Privacy Policy

Effective date: May 26, 2026 · Last updated: October 13, 2026

1. Who we are

ChannelzIQ is a software-as-a-service platform for YouTube content creators, operated by ChannelzIQ ("we," "our," or "us"), a sole-proprietorship business based in the suburbs of Chicago, Illinois, USA. Our website is https://channelziq.com and our customer application is https://go.channelziq.com. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data.

2. Information we collect

2.1 Account information

When you create a ChannelzIQ account, we collect your name, email address, and a hashed password (or, if you use Google Sign-In, the Google account identifier and email address Google returns to us). We collect billing details (last four digits of your payment card, billing zip code, and Stripe customer identifier) when you subscribe to a paid plan; we do NOT store your full credit card number — Stripe handles that.

2.2 Connected Google service data

ChannelzIQ requests permission to access several Google services through OAuth. You grant each permission explicitly during connection, and you can revoke them at any time in your Google Account settings at https://myaccount.google.com/permissions. The specific scopes we request and what we do with each:

  • YouTube Data API (youtube.readonly, youtube.force-ssl): Read your channel profile, video metadata, titles, descriptions, tags, thumbnails, playlists, comments, and subscriber information. The "force-ssl" permission also allows us to post comment replies and update video titles/descriptions on your behalf, but only when you explicitly trigger an action in our interface — we never modify your channel automatically.
  • YouTube Analytics API (yt-analytics.readonly): Read non-monetary analytics — views, watch time, audience retention, traffic sources, demographics, device types, and similar performance metrics — for your own channels only.
  • Google Search Console API (webmasters.readonly): Read search query data, page performance, and click-through rates for websites you own and have verified in Google Search Console. We use this to surface keyword opportunities and search-visibility signals for content planning.
  • Google Analytics API (analytics.readonly): Read pageview, audience, and acquisition data from any Google Analytics 4 properties you grant us access to. We use this to correlate YouTube performance with web traffic for creators who run a companion website or blog. For more on how Google itself handles this data when our service queries it on your behalf, see Google's How Google uses information from sites or apps that use our services.
  • Sign-in scopes (openid, userinfo.email, userinfo.profile): Used to authenticate you and display your name and email in our application.

Note (updated May 2026): the Google AdSense Management API integration was removed from ChannelzIQ. We no longer request the adsense.readonly scope and we no longer store any AdSense data. Customers who previously granted that scope are unaffected — the scope remains on their old OAuth grant until they reconnect, and our code does not read it.

Limited Use of Google user data. ChannelzIQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features that are prominent in the requesting application's user interface, and only with explicit user consent. We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising. We do not allow humans to read Google user data unless we have the affected user's explicit consent for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for ChannelzIQ's internal operations and only when the data has been aggregated and anonymized.

2.3 Connected non-Google services

If you choose to connect a WordPress blog, Facebook page, Instagram business account, or TikTok account, we collect the access tokens and account identifiers necessary to read your published content and (where you authorize it) publish on your behalf. As with Google services, you can revoke these connections at any time.

2.4 Content you create within ChannelzIQ

Drafts, scripts, video titles, blog post outlines, social media captions, research queries, and any other content you generate or edit inside ChannelzIQ are stored in our database and associated with your account. AI-generated suggestions are also stored so you can revisit and reuse them.

2.5 Usage and diagnostic data

We collect application logs (IP address, browser type, pages visited, actions taken, timestamps, error messages) to operate, secure, and improve the service. These logs are retained for 30 days unless required longer for security investigation.

2.6 Cookies and similar technologies

We use first-party cookies for authentication (the cookie cz_user_token keeps you signed in for 24 hours, HttpOnly and Secure flags set). We use Google Analytics 4 on our public marketing pages to understand which pages people read. That is a third-party analytics cookie (_ga), and our cookie notice has always named it as such — this section previously said "minimal first-party analytics", which was wrong, and the two documents contradicted each other. Analytics storage is denied until you accept it in the banner: no _ga cookie is written before then. We do NOT use advertising cookies, retargeting pixels, or social-media tracking pixels anywhere.

