Privacy Policy
RecapShark is a YouTube summarizer and chat assistant. This page explains exactly what data we collect, where it goes, who we send it to, and how to delete it. We try to be plain about it instead of hiding behind legalese.
What we collect
- YouTube URLs you paste, so we can fetch the captions or audio and generate a summary, chapters, and transcript.
- Chat messages you send to the AI (the questions you ask about a video). We store the full text in our database so we can study how people actually use the chat and improve the assistant. This is the only place where free-form text you typed gets saved long-term.
- Anonymous usage analytics via Google Analytics 4 — page views, button clicks, which tab you spent time on, which language you translated to, length of your chat questions (not the text). These events do not include any name, email, or content you typed.
- Approximate location (city / country) and device info (mobile vs desktop, OS, browser) — derived from your IP address by Google Analytics. We never see or store your raw IP.
- Per-session aggregates — a small precomputed summary of each visit (timestamps, event counts, video IDs you watched, country/device) used by our internal dashboard to understand how people use the app.
Where the data lives
- Anonymous analytics events: Google Analytics 4 and Google BigQuery (Google's servers, United States).
-
Chat messages, session aggregates, and cached YouTube titles: a
private Supabase-managed Postgres database in the
United States (US East / Ohio,
us-east-2). - App backend: hosted on a DigitalOcean droplet (United States). Requests pass through it in transit but no user content is stored on the droplet itself.
Third parties we send your data to
Generating a summary or answering a chat question requires sending pieces of your input to outside services. These are all standard, paid API providers — none of them is given permission to use your data to train their own models. Here's the full list of where data flows:
-
OpenAI — receives the YouTube transcript text and your chat
questions in order to generate the summary, chapters, translations, and
chat responses. Data is sent over their API
(
api.openai.com); per OpenAI's API policy, API inputs are not used to train their models and are retained for up to 30 days for abuse monitoring. - Supadata — receives the YouTube video URL/ID so it can fetch the captions / subtitle track. No personal data is sent.
- YouTube (Google) — Data API v3 + oEmbed — receives the video ID when we look up the title, channel, duration, chapters, and comments. No personal data is sent.
- Google Cloud Translate — receives summary / transcript text when you click a translation language so it can translate it. No personal data is sent.
- Google Analytics 4 — receives the anonymous events described above directly from your browser.
- Google BigQuery — Google Analytics auto-exports the same events into BigQuery so we can query them. No new data is collected here; it's the same GA4 events in a queryable warehouse.
- Supabase (Postgres hosting) — receives the chat messages, session aggregates, and cached YouTube titles described in "Where the data lives" above.
- DigitalOcean (server hosting) — our backend runs on their infrastructure. Encrypted HTTPS requests pass through it; no user content is stored at rest on the droplet.
- Gladia (audio transcription) — listed for completeness; integration exists in the codebase but is currently disabled in production (no data is sent). If we re-enable it for videos without captions, audio extracted from the YouTube video would be sent for transcription.
How long we keep it
- Google Analytics events: 14 months (Google Analytics default retention).
- BigQuery analytics events: kept indefinitely (we may shorten this in the future).
- Chat messages and session aggregates in Supabase: kept indefinitely while RecapShark operates. Deleted on request — see "Your rights" below.
- Cookies in your browser: see the Cookies section.
Cookies and local storage
RecapShark sets a small number of first-party cookies and local-storage values:
-
_ga,_ga_*: Google Analytics anonymous client and session IDs. -
rs_is_owner: only set on devices we've marked as the operator's so the internal analytics dashboard can filter our own traffic out. Not set on regular visitors. -
Supabase Auth session (local storage): only set on the operator's
device when signing into the internal owner dashboard at
/owner-login.html. Not used or set during normal app use.
No third-party advertising cookies. No tracking pixels.
Your rights
You can ask us to delete every chat message and session record tied to your browser at any time. Email us (see Contact) with the approximate dates and the city you visited from, and we'll wipe matching rows. We typically respond within a few business days.
You can also opt out of Google Analytics globally via the official Google opt-out browser add-on, or block analytics in your browser's privacy settings.
EU / UK visitors (GDPR)
If you visit RecapShark from the EU or the UK, the operator of the site acts as the data controller for the data described above. The lawful bases we rely on are:
- Legitimate interest for anonymous usage analytics and storing chat messages to improve the product.
- Performance of a contract for the data strictly needed to deliver the service you asked for (e.g. sending your URL to Supadata to fetch captions, sending your chat question to OpenAI to get an answer).
Under the GDPR you have the right to access, correct, delete, restrict, object to, or port the personal data we hold about you. To exercise any of these, email us at the address below. You also have the right to lodge a complaint with your local data-protection authority.
Note that some processors listed above (OpenAI, Google, Supabase, DigitalOcean) are based in the United States. International transfers rely on the providers' standard contractual clauses where required.
California visitors (CCPA)
If you're a California resident, the CCPA gives you the right to know what categories of personal information we collect, the right to request deletion, and the right to opt out of any sale of personal information. RecapShark does not sell personal information, and there is no "Do Not Sell My Personal Information" link to provide because no sale happens. To request deletion, email us at the address below.
Children
RecapShark is not directed at children under 13 (or under 16 in the EU/UK) and we do not knowingly collect data from them. If you believe a child has submitted data to RecapShark, email us and we'll delete it.
Contact
Questions, deletion requests, or anything else: privacy@recapshark.com
Changes
If we ever change what's collected, who we send it to, or how long we keep it, we'll bump the "Last updated" date at the top and surface a notice in the app. Material changes — for example, adding a new data category, adding a new third-party processor, or enabling AI features that work on raw data we hadn't previously sent out — will be flagged before they take effect and won't be applied retroactively to data already collected.