Privacy Policy

YTStats.io Chrome extension and website · Last updated: October 15, 2026

YTStats.io is a Chrome extension and a website that show YouTube creators their own channel statistics. The extension lets them make shareable stat cards. The website has a dashboard with videos, a road to monetization tracker, daily trends, an AI coach, an optional leaderboard and an optional Pro subscription. This policy explains what each part reads, what stays on your device, and what is stored on our server.

1. Who we are

YTStats.io is an independent project run by a solo developer based in Sweden. You can reach us at osmcraft1@gmail.com. YTStats.io is not affiliated with, endorsed by, or sponsored by YouTube or Google.

2. What the extension reads from Google and YouTube

When you click connect, you sign in with Google and grant these read-only permissions:

• youtube.readonly: your channel name, handle, picture, and your list of videos with their public stats.
• yt-analytics.readonly: your own channel's YouTube Analytics, such as daily views, watch time, subscribers gained and lost, average view duration, and per-video figures.

This data is requested directly from Google by your browser and used to draw the charts, calendar, insights and stat cards. It is not sent to our server (except as described in section 5).

3. YouTube Studio

On studio.youtube.com the extension reads the "Stayed to watch" (swipe ratio) figure that YouTube Studio itself shows you, because it is not available in the public API. To do this it uses your existing YouTube Studio session: it creates the request signature locally from your YouTube login cookie and sends that request only to studio.youtube.com. Your cookie is never sent to us or to any other site. The extension also adds a YTStats.io button to the Studio page.

4. What is stored on your device

The extension saves the following in your browser's local extension storage: your connected channel's name and handle, cached per-video swipe ratio values, whether you joined the leaderboard, and technical settings needed to read Studio figures. Images you pick as card backgrounds are used in your browser only and are never uploaded. Removing the extension deletes this data.

5. Optional leaderboard in the extension

The extension leaderboard is off by default. It only works if you press Join in the Leaders tab.

• What is sent: a short-lived Google access token, sent to our server (a Cloudflare Worker). The server uses it for two requests to YouTube only: who you are, and your real views over the last 7 days. The token is not stored or logged by us.
• What we store: your channel ID, channel name, channel handle, profile picture link, your 7-day view count, and the time of the last update.
• What others see: the leaderboard publicly shows your channel name, handle, profile picture and 7-day views, together with your rank, to every user of the extension. Only join if you are happy with this.
• Updates: while you are joined, the extension refreshes your entry about once an hour.
• Deleting your entry: press Leave in the Leaders tab and your entry is deleted. If the extension stops syncing, your entry is removed automatically after 7 days.

Our server runs on Cloudflare, which as our infrastructure provider may process technical connection data (such as IP addresses) in order to deliver the service. We do not use this to identify you.

6. The website (ytstats account and dashboard)

The website is separate from the extension. It stores data on our server (Cloudflare Workers and a Cloudflare D1 database) only after you sign in.