2.7 People who interact with your channels

When you connect a platform we import the public comments and direct messages sent to your accounts — the names, handles, avatars and text of people who wrote them, who have no ChannelzIQ account. We hold this so you can read and reply from one inbox and so AI features you trigger can summarise it. We never contact them; it is deleted with your account.

2.8 Waitlist and contact submissions

We keep your name, email, message and the page you sent it from, so we can reply and, if you asked, send product updates.

2.9 Chatbot transcripts

The assistant on channelziq.com records each message you send, the reply, and your IP address. Cue, the assistant inside ChannelzIQ, records each message you send and the reply, linked to your account, but not your IP address; we also count how often you use it (free help questions and analyses) so you and we can see usage. Transcripts are deleted after 30 days.

2.10 Email open tracking

Marketing emails contain a one-pixel image; when it loads we record the time, your IP address and browser type against that email. Transactional emails (sign-in codes, receipts) carry no pixel. Open records are deleted after 365 days.

2.11 AI assistants you connect (Claude, ChatGPT and other MCP clients)

You can connect your own AI assistant — for example Claude or ChatGPT — to ChannelzIQ through our hosted Model Context Protocol (MCP) server at https://mcp.channelziq.com/mcp. Nothing is connected unless you set it up in that assistant and press Allow access on our approval screen. To make the connection work we keep: a hashed copy of the access key the assistant uses (never the key itself) and its first characters so you can recognise it, a hashed refresh token that lasts up to 90 days, when the key was last used, and a record of each step of connecting (registered, signed in, approved or denied) together with which kind of assistant it was and your account ID. That record holds no email address, IP address or browser details. All of this is deleted with your account. Separately, the assistant registers itself with us (its app name and callback address); that registration contains nothing about you.

Once connected, the assistant can read the ChannelzIQ data your plan allows and act on your instructions (for example save a draft, schedule or publish a post, or reply to a comment). Whatever the assistant reads from ChannelzIQ is sent to the company that runs that assistant, under your own account and agreement with them, not ours — see Section 4. You can disconnect at any time in ChannelzIQ under Settings → Connected Accounts → Claude (MCP), which lists every connected assistant, and by removing ChannelzIQ from the assistant itself.

2.12 Voice features (dictation and the teleprompter's Follow my voice)

Some features in ChannelzIQ can use your microphone, and only after you press their microphone button and allow it in your browser: dictating into a text box, and the teleprompter's Follow my voice, which keeps the line you are reading at the top of the screen. Both use your web browser's own speech recognition. Your browser sends what you say to its maker's speech service to turn it into text — Google's in Chrome, Microsoft's in Edge, Apple's in Safari — under your agreement with that company, not ours. ChannelzIQ never receives, records or keeps your voice. Dictated text becomes part of the box you dictated into and is handled like anything else you type there. The words the teleprompter hears stay in your browser and are discarded when you close the teleprompter; ChannelzIQ records only that the feature was turned on or used, never what was said. The microphone stops when you pause, close the teleprompter or stop dictating.

3. How we use your information

We use the information described above to:

  • Provide the core ChannelzIQ service — display your YouTube analytics, generate AI-assisted content recommendations, surface keyword and competitive research, and let you publish or schedule content across your connected platforms.
  • Process subscription payments through Stripe.
  • Communicate with you about your account, send service updates, and provide customer support.
  • Detect and prevent fraud, abuse, and security incidents.
  • Comply with legal obligations.
  • Improve the product — for example, identifying which features creators use most so we can prioritize roadmap work. This analysis uses aggregated, de-identified data wherever possible.

We do not sell your data to third parties. We do not share data from your connected services with advertisers, data brokers, or any external party other than the limited operational vendors listed below.

