Read-only access
OAuth scopes are limited to youtube.readonly and yt-analytics.readonly. SponsorsMetrics cannot upload, edit, delete, or publish anything on your channel.
Read security detailsTrust Center
How SponsorsMetrics handles your YouTube data.
One page summarising every guarantee SponsorsMetrics makes about read-only access, sponsor isolation, encryption, and your GDPR rights. Each section links to the canonical detail page so the policy stays authoritative.
YouTube accessRead-only
Token storageAES-256-GCM
Sponsor viewReport link only
Subprocessors6 listed
Four trust pillars, four canonical pages.
Every guarantee on this page is sourced from a detail document that legal and security own outright. The hub stays summary-only so the canonical pages can't drift out of sync.
Encrypted tokens
OAuth tokens are encrypted at rest with AES-256-GCM. Per-secret HMAC signing protects sponsor links, CSRF tokens, and webhook payloads.
Read security detailsSponsor isolation
Sponsors only ever see the public report link you choose to share. They never receive your YouTube account, OAuth tokens, dashboard, or other campaigns.
Read sponsor boundariesGDPR & data rights
Access, rectification, erasure, portability, and objection rights are documented and actionable from your account or by emailing privacy@sponsorsmetrics.com.
Read privacy policyYouTube API usage — exact scopes and what each one allows.
SponsorsMetrics uses two read-only OAuth scopes from Google. Every other YouTube capability — uploads, edits, comments, livestreams, AdSense — stays out of reach by design.
youtube.readonly
Read channel and video metadata so SponsorsMetrics can identify the videos and segments your campaigns reference.
Can read
- Read public + private video metadata (titles, descriptions, durations)
- Read channel name and basic identifiers
Cannot do
- Upload, edit, or delete videos
- Change channel settings or branding
- Post comments or replies
- Manage live streams or playlists
yt-analytics.readonly
Read the YouTube Analytics data that powers each Day 7 / 14 / 30 report — views, retention, watch time, demographics.
Can read
- Read campaign-level analytics for the videos you mark as sponsored
- Read aggregate retention and audience composition
Cannot do
- Read AdSense / monetisation revenue figures
- Read individual viewer identities
- Modify any analytics setting
- Access non-creator account data
You can review and revoke these scopes at any time from your Google Account permissions page. Revocation is honoured immediately on the SponsorsMetrics side.
Subprocessors.
Every third party that handles SponsorsMetrics data, what they do, and why they're in the chain.
Supabase
Postgres database, authentication and row-level security.
Stripe
Payment processing for paid plans and Agency seat add-ons.
Resend
Transactional email delivery (sponsor reports, milestone notifications).
Vercel
Hosting, edge runtime, and analytics for the web application.
Google / YouTube
OAuth provider and source of YouTube Analytics data via the YouTube Analytics API.
Anthropic
AI model provider for optional report-generation features.
Common trust questions.
Can I revoke access at any time?
Yes. From your Google Account permissions you can revoke SponsorsMetrics at any time. We also expose revoke controls inside the SponsorsMetrics Settings → Channels page.
How long do you retain my data?
Account data is kept while the account is active. Reports remain stored so historical campaigns survive plan changes. Account deletion is destructive — see Privacy section 5 for details.
Can a sponsor access my YouTube account?
No. Sponsors only see the public report link you share. There is no sponsor-side OAuth, no SSO into your YouTube account, and no path from the sponsor view back into your dashboard.
Where is my data stored?
Primary database hosted on Supabase (EU region). OAuth tokens encrypted with AES-256-GCM. See the subprocessor list above for every third party that touches data.
Contact
Reach the right team directly.
Each topic has a dedicated mailbox so requests land where they can be answered fastest.
- security@sponsorsmetrics.com — vulnerabilities, security incidents
- privacy@sponsorsmetrics.com — GDPR rights, data deletion, data export
- legal@sponsorsmetrics.com — Terms of Service, contractual queries
- support@sponsorsmetrics.com — general account, billing, status updates