Privacy should explain the whole claim.

What a creator provides

An adult creator or parent/legal guardian selects a role, confirms the published-video requirements, authorizes a one-time Google/YouTube ownership check, selects public videos, chooses one category and tagline, and gives versioned publish consent. VRank does not ask for a birth date, legal name, home address, phone number, school, precise location, or private social handle.

Google and YouTube data

VRank uses Supabase Auth for the app account and requests only the Google identity scopes needed for sign-in plus youtube.readonly. The Google provider access token is used once on the server to call YouTube's owned-channel endpoint. Provider access and refresh tokens are not retained in VRank application tables or analytics and are removed before the VRank app session is written to the browser.

After ownership, VRank may store the selected public channel ID, channel name, handle, avatar URL, public subscriber state, public channel views, uploads-playlist ID, selected public-video metadata, refresh times, and ownership timestamp.

What becomes public

Nothing becomes public merely because ownership succeeds. Before approval, the pending profile is visible only to its authenticated owner. After operator approval, the channel identity, category, tagline, ownership-confirmed state, and approved public YouTube facts may be published. A public derived ranking remains disabled until the documented YouTube policy and data gates are cleared.

Claim and publication analytics

VRank records a small first-party allowlist of claim milestones and failure categories. Operator review adds only claim_decided with the narrow approved/rejected/paused outcome and structured reason code, plus profile_published with the truthful non-ranked status. Private operator notes are never copied into analytics. These events can contain a random session ID, claim/account/profile IDs after authentication, step name, safe outcome code, channel-count total, selected-video count, category, and policy version. If a new session begins on a published creator profile, an encrypted 30-minute cookie may hold that profile and classify the entry only as external or direct/unknown; that narrow source is copied to a claim only if the claim starts within the same window. VRank does not retain the referrer URL. Events do not contain OAuth codes, provider tokens, passwords, raw IP addresses, full referrers, user-agent strings, search text, session replay, fingerprints, or cross-site advertising identifiers.

Retention and control

Public YouTube metadata must be refreshed or deleted within the applicable policy window. Claim analytics are intended for a 30-day operating window. While a creator account exists, VRank keeps the structured claim decision, decision timestamp, reviewer identifier, and any short private operator note needed to explain the active review state. A creator can use Data deletion to immediately unpublish and remove the VRank account, claim, profile, selected-video records, operator decision history/notes, and linked product events. No separate product archive is kept after successful deletion. Limited provider security, backup, or legal-compliance records may remain under processor obligations and are not used to recreate the profile. Google authorization can also be reviewed in Google's security settings. Deleting VRank data does not delete anything from YouTube.

Processors and terms

VRank's intended V1 processors are Vercel for the application and Supabase for authentication and Postgres. The product uses the YouTube Data API and is subject to the YouTube Terms of Service and Google Privacy Policy.

Questions or correction

Use the Safety, correction, and ownership path. Do not send passwords, one-time codes, identity documents, or unnecessary information about a minor.