4. Who we share data with

We share information only with the limited set of vendors that operate ChannelzIQ on our behalf:

  • Anthropic, PBC (AI sub-processor) — When you click a "Generate", "Refresh", "Analyze", or similar AI button inside ChannelzIQ, the relevant content from your account is sent to Anthropic's Claude API for processing and the response is returned to you. Examples of data sent in context with each AI feature: video titles and descriptions, video thumbnail images, audience comments and your past replies to them, transcripts you have stored, blog article text, brand-voice samples you have configured, Google Analytics page paths and session counts, YouTube traffic-source labels, keyword lists, and the prompt instructions that frame the request. Anthropic's Commercial Terms contractually prohibit them from training their models on content sent through the API. ChannelzIQ does not pool content across customers to train, fine-tune, or otherwise improve any AI model — every AI request is scoped to the requesting customer's own account. See Anthropic's privacy policy at anthropic.com/legal/privacy.
  • Stripe, Inc. — Payment processing. Stripe receives the data necessary to charge your card and manage your subscription. See Stripe's privacy policy at https://stripe.com/privacy.
  • Hostinger / our hosting infrastructure provider — Server hosting in a US data center. Our hosting provider has access to encrypted data at rest but does not access application content.
  • Google LLC — Our service uses Google APIs (the ones described in Section 2.2). Data flows between ChannelzIQ and Google's APIs are governed by Google's own privacy and security practices.
  • Cloudflare, Inc. — Bot protection on our public forms (waitlist sign-up, contact, feedback, roadmap votes, status-page subscribe and developer access). When you submit one of those forms, Cloudflare’s Turnstile check runs in your browser at challenges.cloudflare.com and our server sends the resulting one-time token, plus your IP address, to Cloudflare to confirm you are not an automated script. Turnstile is designed not to profile you or track you across sites, and it receives none of the information you typed into the form. See Cloudflare’s privacy policy.
  • Twilio Inc. — SMS delivery for one-time sign-in codes, where you have chosen SMS. Twilio receives your phone number and the message body. See Twilio's privacy notice.
  • Meta Platforms, Inc. (Instagram Business Discovery) — Instagram peers in Peer Insights. When you add or refresh an Instagram peer, we ask Meta's Instagram API for that account's public profile and recent posts (followers, number of posts, and each post's likes and comments). Only public Business and Creator accounts can be read. The request is made through the Instagram professional account you connected, so Meta receives the username you entered and can see that your account looked it up. YouTube peers are read from YouTube's public API (Google, above). See Meta's privacy policy.
  • Apify Technologies s.r.o. — An integration for collecting comments on TikTok videos exists but is switched off and has no credentials, so nothing is sent to Apify today. Peer data no longer goes through Apify. It is listed here because the code is one administrative change away from live. See Apify's privacy policy.
  • MaxMind, Inc. — Approximate geolocation of the IP address recorded on each sign-in, so an unfamiliar-location alert can say "a sign-in from Berlin" rather than an IP number. The lookup runs against a database we download and hold ourselves; your IP is not sent to MaxMind at sign-in time. See MaxMind's privacy policy.
  • LinkedIn (Microsoft Corporation) — Only if you connect a LinkedIn account. Receives the OAuth token you granted, plus the content you publish and the comments we fetch back. See LinkedIn's privacy policy.
  • Bluesky Social, PBC — Only if you connect a Bluesky account. Receives your app password or OAuth grant, the posts you publish and the replies we read back. Resolving a Bluesky handle also queries plc.directory, the AT Protocol's public identity directory, which receives the handle being resolved. See Bluesky's privacy policy.
  • Threads (Meta Platforms, Inc.) — Only if you connect a Threads account. Receives the OAuth token and the content you publish. Covered by Meta's privacy policy, linked above.
  • Reddit, Inc. — A Reddit publishing adapter exists in the product but the platform is currently switched off and cannot be connected: Reddit's terms require a signed commercial agreement before a paid product may use their API, and we do not have one. It is listed here because the code is one administrative toggle away from live, and we would rather disclose it early than quietly. If it is ever enabled it will receive the OAuth token you grant and the content you publish.
  • Have I Been Pwned (Superlative Enterprises Pty Ltd, api.pwnedpasswords.com) — When you set or reset a password, we check whether that exact password already appears in public breach data. We do this with k-anonymity: your password is hashed on our server and only the first five characters of that hash are sent. The service returns every hash sharing those five characters and the comparison happens here. Your password, the full hash, your email and your IP address never reach them, and no account identifier is included. If the service is unreachable we let the password through rather than block you. See their privacy policy.
  • Brave Software, Inc. (Brave Search API) — Powers the news and topical-research lookups. Brave receives the search query, which is derived from your topic or keyword. It receives no account identifier. See Brave's privacy policy.
  • Slack Technologies, LLC (hooks.slack.com) and Discord Inc. (discord.com / discordapp.com webhooks) — Only if you save a Slack or Discord webhook address. The alerts or weekly summary you chose are posted to that channel, and can include video titles and your own totals. We keep the address and a 90-day record of each delivery attempt. See Slack's privacy policy and Discord's privacy policy.
  • Our email delivery provider (SMTP / SendGrid) — Sends sign-in codes, alerts and transactional email. Receives your email address and the message content. Nothing else about your account is included.
  • Google Fonts and the Tailwind CSS CDN — Our pages load fonts and, on some pages, a stylesheet from these third parties. Because a browser must request them, your IP address reaches Google and the CDN when a page loads, before you have interacted with anything. This happens on the public site whether or not you have an account. We list it here because it is a real disclosure, not because we like it.

