1. Who we are
Factory (“Factory”, “we”, “us”, “our”) is a web application that connects to a creator's YouTube channel, analyses that channel's performance data, and produces written recommendations, scripts and suggested actions for the channel owner.
This Privacy Policy explains what information we handle when you use factory.shogy.no and the Factory application (together, the “Service”), and what rights you have over that information. It applies to all users of the Service.
For the purposes of the UK GDPR and the EU General Data Protection Regulation, Factory is the data controller for the personal data described in this policy. Our contact details are in section 18.
Independence notice. Factory is an independent product. It is not affiliated with, endorsed by, or sponsored by YouTube or Google LLC. YouTube is a trademark of Google LLC. Factory uses YouTube API Services to access data you authorise.
2. Summary
The short version, which does not replace the detail below:
- We ask for the narrowest Google permissions the product needs, and we tell you what each one is for.
- By default our access is read-only. We cannot change your channel unless you switch that on.
- We do not sell your data, and we do not use it for advertising.
- We do not use your Google user data to train generalised AI or machine-learning models.
- You can revoke our access from your Google Account at any time, and ask us to delete what we hold.
3. Information we collect
3.1 Information you give us
- Account information — your name, email address and Google account identifier, received from Google when you sign in.
- Settings and preferences — the channels you connect, notification settings, report configurations, and whether you have enabled write access.
- Content you enter — notes, prompts, briefs and edits you type into the Service.
- Support correspondence — messages you send us, and our replies.
- Billing information — if you buy a paid plan. Card details are collected and processed by our payment processor; we never receive or store full card numbers.
3.2 Information we obtain from Google and YouTube
With your authorisation, and only within the scopes you grant, we obtain data through YouTube API Services and Google APIs. This is described in detail in section 4.
3.3 Information collected automatically
- Service logs — IP address, browser type and version, operating system, pages requested, timestamps, and referring page.
- Diagnostic data — error reports and performance traces, used to keep the Service working.
- Session cookies — strictly necessary cookies that keep you signed in. See section 16.
We do not use third-party advertising trackers, and we do not build advertising profiles.
4. Google user data
Factory accesses your Google and YouTube data only through Google's official APIs, only after you grant permission on Google's own consent screen, and only within the scopes listed below. You may decline the optional scopes and still use the core product.
| Scope | Data accessed | Purpose |
|---|---|---|
openid, email, profile |
Google account identifier, email address, display name, profile picture URL. | To create and secure your account, sign you in, and show which Google account is connected. |
.../auth/youtube.readonly |
Channels you own, video metadata (titles, descriptions, tags, thumbnails, durations, publication dates), playlists. | To identify your channel and attach findings and recommendations to specific videos. |
.../auth/yt-analytics.readonly |
Private channel analytics: views, watch time, average view duration, audience retention, impressions and click-through rate, traffic sources, subscriber gains and losses, geography and device categories, in aggregate. | To measure how your channel performs and to generate the analysis the Service exists to provide. |
.../auth/yt-analytics-monetary.readonly(optional) |
Estimated revenue, RPM, CPM and ad performance metrics, in aggregate. | Only if you enable revenue reporting, so the Service can show earnings alongside performance. |
.../auth/youtube.force-ssl(optional) |
Ability to write approved changes to your channel — video titles, descriptions, tags, chapter markers and comments. | Only if you enable “Apply changes for me”. Every write is previewed and approved by you before it happens, and is recorded in an activity log. |
We do not request access to your Gmail, Google Drive, Contacts, Calendar, Photos, or any other Google service. We never ask for, receive, or store your Google password. Authorisation is held as an OAuth token which you can revoke at any time (section 13).
5. How we use information
We use the information described above only to:
- provide, operate and maintain the Service, including generating analytics, findings, scripts and recommendations for your channel;
- apply changes to your channel that you have explicitly approved, where you have enabled that feature;
- send you service messages, alerts you have configured, and responses to your support requests;
- keep the Service secure — detecting, investigating and preventing fraud, abuse and technical faults;
- process payments and maintain financial records for paid plans;
- understand aggregate, de-identified usage so we can improve the product; and
- comply with our legal obligations.
We do not use your data for automated decision-making that produces legal or similarly significant effects on you.
6. Limited Use disclosure
Factory's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, and without limiting the above:
- We use Google user data only to provide or improve user-facing features that are prominent in the Service's interface.
- We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets — and then only with notice to you and your consent where required.
- We do not use Google user data for serving advertisements, including retargeted, personalised or interest-based advertising.
- We do not sell Google user data, and we do not share it with data brokers, information resellers or credit agencies.
- We do not allow humans to read your Google user data, unless: (a) we have your affirmative agreement for specific data, for example when you ask us to investigate a support issue; (b) it is necessary for security purposes such as investigating abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and de-identified.
- We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.
In addition, by using the Service you are agreeing to be bound by the YouTube Terms of Service, and you can review Google's own privacy practices in the Google Privacy Policy.
