Privacy policy

1. Who we are

PublishBench (“we”, “us”) provides a workspace for planning, researching, writing and preparing YouTube videos. We are the controller of the personal data described here. Contact us through the contact page for any privacy request.

2. What we collect

Information you give us

• Account details — email address, an optional display name, your chosen password (stored only as a scrypt hash, never in readable form), preferred language and time zone.
• Onboarding answers — your niche, audience, publishing goal and cadence. These pre-fill generation forms and nothing else.
• Content you create — projects, ideas, scripts and their version history, transcripts, thumbnails, folders, notes and everything you generate.
• Files you upload — images and audio, together with your attestation that you hold the rights to them.
• Support messages — your name, email address and the content of any message you send us.

Information we receive on your instruction

• Google account and YouTube data — only if you connect a channel. We request read-only YouTube access and your email address. We store your Google account id, email, and metadata about your channels and recent uploads. We cannot upload, edit or delete anything on your channel.

Information collected automatically

• Session data — a session identifier, the IP address and user-agent recorded when a session is created, and the time it was last used.
• Security and audit records — sign-ins, failed sign-in attempts, role and status changes, credit adjustments, channel connections and deletions. Values whose field names match token, password, secret, key or authorization are redacted before being written.
• Usage records — which features you used, credits consumed, and the token counts and cost of each AI call. Used for billing accuracy and capacity planning.

We do not use advertising trackers, third-party analytics scripts, or cross-site tracking of any kind. The only cookies we set are the two described in section 7.

3. Why we process it

• To provide the service (performance of a contract) — storing your work, running generations, enforcing plan limits.
• To keep the service secure (legitimate interests) — rate limiting, audit logging, abuse prevention.
• To take payment (performance of a contract) — subscriptions, top-ups and invoices.
• To send product updates (consent) — only if you opt in, and you can withdraw it in Settings at any time.

4. Where your content goes

When you run a generation, the relevant input — your prompt, and any source text or transcript you attached — is sent to the AI provider configured for that capability (OpenAI and/or Anthropic). This is what makes the feature work; there is no local model. We send the minimum required for the request and never attach your email address, account id or unrelated content.

Research features send only the search terms you type to the YouTube Data API. Article import fetches the URL you provide from our servers, subject to the safety checks in section 8.

5. Who else receives data

• AI providers — OpenAI and Anthropic, for the content of generation requests as described above.
• Google — for YouTube API requests, if you connect a channel or use research features.
• Stripe — for payments. Stripe receives your email address and payment details directly; we never see or store your card number.
• Our email provider — the address and content of transactional emails (verification, password reset, security notices).
• Our hosting and database providers — as processors storing the data described here.

We do not sell personal data, and we do not share it for advertising.

6. How long we keep it

• Account and content — until you delete your account, at which point it is removed immediately (see section 9).
• Sessions — 30 days maximum, revoked after 14 days of inactivity, and purged 7 days after expiry.
• Rate-limit counters — deleted after 24 hours.
• Research cache — 3 to 12 hours depending on the tool. It holds public YouTube data only, not anything personal to you.
• Audit and billing records — retained after account deletion where we have a legal obligation to keep them (tax and accounting records typically require several years). These retain the minimum needed: the event, the timestamp and an identifier, not your content.

7. Cookies

We set exactly two cookies, both strictly necessary:

• it_session — your session token. HttpOnly, SameSite=Lax, Secure in production. Without it you cannot stay signed in.
• it_csrf — a token your browser echoes back on write requests so we can verify they came from our own interface. Readable by our own scripts by design.

A third short-lived cookie, it_oauth_state, exists only for ten minutes during a channel connection, to prevent authorisation being completed into the wrong account.

8. How we protect it

• Passwords are hashed with scrypt and a per-user random salt.
• Session and email tokens are stored only as keyed HMAC digests, so a database copy does not yield usable tokens.
• Google refresh tokens are encrypted with AES-256-GCM before storage and decrypted only inside the module that calls Google.
• Every query for your data is filtered by your user id at the database level, not merely checked afterwards.
• Uploads are validated by declared type, file extension and magic bytes; markup files are refused outright, and stored files are served with a restrictive content policy so they cannot execute.
• URLs you ask us to fetch are resolved and checked against private and link-local address ranges on every redirect hop.
• Write requests require both a matching origin and a CSRF token; incoming payment webhooks are signature-verified and processed exactly once.

9. Your rights

• Access and portability — Settings → Your data downloads a complete JSON export of everything you have created. It deliberately excludes credentials.
• Correction — edit your profile and any content directly in the app.
• Deletion — Settings → Delete account. This requires your password and a confirmation link sent to your email address. On confirmation we revoke any Google authorisation, delete your stored files, and delete your account row — every table holding your data cascades from it.
• Objection and withdrawal of consent — turn off product updates in Settings; contact us for anything else.

Depending on where you live you may also have the right to complain to a data protection authority.

10. International transfers

Our processors (AI providers, Stripe, Google) may process data outside your country. Where required, transfers rely on the standard contractual clauses or equivalent safeguards those providers publish.

11. Children

PublishBench is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

12. Changes

If we make a material change we will notify signed-in users in the app before it takes effect. The date at the top of this page always reflects the current version.