Miklagard Supply
YouTube Integration Privacy Policy
Effective and last updated: October 8, 2026
This policy describes how the locally operated Miklagard Supply YouTube Publisher accesses, uses, stores, and discloses Google user data. The application is an internal desktop workflow used for the Miklagard Supply YouTube channel. It is not offered as a public consumer application.
Google user data the application accesses
Depending on the operator-approved OAuth step, the application can access:
- the YouTube channel ID for the signed-in Google account and the channel ID resolved for the fixed
@MiklagardSupplyhandle; - the video ID, channel ID, privacy value, metadata, and processing status of a video handled by this workflow; and
- OAuth access and refresh tokens, the scopes granted to those tokens, and token expiration information returned by Google.
The application requests only youtube.readonly for channel verification and status readback, and youtube.upload for the separately controlled private-upload path. It does not request access to Google email, contacts, Drive files, subscriber lists, comments, likes, playlists, or YouTube Analytics.
How Google user data is used
- To verify that the signed-in Google account resolves to the fixed Miklagard Supply YouTube channel before a token is accepted.
- To obtain a new short-lived access token from Google when a stored refresh token remains valid.
- To upload one exact operator-selected MP4 and its title, description, tags, language, audience setting, and disclosure metadata to YouTube as private after a separate explicit command.
- To read the resulting video and processing information, support bounded resumable transfer, and avoid duplicating an upload after an uncertain response.
The implemented Google API path does not make videos public, schedule publication, delete videos, post comments, manage captions, or change channel settings.
Data sent to Google and YouTube
During OAuth, the application sends the OAuth client identifier, requested scopes, a loopback redirect address, state value, and PKCE challenge to Google. It exchanges the returned authorization code with Google's token endpoint. During an explicitly authorized private upload, it sends the selected video file and its YouTube metadata to YouTube. During verification and readback, it sends authenticated requests for the relevant channel and video records.
Local storage
The application stores its operational data on the operator's Windows computer. OAuth tokens are stored in a Windows DPAPI-encrypted file bound to the current Windows user. A resumable upload session URL is stored encrypted in the local SQLite ledger. The local vault also contains the desktop OAuth client configuration.
The ledger can contain the pinned YouTube channel ID, immutable release manifest, media hash, video ID and URL, processing state, workflow events, attempts, errors, retry timing, and request counters. These records support channel safety, resumable transfer, duplicate prevention, and local audit history.
Retention and deletion
The application currently has no automatic retention schedule and no automated deletion workflow. Encrypted credentials and ledger records remain in the local application vault until they are intentionally handled by the operator or the local environment is replaced. Google may separately expire or invalidate a token.
Revoking the application's access in the Google Account permissions page prevents future authorized API access, but it does not automatically erase the application's local ledger, remove its encrypted local token file, or delete a video from YouTube. The application does not implement remote video deletion.
Questions or a request concerning locally stored application data may be sent to contact@support.miklagardsupply.com. Such requests are reviewed and handled manually; this statement does not represent an automated deletion feature.
Disclosure and sharing
The application transmits Google authorization data and YouTube channel/video requests only to the Google and YouTube endpoints needed for the functions described above. It does not sell Google user data, use it for advertising, or transfer it to data brokers. The local application has no third-party analytics integration.
Use and transfer of information received from Google APIs is limited to providing and improving the disclosed application functions and is intended to comply with the Google API Services User Data Policy, including its Limited Use requirements.
Security controls
The implemented controls include OAuth state validation, PKCE S256, a loopback callback on 127.0.0.1, exact-scope validation, fixed channel-ID verification, Windows DPAPI encryption for stored tokens, encrypted storage of the resumable session URL, a restricted local vault, process locking, and atomic replacement of a validated refreshed token. No method of electronic storage or transmission is guaranteed to be completely secure.
Public website data
This dedicated policy covers Google user data handled by the local YouTube application. Browsing this Fourthwall-hosted website can involve separate storefront cookies, logs, analytics, ecommerce, and support processing described in the general Miklagard Supply Privacy Policy. The storefront policy does not replace this YouTube integration disclosure.
Changes and contact
If the application's actual Google data practices change, this policy will be updated before the new practice is used. The updated date at the top will identify the current version.
Contact: contact@support.miklagardsupply.com