Privacy Policy

1. Authentication & Session Security (Firebase Auth)

We utilize Firebase Authentication to verify your identity and protect access to your account. When you sign up or log in, your authentication state is synchronized with our server using a secure session token. This session token is stored in an HTTP-only, secure cookie named __session, which is required for our middleware to perform secure session verification on the server side.

2. Data Storage & Management (Google Firestore)

All user data created within the editor is stored securely in Google Cloud Firestore. This includes:

• User profile properties (email, metadata, settings).
• Project records, including script text files, analysis reports, and pacing segments.
• Script revisions history and rewrites created through our editor.

Your data is secured by custom firestore security rules ensuring that only you, the authenticated author, can access or write to your project collections.

Deep Optimize / portfolio optimization jobs may store job metadata (status, solver mode, model and coefficient versions, configuration hashes, execution receipts, and selected intervention IDs) in Firestore collections such as quantum_jobs and quantum_reports. Segment text used for optimization is kept within our application boundary. When an external quantum or hybrid solver is enabled in the future, we send only mathematical coefficients and opaque variable labels—not raw script text—to that provider. Provider tokens are never stored in the browser.

3. Rate Limiting & Abuse Prevention (Upstash)

To protect the availability of our artificial intelligence features and deter malicious actions, we enforce strict, IP-based rate limiting using Upstash Redis. We track the number of calls to our Gemini rewrite and analysis API endpoints using hashed IP addresses. Additionally, to protect against denial of service during resource-heavy operations, we rate-limit account deletion initiation requests.

4. Artificial Intelligence Processing (Google Gemini + Groq)

When you submit a script for analysis or request rewrites, its text is sent to our AI providers — Google Gemini (primary) and Groq(fallback) — to generate pacing analysis and revision suggestions. The text is processed to produce your results and is handled under each provider’s API data terms.

RetentionYT does not use your scripts to train its own models. We do not control third-party model training; the current data-usage terms of Google Gemini and Groq for the applicable API tier govern how those providers may process submitted text.

5. Third-Party Sub-Processors

We rely on the following providers to operate RetentionYT. Each receives only the data required for its function:

• Google Firebase Authentication — account identity and secure sessions.
• Google Cloud Firestore — storage of your projects, scripts, audits, and settings.
• Google Gemini — AI script analysis and rewrites (processes script text).
• Groq — fallback AI provider for analysis and rewrites (processes script text).
• Lemon Squeezy — payments and subscription management as Merchant of Record (billing and contact data). We never receive or store your full card details.
• Brevo — transactional email (e.g., verification) and optional marketing email (email address).
• Upstash Redis — rate limiting and abuse prevention using hashed IP addresses.
• Vercel — application hosting and content delivery.

Data is encrypted in transit (TLS) and at rest. Some providers may process data outside your country; where required, appropriate transfer safeguards apply. This list may change as the service evolves.

6. Permanent Data Deletion Policy

We believe you should have absolute control over your digital footprint. If you decide to delete your account, we perform a complete cascade deletion. This wipes out all of your projects, revisions, history, saved audits, and your user profile. More details on this and instructions on how to initiate it can be found on our Data Deletion page.

7. Cookie Usage & Local Settings

We limit cookie usage to essential mechanisms. They are described below:

8. Advertising (Google AdSense)

On our public content pages (such as the blog) we may display ads served by Google AdSense, a third-party advertising service. Google and its partners use cookies and similar technologies to serve and measure ads, and — where you consent — to personalize the ads you see based on your prior visits to this and other websites. These advertising cookies are set only on our public pages and are never loaded inside the authenticated application.

We use Google Consent Mode v2: advertising and analytics storage default to denied until you make a choice in the cookie banner. If you choose Reject, personalized advertising and analytics cookies are not enabled; if you choose Accept, they are. Your choice is stored in a first-party cookie (ryt_consent) for up to 180 days and can be changed by clearing that cookie / your site data.

For details on how Google uses information from sites that use its services, see “How Google uses data when you use our partners’ sites or apps”. You can also manage ad personalization in your Google Ad Center.