Privacy Policy

We collect only what's needed to scan and repair broken affiliate links in your own content:

• Your email address (from Google sign-in)
• Your YouTube channel ID
• Your YouTube OAuth refresh token, encrypted (AES-256-CBC) before it is ever written to our database
• Your region and currency, detected at signup, used to show correct pricing and route billing

We deliberately do not collect or store:

• Video view counts, watch time, or any other analytics data
• Subscriber counts
• Audience demographics
• Your payment card details — these are held entirely by our payment processors (Stripe / Paystack), never by us

Your data is used solely to scan your YouTube video descriptions for broken affiliate links and, if you choose, to repair them. We request only the youtube.force-ssl OAuth scope — enough to read and edit video descriptions, never account ownership, deletion, or analytics scopes. We do not use your data to build audience profiles, train recommendation systems, or for any purpose beyond this core link-repair function.

Your data remains active for as long as your account exists. When you disconnect a channel, its connection data is deleted immediately. When you delete your account, everything tied to it — connected channels, scan history, discovered leaks, and ignored-link preferences — is deleted immediately and irreversibly as part of the same cascade.

We use the following processors to operate the service. None of them receive more data than they need to perform their function:

• Supabase — database hosting and authentication
• Google — OAuth sign-in and the YouTube Data API (the source of your channel data)
• Stripe — billing and payment processing (primary)
• Paystack — billing and payment processing (Nigeria only)
• OpenAI — suggesting replacement URLs for broken links
• Trigger.dev — running scan and heal jobs in the background
• Resend — sending account and billing emails
• Upstash — rate limiting (stores request identifiers briefly, not account data)
• Vercel — application hosting

We do not sell your data to anyone, for any reason.

Depending on where you live, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data — use the "Delete Account" button in Settings for immediate, complete erasure
• Port your data to another service
• Restrict or object to our processing of your data

To exercise any of these rights, email privacy@legacylinkhealer.com. EU/UK users may also lodge a complaint with their local Data Protection Authority.

We do not sell your personal information to third parties. California residents can request details of what we hold or request deletion via the "Your Privacy Choices" link in the footer, or by emailing privacy@legacylinkhealer.com. We respond to verified requests within 45 days.

For users in India: signing in with Google and connecting a channel constitutes your consent to the collection described above, limited strictly to the purpose stated in this policy. You may access, correct, or erase your data as described under "Your rights." Our grievance officer can be reached at privacy@legacylinkhealer.com.

For users in Brazil: the legal basis for processing paid accounts is contract performance; for free accounts it is legitimate interest in operating the free audit feature you requested. Our Data Protection Officer can be reached at privacy@legacylinkhealer.com.

Questions about this policy: privacy@legacylinkhealer.com. See also our Record of Processing Activities.