7. AI-assisted features
Some features — script drafts, hook rewrites, title and description variants — are produced with the help of large language models. Where such a feature runs, the minimum necessary context from your channel (for example a video title, a retention summary, or a description you asked us to rewrite) is sent to our model provider solely to generate output for you.
We contractually require that this content is not used to train the provider's models and is retained only transiently for abuse monitoring, in line with the provider's zero-retention or limited-retention terms. Generated output is a suggestion only; you decide whether to use it, and you remain responsible for what you publish.
8. Legal bases for processing
If you are in the UK, the European Economic Area or Switzerland, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service you signed up for | Performance of a contract |
| Accessing your YouTube data through Google APIs | Your consent, given on Google's consent screen, and performance of a contract |
| Security, fraud and abuse prevention | Legitimate interests |
| Product improvement using aggregated, de-identified data | Legitimate interests |
| Billing and financial records | Performance of a contract; legal obligation |
| Marketing emails, where sent | Your consent, withdrawable at any time |
9. Sharing and subprocessors
We do not sell your personal information. We share it only with service providers who process it on our behalf, under contract, and only to the extent needed to run the Service:
| Category | What they do |
|---|---|
| Cloud hosting and databases | Run the application and store your account and channel data. |
| Error monitoring and logging | Record faults and performance data so we can fix them. |
| Transactional email | Deliver sign-in, alert and support emails. |
| Payment processing | Take payment for paid plans and handle invoicing. |
| AI model provider | Generate script, title and description suggestions, as described in section 7. |
We may also disclose information where we are legally required to do so, to enforce our Terms of Service, or to protect the rights, property or safety of our users or the public. If Factory is involved in a merger, acquisition or sale of assets, we will give you notice before your personal information is transferred and becomes subject to a different privacy policy.
A current list of subprocessors is available on request from privacy@shogy.no.
10. Data retention
| Data | Retention |
|---|---|
| Account and profile data | For as long as your account is active. |
| Cached YouTube analytics and video metadata | Refreshed on an ongoing basis; deleted within 30 days of account deletion or revocation of access. |
| OAuth tokens | Deleted immediately when you disconnect a channel, revoke access, or delete your account. |
| Generated scripts, reports and exports | Until you delete them, or within 30 days of account deletion. |
| Service and security logs | Up to 90 days, then deleted or aggregated. |
| Billing and tax records | As required by law, typically 6–7 years. |
Backups are rotated and encrypted; data deleted from live systems is purged from backups within 90 days.
11. Security
We take the following measures to protect your information:
- All traffic is encrypted in transit using TLS 1.2 or higher.
- Data is encrypted at rest.
- OAuth tokens are held encrypted in a dedicated secret store, separate from application data.
- Access to production systems is limited to personnel who need it, protected by multi-factor authentication, and logged.
- We follow least-privilege principles when requesting API scopes and when granting internal access.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by law.
12. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and receive a copy;
- correct inaccurate or incomplete data;
- delete your data (“right to erasure”);
- restrict or object to certain processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing already carried out; and
- lodge a complaint with your data protection authority.
If you are a California resident, you additionally have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information under the CCPA/CPRA. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising any right.
To exercise any of these rights, email privacy@shogy.no. We will respond within 30 days, and may need to verify your identity first.
13. Revoking access and deleting your data
You can stop and remove our access at any time, in three ways:
- Revoke at Google. Go to myaccount.google.com/permissions, select Factory, and choose “Remove access”. Our access to your YouTube data stops immediately.
- Disconnect in the app. Open Settings → Connected channels and disconnect the channel. This deletes the stored OAuth token straight away.
- Delete your account. Open Settings → Delete account, or email privacy@shogy.no. We delete your account data, including all cached Google user data, within 30 days, except records we are legally required to keep.
14. International transfers
We and our service providers may process your information in countries other than your own, including the United States. Where we transfer personal data out of the UK, EEA or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical measures such as encryption.
15. Children
The Service is not directed to children. You must be at least 16 years old, or the minimum age at which you can use YouTube in your country if that is higher, to use Factory. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
16. Cookies
We use strictly necessary cookies only: a session cookie that keeps you signed in, and a security token that protects against cross-site request forgery. We do not use advertising cookies, and we do not permit third parties to set tracking cookies through the Service. Because we use only strictly necessary cookies, no consent banner is required — but you can clear or block them in your browser, accepting that you will be signed out.
17. Changes to this policy
We may update this policy as the Service changes. When we do, we will revise the “Last updated” date at the top of this page. If the change is material — for example, if we request a new permission or use your data for a genuinely new purpose — we will notify you by email or in the Service before it takes effect, and where required we will ask for your consent again.
18. Contact us
Questions, requests or complaints about privacy:
- Privacy enquiries: privacy@shogy.no
- General support: support@shogy.no
- Postal address: available on request.
If you are not satisfied with our response, you may complain to your local data protection authority.