PlaylistMaker

Privacy Policy

Last updated: October 28, 2026

What we collect

From your Google sign-in: your email address and name, and the picture on your Google profile. We never see or store your Google password.

If you sign up with email and password: your email address, an optional name, and your password. The password is stored only as a one-way cryptographic hash (scrypt) that we cannot reverse, never in plain text. We also keep whether you have confirmed your address, and a one-time confirmation code (also stored only as a hash) until you use it or it expires after 24 hours.

Your account record: your email address, name, role, when you first and last signed in, and which version of the Terms and Privacy Policy you accepted and when.

Protection against abuse: to stop automated sign-ups and password guessing, the sign-up form includes a hidden field and a small puzzle your browser solves, and the server counts recent sign-up and sign-in attempts per address and per IP address. The counts are kept in memory for a short time (at most an hour) and are not stored. When it is switched on, the sign-up form also shows a Cloudflare Turnstile check; Cloudflare runs it in your browser and receives details about your browser and connection to decide whether you are a person. Our server logs record the IP address, time and page of each request.

Your playlists: the playlists you save in PlaylistMaker: their names, the videos in them (video identifiers, titles, channel names, lengths, and the public view, like and comment counts YouTube gives us), their order, and, for a copy of one of your YouTube playlists, the identifier and name of the original playlist.

Your Google / YouTube authorization: when you sign in, Google gives PlaylistMaker an access token and a refresh token. They are kept in the server's memory for your session, not written to a database or disk, and are discarded when you sign out, when the session expires, or when the server restarts.

A usage log: each request PlaylistMaker makes to the YouTube API for you is logged with the time, your email address, the kind of request, and whether it succeeded. It is used to watch YouTube's daily quota and to diagnose problems. It does not contain the videos or playlists involved.

Cookies and browser storage: a session cookie keeps you signed in for up to 7 days; a short-lived cookie (10 minutes) is used while you sign in with Google to prevent forged sign-ins; and your browser's local storage keeps, on your device, your current workbench (sources, fetched videos, filters) and which parts of the sidebar are open. We use no advertising or analytics cookies.

What we do not collect

We do not request access to your Google Contacts, Gmail, Google Drive, or other Google services. From Google we ask for your basic profile (name and email address) and permission to view and manage your YouTube playlists. We do not read your watch history, subscriptions, comments, or uploads. We do not use Google Analytics or any advertising network, we place no advertising of our own, and we do not take payments. Videos play in YouTube's embedded player, where YouTube may show its own ads under YouTube's policies; we do not choose, target, or control those ads.

How we use it

  • to create your account, confirm your email address, and sign you in;
  • to show your YouTube playlists and let you search YouTube, fetch videos, and build and save playlists;
  • to create or change playlists in your YouTube account when, and only when, you confirm it;
  • to apply your role, keep the Service within YouTube's limits, and keep it secure and free of automated abuse.

PlaylistMaker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

Google / YouTube: when PlaylistMaker searches, reads, and (at your request) changes playlists on your behalf, under the Google Privacy Policy.

Our infrastructure providers: the hosting services used to run PlaylistMaker, and the email service that delivers the confirmation emails (it sees your email address and the message), used only to operate the Service.

FamTiVi (famtivi.app, also operated by Neurodigits): when, and only when, you click “Watch as a TV station”, PlaylistMaker opens FamTiVi in a new tab and the link includes the identifier of the YouTube playlist concerned, so that FamTiVi can load that playlist. That identifier is not secret (it is part of the playlist's YouTube address), and nothing else about you or your PlaylistMaker account is sent. FamTiVi is a separate service with its own terms and privacy policy.

Sharing a PlaylistMaker playlist with FamTiVi: for a playlist that is not on YouTube, “Watch as a TV station” first asks for your approval. If you approve, PlaylistMaker creates a link containing a random code, and FamTiVi uses it to import the playlist. Anyone who has the link can read the playlist's title and its videos (title, channel, length, thumbnail and publish date), and nothing else: not your name, email address, account or other playlists. We do not publish or list these links. You can turn a link off at any time with “Stop sharing”; it then stops working immediately, although anything FamTiVi has already imported stays with FamTiVi. The random code is kept with the playlist until you turn the link off or delete the playlist.

Cloudflare: only when the Turnstile check is switched on, for the sign-up form, under the Cloudflare Privacy Policy.

We do not sell personal data, and we do not share it with any advertiser. We may disclose information if legally required to (for example, a valid court order), or if Neurodigits is acquired or merged, in which case the successor would be bound by this same Privacy Policy unless you are given notice and a choice otherwise.

How long we keep it

Your account record and saved playlists are kept while your account is active, until you delete them or ask us to. The usage log is kept as long as we need it to monitor quota and diagnose problems. Sign-in tokens live only as long as your session, as described above.

Your choices

  • Sign out at any time. Doing so discards the tokens held for your session.
  • Withdraw PlaylistMaker's access to your Google account at myaccount.google.com/permissions.
  • Delete any playlist you saved in PlaylistMaker from its page. This does not change YouTube; changes you already made to your YouTube playlists stay there.
  • To ask for a copy of your data, or for your account and everything saved under it to be deleted, contact us (below).

Children's privacy

PlaylistMaker is for adults and is not directed at children. We do not knowingly create accounts for children.

Changes to this policy

We may update this policy. The date above shows the latest version, and for significant changes we will ask you to accept it again.

Contact

Neurodigits Inc. Questions about privacy, and requests to export or delete your data: see Support at neurodigits.com/docs.