Privacy Policy

1. Authentication & Session Security (Firebase Auth)

We utilize Firebase Authentication to verify your identity and protect access to your account. When you sign up or log in, your authentication state is synchronized with our server using a secure session token. This session token is stored in an HTTP-only, secure cookie named __session, which is required for our middleware to perform secure session verification on the server side.

2. Data Storage & Management (Google Firestore)

All user data created within the editor is stored securely in Google Cloud Firestore. This includes:

• User profile properties (email, metadata, settings).
• Project records, including script text files, analysis reports, and pacing segments.
• Script revisions history and rewrites created through our editor.

Your data is secured by custom firestore security rules ensuring that only you, the authenticated author, can access or write to your project collections.

Deep Optimize / portfolio optimization jobs may store job metadata (status, solver mode, model and coefficient versions, configuration hashes, execution receipts, and selected intervention IDs) in Firestore collections such as quantum_jobs and quantum_reports. Segment text used for optimization is kept within our application boundary. When an external quantum or hybrid solver is enabled in the future, we send only mathematical coefficients and opaque variable labels—not raw script text—to that provider. Provider tokens are never stored in the browser.

3. Rate Limiting & Abuse Prevention (Upstash)

To protect the availability of our artificial intelligence features and deter malicious actions, we enforce strict, IP-based rate limiting using Upstash Redis. We track the number of calls to our Gemini rewrite and analysis API endpoints using hashed IP addresses. Additionally, to protect against denial of service during resource-heavy operations, we rate-limit account deletion initiation requests.

4. Artificial Intelligence Processing (DeepSeek, Google Gemini, Groq)

When you submit a script for analysis or request rewrites, its text is sent to an AI provider to generate pacing analysis and revision suggestions. We attempt them in this order, and your script is sent only to the provider that answers:

• DeepSeek — primary provider. Operated by a company based in China, so this processing takes place outside the EU, UK and US.
• Google Gemini — used when DeepSeek does not return a usable result.
• Groq — used when neither of the above returns a usable result.

RetentionYT does not use your scripts to train its own models. We do not control third-party model training; the current data-usage terms of DeepSeek, Google Gemini and Groq for the applicable API tier govern how those providers may process submitted text.

5. Third-Party Sub-Processors

We rely on the following providers to operate RetentionYT. Each receives only the data required for its function:

• Google Firebase Authentication — account identity and secure sessions.
• Google Cloud Firestore — storage of your projects, scripts, audits, and settings.
• DeepSeek — primary AI provider for analysis and rewrites (processes script text). Based in China.
• Google Gemini — AI script analysis and rewrites (processes script text).
• Groq — final fallback AI provider for analysis and rewrites (processes script text).
• Dodo Payments — payments and subscription management as Merchant of Record (billing and contact data). We never receive or store your full card details.
• Brevo — transactional email (e.g., verification) and optional marketing email (email address).
• Upstash Redis — rate limiting and abuse prevention using hashed IP addresses.
• Vercel — application hosting and content delivery.

Data is encrypted in transit (TLS) and at rest. Some providers may process data outside your country; where required, appropriate transfer safeguards apply. This list may change as the service evolves.

6. Permanent Data Deletion Policy

We believe you should have absolute control over your digital footprint. If you decide to delete your account, we perform a complete cascade deletion. This wipes out all of your projects, revisions, history, saved audits, and your user profile. More details on this and instructions on how to initiate it can be found on our Data Deletion page.

7. Cookie Usage & Local Settings

We limit cookie usage to essential mechanisms. They are described below:

8. Advertising (Google AdSense)

On our public content pages (such as the blog) we may display ads served by Google AdSense, a third-party advertising service. Google and its partners use cookies and similar technologies to serve and measure ads, and — where you consent — to personalize the ads you see based on your prior visits to this and other websites. These advertising cookies are set only on our public pages and are never loaded inside the authenticated application.

We use Google Consent Mode v2: advertising and analytics storage default to denied until you make a choice in the cookie banner. If you choose Reject, personalized advertising and analytics cookies are not enabled; if you choose Accept, they are. Your choice is stored in a first-party cookie (ryt_consent) for up to 180 days and can be changed by clearing that cookie / your site data.

For details on how Google uses information from sites that use its services, see “How Google uses data when you use our partners’ sites or apps”. You can also manage ad personalization in your Google Ad Center.

9. Chrome Extension

The optional RetentionYT Chrome extension (Google Docs, Notion, YouTube) reads script text from the active tab only in your browserto show word count, estimated speaking time, and filler-phrase hints. That text is stored in Chrome extension storage and, when you click “Full Drop-off Audit on RetentionYT”, copied to a first-party pending_script_draft key on retentionyt.com so the dashboard can open a draft. We do not upload Docs or Notion content until you are signed in and choose to analyze it with the web app.

The extension asks Chrome for storage, sidePanel, and tabs, plus host access to retentionyt.com, Google Docs, Notion, and YouTube — only so it can read the page you already have open and hand off to this site. It does not sell page content, and it does not run on unrelated websites.