Security & data practices

Engagement Board helps YouTube creators manage, analyze, and respond to comments. This page explains, in plain language, exactly which Google permissions we request and why, what we store, and how we protect and delete everything you connect.

🔒 Encrypted

Your YouTube access tokens are encrypted at rest, and all traffic is encrypted in transit with TLS.

✋ You stay in control

We never post, reply, or moderate without your explicit action. Disconnect anytime.

🗑️ Delete on demand

Disconnect a channel or delete your account and we erase your data and revoke access with Google.

What happens when you connect a channel

1
Choose your Google account
You’re sent to Google’s own secure sign-in page. Pick the account that owns your YouTube channel — we never see your Google password.
2
Review the permissions Google shows you
Google lists exactly what you’re granting. The section below explains each permission and why we ask for it.
3
Click “Continue”
Google returns you to Engagement Board and hands us an access token, which we encrypt before storing.
4
Change your mind anytime
Disconnect from Settings, or revoke access directly in your Google account — either one cuts off our access immediately.

Which Google APIs & permissions we use — and why

We request the minimum permissions (“scopes”) needed for the features you use. Here is every scope we request and the reason for it:

Permission	What it lets us do
`youtube.force-ssl` Sensitive	Read your comments, and — only when you approve an action — post replies, moderate comments, and update your own videos, thumbnails, and channel details. Google classifies this permission as sensitive, so it is reviewed as part of Google’s OAuth verification.
`yt-analytics.readonly` Read-only	Read your channel’s analytics (such as views and engagement) to power your dashboards. We never modify analytics.

Why the write permission? Replying to comments, moderating, and updating your own content are core features, and the read-only YouTube permission cannot perform those actions. Because that capability can write to your channel, Google classifies youtube.force-ssl as a “sensitive” scope and requires an official verification review before an app may request it. Every write stays gated behind an action you take in the product — we never reply, moderate, or edit on your behalf automatically.

What data we access and store

OAuth access & refresh tokens for your connected Google/YouTube account (encrypted).
Your channel ID, channel title, and public channel statistics.
Comments and comment threads on your videos, and video metadata.
Caption tracks for your videos, where you use caption features.
Channel analytics from YouTube Analytics.
Derived data we generate to power features: sentiment scores, text embeddings for grouping/search, suggested replies, and content ideas.

How we protect it

Encryption at rest

Your YouTube OAuth tokens are encrypted in our database using authenticated symmetric encryption (Fernet / AES). Even with database access, tokens are not readable without the separate encryption key.

Encryption in transit

All connections to Engagement Board and to Google’s APIs use HTTPS/TLS, so data is encrypted as it travels over the network.

Least-privilege access

We request only the scopes our features need, and write actions happen only when you explicitly trigger them.

Access controls

Production data access is restricted, and channel data is owned by a single account — it is not shared between users.

Disconnecting & deleting your data

Disconnect a channel and we revoke the OAuth grant with Google and delete that channel’s stored data — tokens, comments, videos, sentiment data, embeddings, and drafts.

Delete your account and we revoke your YouTube grant(s) with Google, hard-delete your personal and content data, and anonymize your account record. We retain only the billing records required for accounting and tax compliance, in anonymized form.

You can also independently review or remove Engagement Board’s access at any time from your Google account at myaccount.google.com/permissions.

Who we share data with

We do not sell your data, use it for advertising, or use your content to train generalized AI models. We share data only with service providers that help us run the product, under confidentiality and data-protection obligations:

Google / Firebase — authentication and the YouTube API Services.
OpenAI — generating reply suggestions and analysis (only the data needed for the feature you use).
Stripe — payment processing.
Google Cloud — hosting and storage.
Resend — transactional email.

The verification review

As part of Google’s requirements for the sensitive youtube.force-ssl permission, Engagement Board has completed Google’s OAuth verification review. Google reviewed our OAuth consent flow, our privacy policy, and how each requested scope is used, and confirmed our handling of your data complies with the Google API Services User Data Policy, including its Limited Use requirements. We keep our verification current on Google’s required schedule.

Questions?

We’re happy to answer anything about how we handle your data. Email info@secondlifesoftware.com.

See also our Privacy Policy and Terms of Service.