while the channel remains connected. Disconnecting a channel in the
app revokes access and deletes the stored tokens and cached comments. You may
also revoke access at https://myaccount.google.com/permissions.

​

4. Data protection and security
Security procedures are in place to protect the confidentiality and integrity of
your data, including Google user data. All data is transmitted over encrypted
connections (HTTPS/TLS), and OAuth tokens are encrypted at rest. Access to user
data is restricted to authorized systems and personnel, and is used only to
provide the features described in this policy. We take reasonable measures to
protect your information against unauthorized access, disclosure, alteration, or
loss.

​

5. Sharing and disclosure of Google user data
We do not sell Google user data. We disclose it only to the recipients below, and
only to the extent needed to operate the features you request.

- Infrastructure and hosting. We run this service on Google Cloud, using Cloud
  Run to host the application and Google Cloud SQL for the database. These
  services process data on our instructions.

- Professional advisers and authorities. We may disclose data where required by
  law, or to protect the rights and safety of YTT AI, our users, or the public.

We do not share Google user data with advertising networks, data brokers, or other
third parties for their own purposes.

Artificial intelligence. We do not send Google user data to any artificial
intelligence or large language model provider, and we do not use it to train any
machine learning model. If this changes in future, we will update this policy
before doing so and will update the effective date above.

Storage location. This service is hosted on Google Cloud. Your data, including
Google user data, may be processed outside your country of residence, in Google
Cloud regions in the European Union and in the United States (us-central1). Data
transferred across borders is protected as described in Section 4.

Human access. Authorized personnel may access Google user data only for security,
troubleshooting, and legal compliance, and only where necessary. Otherwise,
Google user data is not accessed by humans.

If you have questions about who processes your data, contact us at
ytt1998sg@gmail.com.

​

6. Limited Use
Our use and transfer of information received from Google APIs adheres to the
Google API Services User Data Policy
(https://developers.google.com/terms/api-services-user-data-policy), including
the Limited Use requirements. We use the data only to provide the features above;
we do not use it for advertising; we do not transfer it to third parties except
as described in Section 5; and we do not allow humans to read it unless you
consent, it is necessary for security or legal reasons, or it is aggregated and
anonymized. We do not use Google user data to train any machine learning or
artificial intelligence model.

​

7. YouTube API Services
This application uses YouTube API Services. By using it you also agree to the
YouTube Terms of Service (https://www.youtube.com/t/terms). Google's handling of
data is governed by the Google Privacy Policy
(https://policies.google.com/privacy).

​

8. Data deletion
To delete your data, disconnect the channel in the app or email
ytt1998sg@gmail.com. We delete stored tokens and cached comments on request.

​

9. Contact
Suzhou Shiyongxiang Management Consulting Co., Ltd. — ytt1998sg@gmail.com

​

10. Other connected social platforms
Beyond YouTube, YTT AI also connects to the platforms below. The same principles
apply to all of them: we access data only for the accounts you yourself connect;
we use it solely to provide the features you request; we never publish or post
without your explicit action; we store OAuth tokens encrypted at rest and delete
them when you disconnect the account. The storage and retention (Section 3),
data protection and security (Section 4), sharing and disclosure (Section 5), and
data deletion (Section 8) practices described above apply equally to every
platform in this section. We do not sell your data, do not use it for advertising,
and do not access accounts you do not own.

​

10.1 TikTok
When you connect a TikTok account you may grant: user.info.basic,
user.info.profile, user.info.stats — to obtain your open ID, display name, avatar,
and aggregate profile statistics (follower, like, and video counts) to identify
your account and power your dashboards; video.list (Display API) — to list videos
you published on your own account and read their public metrics (views, likes,
comments, shares) for your performance dashboards and reports; video.upload /
video.publish (Content Posting API) — to upload or publish the videos you schedule
to your own TikTok account, only on your explicit action. Where required, content
is posted privately until eligible, and any commercial-content or
branded-content disclosure is set by you at publish time. Our access to and use
of TikTok data comply with the TikTok Developer Terms of Service and TikTok's
Developer Policies.

​

10.2 X (Twitter)
Scopes: tweet.read, tweet.write, users.read, offline.access, media.write. We use
these to identify your account, read your recent posts and their public metrics,
upload media, and publish the posts you schedule — only on your explicit action.

​

10.3 Meta — Facebook Pages & Instagram
Permissions: pages_show_list, pages_manage_posts, pages_read_engagement,
pages_read_user_content, pages_manage_engagement, read_insights, instagram_basic,
instagram_content_publish, instagram_manage_insights, and instagram_manage_comments.
We use these permissions to list the Facebook Pages you are authorized to manage
and their connected Instagram Business or Creator accounts, publish content that
you explicitly create or schedule, and retrieve supported engagement and insights
for your dashboards. If you provide an optional first comment, we use
pages_manage_engagement or instagram_manage_comments to publish that comment after
the main post is published. For Facebook, pages_read_user_content may also be used
to check recent comments on that specific post and determine whether the
Page-authored first comment already exists before retrying, which prevents
duplicate comments. We access only accounts selected by you and use this data
solely to support the publishing, first-comment delivery, status tracking, and
analytics features you request.

​

10.4 Threads
Scopes: threads_basic, threads_content_publish, threads_manage_insights. We use
these to identify your Threads profile, publish the threads you schedule, and read
their insights.

​

10.5 LinkedIn
Scopes: for organization pages — w_member_social, r_organization_social,
w_organization_social, rw_organization_admin; for personal profiles — openid,
profile, w_member_social. We use these to identify you or your organization,
publish the posts you schedule, and read post analytics.

​

10.6 Pinterest
Scopes: boards:read, pins:read, pins:write, user_accounts:read. We use these to
read your boards and account information and to publish the Pins you schedule.

​

11. Third-party platform terms and privacy policies
By connecting an account you also agree to that platform's terms of service, and
each platform's own handling of your data is governed by its privacy policy:

TikTok — Terms: https://www.tiktok.com/legal/page/global/terms-of-service/en ·
Privacy: https://www.tiktok.com/legal/page/global/privacy-policy/en
X (Twitter) — Terms: https://x.com/en/tos · Privacy: https://x.com/en/privacy
Meta (Facebook / Instagram) — Terms: https://www.facebook.com/legal/terms ·
Privacy: https://www.facebook.com/privacy/policy
Threads Supplemental Privacy Policy:
https://help.instagram.com/515230437301944
LinkedIn — Terms: https://www.linkedin.com/legal/user-agreement ·
Privacy: https://www.linkedin.com/legal/privacy-policy
Pinterest — Terms: https://policy.pinterest.com/en/terms-of-service ·
Privacy: https://policy.pinterest.com/en/privacy-policy
(YouTube / Google terms and privacy links are in Section 7.)