Privacy notes

What this describes

uxrls publish is a private, operator-authorized tool for managing YouTube publishing. It does not offer open registration. The informational homepage is https://uxrls.com/publishing/. That page is not the sign-in screen. Operator sign-in is only at https://publish.uxrls.com/auth/login. The application host is https://publish.uxrls.com/.

The operator reports that Google sign-in uses an OAuth web application project named uxrls-publish. OAuth is the consent step Google shows when an application asks for access to an account.

The operator reports that the current account has 10 YouTube channels connected, as of 8 November 2026. Channel names are not published here. Live upload calls and live analytics calls had not been confirmed in operation at that date.

The tool is built so the operator can connect channels they are allowed to manage, upload and schedule items they select, and view analytics where YouTube supports that.

Scopes the client requests

The operator reports that the OAuth client requests the scopes below. They are broad. Google’s short description is quoted for each one, from Google’s public documentation as checked on 8 November 2026. The scope lists used for that check are OAuth 2.0 Scopes for Google APIs and the YouTube Analytics and Reporting authorization guide. YouTube Data API scope wording is the text Google publishes for those scope strings.

This list does not include openid, a monetary YouTube Analytics scope, or youtubepartner-channel-audit. The live consent screen has to be checked against this list. If the client requests a scope that is not written here, this page is incomplete until it is added.

Requesting a scope means Google may grant the permission Google describes. It does not, by itself, say that every permitted action is used, and it does not say that unused actions are blocked in the software.

Data stored or sent

The operator describes the deployment as storing or sending the following, as they apply to a connected account and to the actions the operator takes:

• Google account profile details and the primary email address returned for the profile and email scopes
• OAuth access tokens and refresh tokens
• YouTube channel metadata, content information, and analytics reports where those are requested
• Media the operator selects for a post
• Scheduled posts the operator saves
• Operational logs written while the software runs
• A public, provider-fetchable copy of upload media, described below

Access tokens and refresh tokens are stored so the tool can keep the operator’s authorization and renew it. A refresh token is a long-lived credential. This page does not say that stored tokens are encrypted.

Public provider-fetchable upload delivery

The operator states that upload delivery is public and provider-fetchable. Media selected for an upload is stored, and the file can be placed at a network address that YouTube, or another configured provider, can fetch without the operator’s private sign-in. “Public” means that address is not described as a private, signed-in page.

Anyone who knows a live address may be able to download that file while the address still works. This page does not say that the address is secret, that it expires, that it is removed after a provider fetches it, or that some other access check exists. No lifetime is stated.

Logs

Operational logs may include whatever the running software writes: times, task results, identifiers, and error text are examples, not a complete field list. This page does not say that logs leave out tokens, file names, post text, or API error text. The operator has to confirm what is actually written.

Scheduled posts

Posts the operator schedules are stored on the deployment. This page does not say how long a sent or unsent post remains stored.

Purpose and Limited Use

Google user data is requested so the authorized operator can connect YouTube channels and carry out the publishing actions they ask for: uploads, scheduling, channel and content information needed for that work, and analytics where the API supports them. Profile and email are requested to identify the authorizing account.

The intended Limited Use statement is:

The use of information received from Google APIs is intended to follow the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not to be sold. It is not to be used or transferred for advertising or ad targeting, including retargeting, personalized advertising, or interest-based advertising. It is not to be used to determine credit-worthiness or for lending. It is not to be used to train artificial-intelligence or machine-learning models.

That is the operator’s intended rule, and it is meant to be strict. The general Limited Use text published by Google limits use of the covered data to user-facing features, restricts transfers, restricts human reading except in stated cases, and prohibits sale, advertising use, and credit use. The prohibition on training artificial-intelligence or machine-learning models is the operator’s additional intended rule on this page. Some other Google product policies use a similar model-training limit. This page does not treat that extra rule as a certificate.

The operator must confirm that the running service matches the statement. That includes stored tokens and media, logs, public upload addresses, and any bot connector relay. This page does not say that confirmation has been done.

The tool is for the authorized operator to read and act on their own channel data. These pages do not describe access by any other person. They do not describe a staff program.

This is not a credit or lending product.

Who processes data

Each party below is listed where it applies. A name that is missing is not proof that no other party exists. If another host, backup, or service can read tokens, media, posts, or logs, the operator has to add it to this page before relying on the list.

The operator

The operator runs the private deployment and decides what they store and delete. No separate company name is published on this page. No public contact is published.

Google

Google processes the OAuth consent for the project named uxrls-publish, issues access tokens and refresh tokens, and processes YouTube and YouTube Analytics API calls. Video, metadata, and other fields the operator sends through those APIs are processed by Google. Google’s own handling is described in the Google Privacy Policy.

OVH

The operator identifies OVH as infrastructure used for this service. Where the tool or these pages are hosted on OVH, OVH processes the stored data and the connection data that hosting involves. This page does not name an OVH product, a region, or a contract.