AI assistants you choose to connect (Section 2.11) are not our vendors. When you connect Claude (Anthropic, PBC), ChatGPT (OpenAI, L.L.C. / OpenAI OpCo, LLC) or another MCP-capable assistant, the ChannelzIQ data that assistant reads at your request — for example video titles, analytics, comments, scripts and calendar entries — goes to that company under your own account with them, and how they keep and use it (including whether it may be used to train their models) is set by their terms, their privacy policy and your settings there, not by ChannelzIQ. See Anthropic’s privacy policy and OpenAI’s privacy policy. This is separate from the ChannelzIQ AI features described above, which run on Anthropic’s API under our commercial terms.

We may also disclose information if required by a valid legal request (subpoena, court order, law enforcement request) but we will resist requests we believe are overbroad and notify the affected user where legally permitted.

4.1 Third-party data sources used for enrichment

The following third-party services are used to translate and enrich data we already have on file. We do NOT pass your account identity or personal information to any of them — only generic terms (such as place names) are submitted.

Geocoding & Location Data (Nominatim / OpenStreetMap)

ChannelzIQ uses the Nominatim geocoding service to translate audience location data (city / region / country) returned by your connected platforms (YouTube Analytics, Meta Insights) into a standardized format for display and analytics. Map data and geocoding results are provided by OpenStreetMap contributors under the Open Database License (ODbL). We cache geocoding results locally for up to 90 days to reduce Nominatim API load and honor their usage policy. We do not share your audience location data with Nominatim — only generic place names are submitted for translation.

5. Data retention

We retain account information and content you create for as long as your account is active. If you delete your account, your access ends immediately and your data is held for a 30-day grace period, during which you can ask support to stop the deletion; at the end of it your account data is permanently erased. Three things survive that erasure: billing records we are required to keep for accounting and tax purposes (typically 7 years); one audit entry recording that the account was erased and when (kept 7 years, with no content); and encrypted backups until they age out. Backups on our server are kept for 7 days and the off-site copy for 30 days, so a copy of your data can exist for up to about 60 days after you ask us to delete it. If we ever have to restore a backup, we erase again every account whose deletion had already been requested.

Cached data from connected services (e.g., YouTube video metadata, keyword research results) is refreshed regularly and replaced. Analytics we import from your connected services — including history back to when a channel started, where the platform provides it — are kept for as long as your account is active, so trends and comparisons can cover your whole history.

YouTube data (specific commitment). Under Google's YouTube API Services Developer Policies, a daily job deletes any YouTube comment or video details we have not been able to refresh from YouTube in the last 30 days, and closes a YouTube connection that has not synced in 30 days. While your connection stays authorized, our regular sync re-reads your channel and re-pulls recent analytics days; analytics history from earlier days is kept with your account, as described above.

If you disconnect a Google account from ChannelzIQ, we revoke the OAuth token at Google immediately, and the comments and video details we stored through it are deleted once 30 days pass without a refresh. Analytics history imported through it stays with your account until you delete the account or ask us to remove it. If you ask us to delete a specific piece of YouTube-derived data, we will do so within 7 days of your request (see Section 7).

