Privacy notice
Last updated 25 September 2026
Who holds it
TubeExtract is run by TubeExtract, a sole trader business registered in Turkey, who is the data controller for everything described below. Write to privacy@tubeextract.dev about anything on this page; a person reads that address, not a ticketing robot. There is no data protection officer, because a one-person operation is under the threshold that requires one — that is a statement about size, not a way of avoiding the question.
What we hold
Your account details, the video IDs and schemas you send, and the rows we return. We do not hold video files or audio, because we never fetch them: extraction reads the caption track a video already publishes.
Where it runs
Two machines, and they are not in the same country. Your account, your schemas, the job queue and the billing record live on a server we rent from Hetzner in Germany. The extraction itself runs on a machine of ours in Turkey: to answer a job, the caption text of that video and the schema you wrote are sent there, and the rows come back. Turkey is outside the EEA and is not covered by an EU adequacy decision; the section on sending data outside the EEA explains how that transfer is protected. Nothing is stored on the Turkey machine beyond the life of the request.
How we get the captions
Caption tracks are retrieved through a third-party transcript provider, which receives the video ID and nothing else — not your account, not your schema, not your results. Earlier versions of this service read them directly; that was replaced, and the provider is now the only path.
How long
Results are not stored for you to come back to. The first time you successfully read a finished job we hand over the rows and delete them, along with the URL you submitted, in the same request. What stays is the job's status, its timestamps and its character and chunk counts, which is what usage and billing are calculated from; those are kept for seven years.
What we do not do
We do not train models on your schemas or results, sell data, or run advertising. The extraction model runs on our own hardware and is not fine-tuned on anything you send. The website counts page views with Cloudflare Web Analytics, which sets no cookies and does not identify or track individual visitors; we see aggregate numbers such as visits per page and referring sites. Beyond that, the website records two things: an anonymous yes or no on a documentation page when someone presses the button asking for one, and, if the link you followed to the sign-up page carried a utm_source tag (a directory listing or a launch post, say), that tag with your new account, so we can tell which places bring people who stay. Nothing is stored in your browser to do it; the tag travels in the link.
Who else sees it
Cloudflare, which carries all traffic to the website and the API and counts page views; the Hetzner server in Germany; the transcript provider that fetches captions; Resend for transactional email; and Paddle. Paddle is the merchant of record for every purchase, which means it handles the payment, the subscription, the tax and the invoice, and it is a controller of that billing data in its own right rather than only acting for us — your card details reach Paddle and never reach us at all. Beyond those, data goes to professional advisers where we need advice, and to an authority where the law requires it. The Turkey machine is our own hardware rather than a subprocessor, but it is listed on the DPA page for the same reason: it is somewhere your data goes. The current list is on that page.
Keeping it safe
Everything is encrypted in transit between every component. Access to the production server is limited to the operator, over SSH with key authentication; passwords are stored hashed with bcrypt, and API keys are stored as hashes so a copy of the database does not hand anyone your keys. Verification and password-reset tokens are stored as SHA-256 and expire. The DPA page has the same paragraph with the part we cannot claim spelled out: there is no SOC 2, no external penetration test and no security team, and it is better that you read that here than assume otherwise.
Why we are allowed to hold it
Four bases, and which one applies depends on the data. Running your account, your jobs and your schemas is performance of the contract you entered when you signed up — without it there is no service to give you. Billing records and invoices are a legal obligation under tax law, which is why they outlive the account. Keeping the service secure and working, including rate limits and the health checks behind the status page, is our legitimate interest in not having it fall over. Product email that is not about your account is consent, and the settings screen turns it off.
Sending data outside the EEA
Extraction runs on our machine in Turkey, which has no EU adequacy decision, so that leg is a restricted transfer. It is covered by standard contractual clauses between the operator and the operator's own hardware, which is an honest description of a small setup rather than an impressive one: the same person controls both ends. What actually limits the exposure is that nothing is retained there — caption text and your schema go, rows come back, and the machine holds neither after the request. If your own compliance review needs more than that sentence, ask before you sign the DPA rather than after.
Cookies
One cookie, for your signed-in session, and it is required for the dashboard to work at all. Signing in with GitHub or Google also sets a few cookies that last the ten minutes the round trip can take: a security check against forged sign-ins, where to land afterwards, and the utm_source tag if the sign-up page had one. No advertising cookies, no third-party trackers and no consent banner, because there is nothing to consent to: page views are counted by Cloudflare Web Analytics, which sets no cookie and does not identify you. If you are reading this looking for the tracking list, that is the whole list.
Your rights
You can ask for a copy of what we hold, a correction, deletion, a machine-readable export, a restriction on how we use it, or object to a use that rests on legitimate interest. Where a use rests on consent you can withdraw it at any time, which does not undo what happened before. Write to privacy@tubeextract.dev; we answer within 30 days and usually the same week, and we do not charge for it. If you think we have handled your data badly you can complain to a supervisory authority — in the EU, the one where you live or work.
Changes to this page
The date at the top is the last change. A change that alters what we do with data already held is announced by email and in the changelog at least 30 days before it takes effect, the same notice period the terms use. Corrections that make an existing practice clearer go up when they are written.