Privacy Policy
KucingHitam Uploader ("the tool") is private software operated by an individual developer to manage a YouTube channel they own. It is not a public service and has no users other than its operator. This policy explains exactly what data the tool touches, where it lives, and how it is deleted.
The short version
- The tool has exactly one user: its operator.
- It does not collect, store or process data belonging to anyone else.
- Nothing obtained from Google is sold, shared, or used for advertising or AI training.
- Data lives on a private home server; revoking access in your Google Account ends it immediately.
1. Information the tool accesses
When the operator authorizes the tool through Google OAuth 2.0 with the https://www.googleapis.com/auth/youtube scope, the tool can access the following data for the operator's own channel only:
| Data | Purpose |
|---|---|
| Channel identity | Confirm which channel is being published to (id, name, subscriber and video counts) |
| Own video metadata | Set and correct title, description, tags, category, thumbnail, privacy status and publish schedule |
| Own video statistics | Read views, likes and comments to evaluate which topics to publish next |
| Uploaded media | Video files produced by the operator, sent to YouTube via videos.insert |
The tool does not request Gmail, Drive, Calendar, Contacts, Analytics, or any other Google scope. It cannot read another channel's private data and does not perform search.list on third-party content.
2. Credentials and storage
- OAuth credentials (access token and refresh token) are stored in a single file on the operator's private server with filesystem permissions
0600, readable only by the operator's Unix account. - Tokens are transmitted only to
oauth2.googleapis.com(refresh) andwww.googleapis.com(YouTube Data API v3) over TLS. - There is no database of personal data, no analytics SDK, no advertising identifier, and no tracking cookie on this website. The site is static HTML.
- Server access is limited to the operator; the machine is not a shared or multi-tenant host.
3. How the data is used
Data is used solely to publish and manage the operator's own videos: uploading a file, naming it, setting a cover image, choosing when it goes public, and reading back performance of those same videos. No processing is performed for advertising, profiling, credit scoring, surveillance, or model training.
4. Sharing
No data received from Google APIs is transferred to any third party. The only outbound destinations are Google's own API endpoints. The tool does not operate a server that receives data from anyone other than its operator.
5. Google API Services User Data Policy — Limited Use
KucingHitam Uploader's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide the publishing features described above.
- It is not transferred to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice.
- It is not used for serving advertisements, including personalized or retargeted advertising.
- It is not used to determine creditworthiness or for lending purposes.
- No human reads the data, except the operator reading their own channel data, or where required for security, legal compliance, or with explicit consent.
6. Retention and deletion
- Local credential files are kept only while the tool is in use. They can be deleted at any time with
rm ~/.hermes/youtube_token.jsonon the operator's server. - Revoking the app's access at myaccount.google.com/permissions invalidates the refresh token within minutes; the tool then has no access at all.
- Uploaded videos and their metadata belong to the operator's YouTube channel and are deleted or edited through YouTube Studio, exactly like any manually uploaded video.
- Any request to delete data can be sent to the contact address below and will be handled within 7 days.
7. Security
Transport to Google is TLS-only. Credentials are never transmitted to any host other than Google's token and API endpoints, never sent over chat or email, and never committed to source control. Access to the host is protected by SSH key authentication. Some automated requests carry no credentials of any other person because no other person is involved.
8. Children
The tool is not directed at children and has no end users other than its operator.
9. Changes
If the tool's data handling changes, this page is updated and the "Last updated" date above changes with it. Because there is a single user, material changes are also visible to that user immediately.
10. Contact
Data controller: the operator of KucingHitam Uploader, an individual developer based in Indonesia.
Email: iqbaladinur@gmail.com