Server log files are deleted after 30 days. Database records follow fixed windows, purged daily: chatbot transcripts and error reports 30 days; sign-in attempts 90 days; sign-in codes 7 days; email opens 365 days; feature-usage events 400 days; internal operational logs (sync, pull, backfill and delivery records) 90 days; email delivery records and security events 365 days; administrative audit entries 90 days, except the record that an account was anonymised, kept for 7 years.

6. How we protect your data

  • All data in transit is encrypted using TLS 1.2 or higher.
  • Sensitive credentials (OAuth refresh tokens, API keys, payment processor tokens) are encrypted at rest in our database.
  • Access to production systems is limited to the ChannelzIQ founding team and requires SSH key authentication. There are no offshore contractors or third-party developers with access to production data.
  • We log all access to production systems and review the logs regularly.
  • Nightly backups are encrypted with a key held outside the server and copied to a separate location.

No security measure is perfect. If we detect a security incident affecting your data, we will notify you and the appropriate authorities as required by applicable law.

7. Your rights

Regardless of where you live, you have the following rights with respect to your ChannelzIQ data:

  • Access and portability — export everything we hold for your organization yourself, from Settings → Data & Privacy → Export All My Data. It downloads as a ZIP of spreadsheets, one per kind of record. You do not need to ask us.
  • Correction — edit it directly: Settings → Profile for your name and email, Settings → Organization for your organization’s details, and Settings → Connected Accounts to reconnect or replace a linked service.
  • Deletion — Settings → Data & Privacy → Delete my account. After a 30-day grace period during which you can change your mind, your content is destroyed across every table that holds it, and the records that must survive for billing and tax are stripped of anything identifying you.
  • Do not sell or share — we do not sell personal information and do not share it for cross-context behavioural advertising. Settings → Data & Privacy has a switch that records your opt-out; it takes effect immediately and you can turn it off at any time. If your browser sends the Global Privacy Control signal we switch it on for you. More about this right.
  • Withdraw consent — disconnect any connected Google or third-party service at any time from within ChannelzIQ Settings, or revoke our access directly from your Google Account at https://myaccount.google.com/permissions.

To exercise any of these rights, email support@channelziq.com. We will respond within 30 days.

8. Children's privacy

ChannelzIQ is not directed at children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact support@channelziq.com and we will delete it.

9. International users

ChannelzIQ is operated from the United States and our servers are located in the United States. If you access ChannelzIQ from outside the US, you understand that your data will be transferred to and stored in the US, which may have different data-protection laws than your jurisdiction.

ChannelzIQ is not currently optimized for compliance with the European General Data Protection Regulation (GDPR) or the UK Data Protection Act. We are keeping that sentence because it is true, and we would rather say so than imply otherwise. What it does not mean is that the underlying rights are unavailable: access, portability, correction, deletion and opt-out are all self-serve controls in the product, described above, and deletion erases your content across every table that holds it rather than merely flagging the account closed. What we have not done is the formal apparatus a GDPR-ready processor is expected to have — a documented lawful-basis register, data-processing agreements with every sub-processor listed in section 4, and a named data protection officer. (We do keep a written incident and breach-response procedure.) We are focused on serving creators based in the United States and Canada at this stage. If you reside in the EU, UK, or another jurisdiction with comprehensive data-protection law, please note that not all features described in this policy may be enforceable in your local courts, and our processes may not fully meet local requirements.

10. Changes to this policy

We may update this Privacy Policy from time to time as we add new features or change our practices. When we do, we will update the "Last updated" date at the top of this page. If we make a material change — a change to what personal information we collect, how we use it, or who we share it with — we will notify you by email or through a notice in ChannelzIQ a reasonable time before it takes effect. We will not apply a material change to personal information we collected before the change without your consent. Continued use of ChannelzIQ after a change takes effect constitutes acceptance of the updated policy.

11. Contact us

Questions, requests, or concerns about this Privacy Policy or how we handle your data? Reach out:

Email: support@channelziq.com

If you need to send physical mail, request our mailing address by emailing support@channelziq.com with the subject line "Mailing address request" and we will respond within 5 business days.