Privacy Policy

1. Who this policy covers

This policy covers the DK Security Lab Uploader (the “Uploader”), a desktop application written and used by Dustin Paulson to publish videos to the DK Security Lab YouTube channel, and this sentineltutorial section of dkbuilt.com.

The Uploader is a private, single-user tool. It is not distributed to anyone else, and it has no other users. Nothing in this policy describes the collection of data from a third party, because no such collection happens.

2. Use of YouTube API Services

The Uploader uses YouTube API Services to publish to and manage the owner’s own YouTube channel.

By using the DK Security Lab Uploader you are agreeing to be bound by the YouTube Terms of Service.

Google’s handling of any information it receives is described in the Google Privacy Policy, at https://www.google.com/policies/privacy.

3. How the Uploader signs in, and what it is allowed to do

The Uploader authenticates with Google using OAuth 2.0. The owner signs in to his own Google account in a browser, Google asks him to grant access, and the Uploader receives a token from Google. The Uploader never sees, handles or stores a Google password.

It requests exactly one scope:

• https://www.googleapis.com/auth/youtube.force-ssl

Within that scope the Uploader acts only on the channel owned by the person signed in, and only to:

• upload video files to that channel;
• set or replace a video’s thumbnail;
• upload caption tracks for a video;
• update a video’s metadata — its title, description, tags and category;
• set or change a video’s visibility (private, unlisted or public).

It does not act on any other channel, it does not read or write anyone else’s data, and it performs no action beyond publishing and maintaining the owner’s own uploads.

4. What is stored, and where

The Uploader stores exactly three things, all on the owner’s own computer:

1. An OAuth 2.0 refresh token issued by Google, so that the tool does not have to prompt for sign-in on every upload.
2. The video files and their metadata — the recordings, thumbnails, caption files, titles, descriptions and tags that are being prepared for upload.
3. A small local state file, written by default to ~/.local/state/stuploader/state.json and relocatable with the STU_STATE_DIR environment variable. It holds two kinds of entry and nothing else: the id and title of the YouTube channel the tool was bound to when the owner signed in, which it uses thereafter to refuse to act on any channel other than that one; and a last_run record of the most recent command’s name and its YouTube API quota accounting. It holds no credentials and no video content, no information about anybody but the owner, and it stays on the owner’s own computer.

Those three are everything the Uploader keeps. Nothing is uploaded anywhere except to YouTube, through YouTube API Services, at the owner’s instruction.

5. What does not exist

To be explicit about the things a privacy policy is usually written to disclose — none of the following is part of the Uploader or this section of the site:

• no server and no hosted backend of any kind;
• no database of users, viewers or contacts;
• no analytics, no tracking pixels and no cookies set by this section;
• no telemetry, crash reporting or usage reporting;
• no advertising, and no advertising identifiers;
• no sharing, transfer or disclosure of data to any third party;
• no sale of data, ever, to anyone;
• no collection of data from any other person — the Uploader has one user, its owner, and no accounts exist for anybody else.

Google necessarily receives the video files, thumbnails, captions and metadata that are uploaded, because publishing them to YouTube is the entire purpose of the tool. That is a deliberate action taken by the owner on his own content, and it is governed by the YouTube Terms of Service and the Google Privacy Policy.

6. Retention and Deletion

The stored refresh token and the local video files are kept only for as long as they are needed to publish to the channel. They are deleted:

• on request — write to sentineltutorial@gmail.com and the stored token and local files will be deleted; and
• on uninstall — removing the Uploader removes the stored token and its local working files with it.

The Uploader’s access to the Google account can also be revoked at any time, independently of the tool, from Google’s own security settings page: https://security.google.com/settings/security/permissions. Revoking access there makes the stored refresh token useless immediately.

7. Children

The Uploader and this section of the site are not directed to children under 13, and no information is knowingly collected from children under 13. The tool has a single user, its adult owner, and creates no accounts for anyone else.

8. Changes to this policy

If this policy changes, the revised version is published on this page and the last-updated date at the top is changed with it.

9. Contact

Questions about this policy, or a deletion request:
sentineltutorial@gmail.com

See also the Terms of Service and the DK Security Lab section home.