• Signing in: you sign in with Google. We receive and store your Google account ID, name, email address and profile picture link, plus your plan and the times you created your account and last logged in. A session cookie keeps you signed in for up to 30 days.
• Connecting a channel (optional): if you press Connect channel, you grant the same two read-only permissions as in section 2. We store your channel ID, channel name, handle, picture link, subscriber count (if public), and a Google refresh token. The refresh token is encrypted before it is saved.
• What we read: with that token our server reads your channel's videos and YouTube Analytics (watch time, views, Shorts views, subscribers, retention and traffic sources) to show your dashboard and your road to monetization. These figures are fetched when you open the page. We keep only the daily snapshot and the leaderboard snapshot described below.
• Daily history (trends): once a day for every connected channel we save a snapshot of your subscribers (if public), watch hours for the last 12 months and 90 days, and Shorts views for the last 90 days. To do this our server uses your stored refresh token in the background about once a day, even when you are not using the site. Free accounts keep about 30 days of snapshots and Pro accounts about 12 months. They are used only to show your trends and to write your weekly email, and they are deleted when you press Disconnect, revoke access in your Google account, or delete your account.
• Weekly email: if you have a connected channel we send you one short email a week, from our email provider Resend, with how your numbers changed. It goes to your account email address and is on by default. You can switch it off in Settings, or with the unsubscribe link in every email. We store whether it is on and the week we last sent it.
• Ask box (AI coach): if you type a question in the Ask box on your dashboard, our server sends your question together with a short summary of your own channel (channel name, subscriber count, Partner Program progress numbers, recent views, and the titles, ages, lengths, views and likes of your latest videos) to an AI model provider, Anthropic, to write the answer. This only happens when you submit a question. The summary is used only to answer you, is not used for advertising, and is not used by us or, under the provider's API terms, to train AI models. Each question uses credits. We store only your credit balance (to apply the limit), not your questions or the answers. Your chat history is saved only in your own browser on the device you use, so you can reopen it later. It is not sent to or kept on our server, and you can delete any chat with the × next to it.
• Video Lab (optional): when you unlock a video, our server sends that video's title, description, tags, length, age and public numbers (views, likes and comments), together with your channel name, to an AI model provider, Anthropic, to write ideas for a title, tags and a description. This only happens when you unlock a video, and it uses credits. We store which videos you unlocked and the ideas that were written for them, so you can open them again without paying twice. They are used only to show them to you, are not used for advertising, and are not used by us or, under the provider's API terms, to train AI models. They are deleted when you press Disconnect, revoke access in your Google account, or delete your account.
• Buying credits (optional): if you buy extra AI credits, you pay on a checkout page run by our payment provider, Stripe. Stripe collects your payment details, we never see or store your card number. We store a record of each purchase (the Stripe checkout ID, how many credits, and the date) so credits are added once and only once.
• Pro subscription (optional): if you subscribe to Pro, you pay on a checkout page run by Stripe, which can offer card, Apple Pay and Google Pay. We never see or store your card number. We store your Stripe customer ID, subscription ID, the status of the subscription, whether it is monthly or yearly, and when the current period ends, so we can give you Pro while it is active. You can change your card, switch plan, cancel and download invoices from the billing page linked in Settings.
• Help button (optional): if you send us a message from the help button, we store your email address, your message, the page you were on, your browser language and the time. We also store a scrambled (hashed) form of your account or IP address, only to limit spam. We use this to reply to you, and delete these messages after 180 days. This works whether or not you are signed in.
• Disconnecting: pressing Disconnect asks Google to revoke our access and deletes your stored channel details, refresh token, saved Video Lab ideas and any leaderboard entry.

7. Website leaderboard

The website leaderboard is off by default. It only includes your channel if you press Join leaderboard in the Leaderboard tab.

• What we store: your channel ID, name, handle, picture link, subscriber count, watch hours for the last 12 months, watch hours for the last 90 days, Shorts views for the last 90 days, and the times of your last update and check.
• Daily history: once a day while you are on the leaderboard we also save a snapshot of your subscribers, watch hours and Shorts views, and keep it for about 14 days. It is used only to show how much your progress moved this week, and it is deleted with your entry.
• What others see: other signed-in users of the website can see your channel name, handle, picture, subscribers, watch hours or Shorts views (whichever is closer to the Partner Program numbers), your progress, how much it changed this week, and your rank. It is not shown to people who are not signed in.
• Updates: while you are on the leaderboard, our server uses your stored refresh token to refresh your numbers in the background on a regular schedule, even when you are not using the site.
• Leaving: press Leave leaderboard and your entry is deleted. Disconnecting your channel, or revoking access in your Google account, also deletes it.
• Some Shorts figures can be estimated from your videos that are under 3 minutes when YouTube Analytics does not return a Shorts total. Estimates are labelled on the leaderboard.

8. What we do not do

• We do not sell your data or transfer it to third parties, except to our hosting provider (Cloudflare) as needed to run the website and leaderboards, to our AI provider (Anthropic) only to answer a question you submit in the Ask box or to write the ideas when you unlock a video in Video Lab, and to our payment provider (Stripe) only if you buy credits or subscribe, and to our email provider (Resend) only to deliver the support messages you send us and the weekly email described in section 6.
• We do not use your data for advertising, profiling, or credit and lending decisions.
• We do not use your data for anything unrelated to providing YTStats.io's features described here.
• We do not read or store your Google password.