Cloudflare

Where a hostname for these pages or for the tool is served through Cloudflare, Cloudflare processes connection data for those requests. That can include IP address, user agent, and the requested URL. This page does not say that every hostname is proxied by Cloudflare, and it does not say that none of them are. The operator has to confirm which names are proxied.

Bot connector relay

Where the operator uses a bot connector relay, that relay processes the messages it forwards. Those messages can include post text, media references, schedule fields, and status. The intended use is to carry a publishing action the operator asked for. The relay is not given a separate public brand on this page, and it is not described as running for every action.

The operator has to confirm what the relay stores, and that it does not use Google user data for advertising or to train models. This page does not state the relay’s retention. A transfer to a relay has to stay within the Limited Use limits the operator intends, including consent where Google’s policy requires it. This page does not say that review has been completed.

Security

The tool’s address and the sign-in address use HTTPS. These notes are written to be read over HTTPS at the public addresses on uxrls.com. Administration is meant to stay with the authorized operator. There is no public sign-up on these pages.

Those are descriptions of the intended setup. They are not a certificate report, a redirect test, or a review of how admin access is enforced.

Stored tokens, media, scheduled posts, and logs are not described here as encrypted while stored. This page does not make that claim.

Google may require a security assessment for some sensitive or restricted scopes before an OAuth client is verified for public use. This page does not say that an assessment has been done, and it does not say that Google has verified the client.

The service is not directed at children and it does not offer public registration. This page does not describe an age gate.

Retention and deletion

No fixed retention period is stated for tokens, media, scheduled posts, analytics, profile or email details, logs, or provider-fetchable files. No number of days is set on this page.

YouTube’s own developer policies may require the operator to refresh or delete some YouTube API data on YouTube’s schedule. Those rules are in the YouTube API Services Developer Policies. This page does not copy a number of days from them, and it does not say that an automatic deletion job is already running. The operator has to match the live system to YouTube’s current rules.

Deletion of data stored by uxrls publish is operator-managed. The administrator of the private deployment is the person who can delete copies they control. This page does not promise that deletion is immediate, that it is complete, or that it is available through a public form. It does not promise that copies held by Google, OVH, Cloudflare, or a bot connector relay are removed on the same schedule. Google’s own retention of data sent to YouTube is covered by Google’s and YouTube’s policies, not by a promise on this page.

There is no published address to send a deletion request. If you do not already have a direct way to reach the administrator, these pages do not provide one.

Revoking Google access

Removing this application’s access in the Google Account settings is revocation at Google. It is not the same step as deleting data already stored by uxrls publish.

1. Read Google’s help article, Manage links between your Google Account and apps from other developers. That is the current official instruction for reviewing and removing third-party app access. Use the part of the article about reviewing or removing what a linked app can access.
2. Open your linked apps while signed in to the Google account that granted access. Google’s help article links to that page.
3. Select this application and remove its access, following the labels on Google’s own page. The OAuth project name the operator reports is uxrls-publish. The name on the consent screen is the name to look for. This page does not include a picture of that screen, and it does not invent the button label.

An older help address, https://support.google.com/accounts/answer/3466521, currently redirects to Google’s overview of sharing account access with other developers. The removal steps themselves are on the manage-links article above.

Google’s help states that removing access means the app can no longer access the Google Account, and that deleting a sign-in link does not delete data already held on the app. Revocation tells Google to stop this application’s access. Google can refuse new tokens and can invalidate tokens Google still controls.

Revocation does not, by itself, delete media, scheduled posts, saved channel or analytics data, saved profile or email details, operational logs, or files still published for provider-fetchable delivery. It does not, by itself, delete copies at OVH, Cloudflare, or a bot connector relay.

The operator can also disconnect a channel or delete stored data if the deployment has those controls. This page does not name a button or menu, because the live screen was not documented here. That operator step is still separate from the Google Account linked-apps page, and it still has no fixed completion time on this page.

Policies that also apply

• YouTube Terms of Service
• YouTube API Services Terms of Service
• YouTube API Services Developer Policies
• Google Privacy Policy
• Google API Services User Data Policy, including Limited Use

Use of YouTube through the tool is also covered by the terms for uxrls publish.

What this page does not claim

• It does not claim encryption of stored data.
• It does not state a fixed retention period.
• It does not promise that deletion removes every copy or happens within a stated time.
• It does not report a security certification, a completed Google verification, or a completed security assessment.
• It does not publish a support address, a personal name, or a legal name.
• It does not say that live upload or live analytics has been proven.
• It does not say that every action allowed by a scope is used, or that unused actions are blocked.
• It does not say that a provider-fetchable address expires or is access-controlled.
• It does not name OVH products, regions, or contracts.
• It does not say that Cloudflare proxies every hostname, or that it proxies none.
• It does not say that the intended ban on sale, ad targeting, and model training has been operationally confirmed.

The operator may replace these pages. This copy is dated 8 November 2026.

Back to the top of these notes