Privacy

What Uplora stores, what it never touches, and how to make all of it disappear.

What we store

The complete inventory. If it is not in this list, we do not have it.

google refresh token: sealed-box encryptedlibsodium sealed box; the decryption key lives in env/KMS, never in the database. Decrypted only inside the publish worker, at the moment of use — so approved videos can publish while you sleep.
channel metadata: id · title · thumbnail · subscriber countshows you which channel is connected. Refreshed or deleted within 30 days.
token status: last-verified timestampso a revoked grant flips the channel card to disconnected and you get notified, not surprised.
youtube video id: our uploads onlyonly videos Uplora itself uploaded — powers the deep link to the published video and its Studio page.
your account: email · namefrom your Clerk sign-in. No password — see the next section.
your uploads: masters · thumbnails · metadatawhat your editor submits and you approve, stored until you delete it.

What we never access

Your Google password. OAuth hands Uplora tokens, never credentials, so there is no password to see. Beyond that, the grant simply does not include: channel revenue or AdSense data, YouTube Analytics, your existing videos, your comments, your subscribers’ identities, or anything else in your Google account outside the two scopes listed on the security page.

No Google user data is sold, used for advertising, or transferred to anyone. Humans at Uplora cannot read your tokens; the key that decrypts them never touches the database.

Google API Services — Limited Use

Uplora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking is real deletion, not a flag. Disconnect a channel in Uplora — the button opens a dialog naming the channel, so it is never an accident — and we call Google's revoke endpoint and destroy the stored token ciphertext. The destruction happens even if the revoke call fails, so a dead ciphertext can never outlive the connection. Your channel's picture and subscriber count go with it. We keep the channel's name and id, because your published videos point at them — that is your record of where each one went.

Revoke from Google's side instead, at myaccount.google.com/permissions, and the verification job detects the dead grant, stops the channel publishing, notifies you, and destroys the ciphertext all the same.

Your content

Masters stay masters. The file your editor uploads is the file that reaches YouTube: original bytes, never transcoded, checked against a sha-256 checksum on arrival and again before publish. It is your content — Uplora publishes it to your channel when you approve, and does nothing else with it.

Export any time: the master, the metadata JSON, the thumbnail — the same package your approval locked. That includes after you cancel. Read-only mode still exports.

Third parties

Uplora runs on a small set of processors. What each one sees:

sign-in: Clerkyour email, name, and session. Uplora never stores a password.
database: Supabasethe rows in the table above, behind row-level security on every table.
file storage: AWS S3your video masters and thumbnails, nothing else.
billing: Paddleyour card and the billing address your country's tax rules need, when billing is on. It goes to Paddle directly — it never passes through Uplora, and we never see a card number.
delivery: Telegram · emailpackage titles and state changes — enough to approve from your phone, nothing more.

Paddle is the odd one out, and the difference matters to you: it is not a processor acting on our instructions but our merchant of record — the seller on your receipt. It decides what billing data the tax rules of your country oblige it to keep, and it holds that data as its own controller under its own privacy notice. Nothing about your videos, your channel or your team is sent to it — a workspace id and an email address are the whole of it.

Deletion

Deleting a workspace is a hard delete: packages, masters, thumbnails, metadata, cached channel data, and encrypted tokens are destroyed. One honest exception: the append-only audit log survives for 30 days after deletion, so a disputed approval can still be answered. Then it is deleted too.

Disconnecting a single channel deletes its token, picture and subscriber count immediately, as described above.

Contact

Questions, corrections, or a deletion request we should hurry: contact@uplora.io. A human reads it.