9. How we protect your data

This section describes the technical and organisational measures we use to protect your data, including the sensitive Google user data (your YouTube channel and YouTube Analytics data) that you allow us to access.

• Read-only, minimum access: we only ask for the two read-only permissions in section 2. We cannot change, upload or delete anything on your YouTube channel, and we do not ask for any other Google data.
• Encryption in transit: all traffic between your browser or the extension, our server, Google, Anthropic, Stripe and Resend is sent over HTTPS (TLS). Our website also tells browsers to use HTTPS only (HSTS) and sends further security headers that prevent content sniffing, embedding of our pages in other sites and unnecessary sharing of referrer data.
• Encryption at rest: your Google refresh token is encrypted with AES-256-GCM before it is saved in our database. The encryption key is kept as a secret in Cloudflare's secret store, separate from the database and never in our code, so the database on its own does not reveal any token. The database itself (Cloudflare D1) is also encrypted at rest by Cloudflare.
• Short-lived access tokens: when we need to read your data, we use the encrypted refresh token to get a short-lived Google access token. It is used on our server for that request only, it is not saved, it is never sent to your browser on the website, and it is never written to our logs. (The extension leaderboard in section 5 is the one case where your browser sends a short-lived token to our server, which uses it once and does not store it.)
• Secure sign-in: your session cookie is cryptographically signed, marked HttpOnly (not readable by scripts on the page), Secure (only sent over HTTPS) and SameSite, and expires after at most 30 days. Signing in and connecting a channel both use a one-time state value that protects against forged requests.
• Access controls: every request for your data needs a valid signed session, and every lookup is limited to your own account, so one user cannot read another user's data. The only data other users can see is a leaderboard entry you chose to join. Access to our hosting account and database is limited to the developer.
• No human access to your Google data: nobody at YTStats.io reads your Google user data, unless you ask us to look at it to help you with a support request, it is needed to investigate abuse or a security problem, or the law requires it.
• Limited sharing: the AI provider only receives the text described in section 6 (your question and a short summary of your channel or video), never your Google tokens or password. Card details are handled only by Stripe, and Stripe's payment notifications to us are verified with a cryptographic signature before we act on them.
• Data minimisation and deletion: we store only what the features need. Old data is deleted automatically on a schedule (for example daily history after about 30 days on free accounts and about 12 months on Pro accounts, leaderboard history after about 14 days and support messages after 180 days). If you press Disconnect, revoke our access in your Google account, or delete your account, the matching data and your refresh token are deleted, as described in sections 6 and 11.
• Logging: our server logs technical errors so we can fix problems. These logs do not contain your tokens, your passwords or the content of your Google data.
• If something goes wrong: if a security incident affects your personal data, we will tell the affected users and the authorities without undue delay and as required by law.

No system is perfectly secure, but we aim to keep your data protected with the measures above. If you find a security problem, please email us at osmcraft1@gmail.com.

10. Google API Services User Data Policy

YTStats.io's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Your choices and rights

• Press Leave in the extension, or Leave leaderboard on the website, to remove your leaderboard entry at any time.
• Press Disconnect on the website dashboard to revoke our YouTube access and delete your stored channel data and token.
• Revoke access to your Google account at myaccount.google.com/permissions.
• Uninstall the extension to delete everything it stores on your device.
• To delete your website account, open Settings in the dashboard and press Delete account. This deletes your account, sign-in details, channel connection, daily history, saved Video Lab ideas, credits, leaderboard entry and support messages, revokes our YouTube access and cancels any Pro subscription straight away. We keep only the record of each payment (the Stripe checkout ID, credits and date, no longer linked to you), and Stripe keeps its own payment and invoice records, because accounting law requires it. Settings also lets you download a copy of the data we hold about you.
• If you are in the EU/EEA, you have the right to access, correct or delete the data we hold about you, and to complain to your data protection authority (in Sweden, IMY). Write to the address above and we will respond.

12. Children

YTStats.io is not directed at children under 13 and we do not knowingly collect data from them.

13. Changes

If we change what we collect or how we use it, we will update this page and the date at the top before the change takes effect. Payments for credits and subscriptions are described in section 6.