Privacy Policy

1. Scope

Music Brain is currently a private Personal MVP and invited-testing application. It provides user-authorized music and video organization, playlist management, cross-provider matching, and first-party preference memory.

2. YouTube API Services

Music Brain uses YouTube API Services, specifically the official YouTube Data API v3, together with Google OAuth 2.0. Use of YouTube features is also subject to the YouTube Terms of Service. Google's handling of information is described in the Google Privacy Policy.

3. Information Music Brain may access

Depending on the workflow and permissions granted by the user, Music Brain may access:

• basic YouTube account/channel identity needed to identify the authorized account;
• user-owned YouTube playlists and playlist items;
• video, channel, playlist, title, description, duration, and related metadata returned by the YouTube Data API;
• search results requested for user-initiated music or video discovery and cross-provider matching;
• liked-video or rating state only when required for a user-requested library action;
• OAuth access and refresh tokens needed to perform authorized API requests.

Music Brain does not request, collect, or store the user's Google or YouTube password.

4. How information is used

Information is used only to provide the functionality requested by the authorizing user, including reading and organizing playlists, searching YouTube, matching recordings across providers, creating or editing user-owned playlists, avoiding duplicate work, and resuming authorized jobs safely.

Music Brain does not use YouTube API Data for surveillance, advertising profiles, or unrelated secondary purposes.

5. Storage, caching, and retention

Music Brain stores only the limited account, authorization, mapping, job, and provider metadata needed to provide its user-authorized functionality. OAuth credentials are stored by the Music Brain backend in encrypted form. Provider access is transmitted over HTTPS.

Search results and provider mappings may be cached to reduce duplicate API requests and conserve quota. Music Brain's retention policy is to refresh or delete YouTube API Data within the time periods required by the YouTube API Services Developer Policies. Unless a policy expressly permits longer storage, stored YouTube API Data is refreshed or deleted no later than 30 calendar days after it was obtained.

6. Sharing and third parties

Music Brain does not sell YouTube API Data. It does not provide YouTube API Data to advertisers. API results may be presented to the authorizing user through ChatGPT, which the user has chosen as the Music Brain interface, and may be processed by the infrastructure providers necessary to operate the service. Access is limited to the purposes described in this policy.

The public informational pages at this domain do not contain third-party advertising or behavioral analytics.

7. User control over actions

The authorizing user remains in control of actions performed on their account. Music Brain identifies requested write operations and uses explicit authorization/confirmation for narrow destructive actions where supported. It does not silently change unrelated content.

8. Revoking Google/YouTube access

A user can revoke Music Brain's Google/YouTube authorization at any time through Google Account permissions. Revoking access stops future authorized API requests once revocation is detected.

9. Requesting deletion of stored Music Brain data

Because this is a private Personal MVP, users can request deletion through the same private communication channel through which access to Music Brain was provided. The request should identify the Google/YouTube account whose Music Brain data should be removed.

Music Brain will delete stored user data associated with a valid deletion request as soon as practicable and no later than 7 calendar days, except information that must be retained by law. When authorization has been revoked and that revocation is detected, associated Authorized Data is also removed in accordance with the applicable YouTube API Services policies.

Deleting data stored by Music Brain does not delete data stored by YouTube. To delete playlists, videos, likes, or other content held by YouTube itself, the user must use YouTube or another authorized client that supports that action.

10. Security

Music Brain uses HTTPS transport, encrypted provider credentials, scoped OAuth permissions, bounded API operations, and access controls intended to prevent unauthorized access or disclosure. No internet-connected service can guarantee absolute security.

11. Policy changes

If Music Brain materially changes how it accesses or uses YouTube user data, this policy will be updated before the changed use is applied to users, and additional consent will be obtained where required.

12. Contact

During the private MVP, privacy and deletion requests are handled through the same direct communication channel used to grant the tester access to Music Brain. The primary developer contact is also supplied directly to Google in the YouTube API Services compliance submission.