Last updated: 2 October 2026
Your privacy is important to us. It is MyFreshTools policy to respect your privacy regarding any information we may collect from you across our website ("Services"), and other sites we own and operate.
We only ask for personal information when we truly need it to provide a service to you. We collect it by fair and lawful means, with your knowledge and consent. We also let you know why we’re collecting it and how it will be used.
We only retain collected information for as long as necessary to provide you with your requested service. What data we store, we’ll protect within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification.
We don’t share any personally identifying information publicly or with third-parties, except when required to by law.
Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and practices of these sites, and cannot accept responsibility or liability for their respective privacy policies.
MyFreshTools uses YouTube API Services, and by using YouTube Content within MyFreshTools Sites and Services you are agreeing to be bound to YouTube’s Terms of Service and Google’s Privacy Policy.
Third-party social networking services, such as Google and YouTube, may update their Terms of Service and Privacy Policies from time to time, and MyFreshTools is not responsible for your review of any changes or updates to these. We recommend that you review YouTube’s Terms of Service and Google’s Privacy Policy regularly.
The Service also might enable linking between various online third-party services, including YouTube (“Third-Party Services”). To take advantage of these features and capabilities, we may ask you to authenticate, register for or log into Third-Party Services through the Service or on the websites of their respective providers and, if applicable, allow you to configure your privacy settings in that third-party website account to permit your activities on the Service to be shared with your contacts in your third-party site account.
You are free to refuse our request for your personal information, with the understanding that we may be unable to provide you with some of your desired services.
Several MyFreshTools features (including the YouTube Playlist Export and YouTube Channel Backup tools) let you connect your YouTube account so you can export, back up, and analyze your own content. This section describes what we access, how we use it, and how you stay in control.
When you click Connect YouTube on any of our read-only tools, we request a single scope — https://www.googleapis.com/auth/youtube.readonly. This scope allows MyFreshTools to read your YouTube channel information (channel ID and title), your playlists (including private and unlisted ones you own), your Liked videos playlist, your uploads playlist, and basic metadata about videos in those playlists (title, description, thumbnails, view counts, tags, durations). With this scope alone MyFreshTools cannot change anything on your account.
A small number of tools change things on your YouTube account on your instruction — for example the Playlist Duplicate Remover, Playlist Manager, Playlist Copier, Playlist Builder, Playlist Transfer, Bulk Find & Replace, YouTube Music Bulk Like, and the subscription tools. These require a second, separate permission: https://www.googleapis.com/auth/youtube.force-ssl. We request it only when you choose to connect on one of those tools, and never as part of connecting to a read-only tool. If you only use our read-only tools, you will never be asked for it. Exactly what we do with it is listed under Changes we make to your YouTube account below.
Information accessed via the YouTube Data API is used solely to provide the feature you explicitly invoked — for example, exporting a playlist you selected to a CSV file, backing up your own channel to a downloadable file, or applying the playlist, like or subscription changes you selected and confirmed. We do not use YouTube data for advertising, we do not sell or rent it, we do not transfer it to data brokers, and we do not use it to train machine-learning models.
Only the tools listed under What we access ever change anything on your YouTube account, and only after you connect with the write permission (youtube.force-ssl) and confirm the action. Google grants that permission as a broad one — its consent screen mentions videos, ratings, comments and captions — so it is worth being precise about the narrower set of operations we actually perform with it:
playlistItems.insert, playlistItems.update, playlistItems.delete), and create, edit or delete a playlist you own (playlists.insert, playlists.update, playlists.delete). Used by Playlist Manager, Playlist Copier, Playlist Builder, Playlist Transfer and the Duplicate Remover.videos.rate), used by the YouTube Music Bulk Like tool.subscriptions.insert, subscriptions.delete), used by the subscription tools.videos.update), used by Bulk Find & Replace.Some changes, such as removing a playlist entry or deleting a playlist, cannot be undone — YouTube provides no mechanism to restore them, and neither do we. Please review the confirmation list before confirming. If you would rather not have anything modified, our Playlist Duplicate Finder reports the same duplicates read-only.
To keep your account connected between sessions, we store a YouTube refresh token issued by Google. This token is encrypted at rest using AES-256-GCM with a key held only on our servers. Video and playlist metadata returned by the YouTube Data API is processed in memory to generate your export file and is not retained after the export completes, except for export-history records you can review and delete from your MyFreshTools account. The specific safeguards applied to this data are described in How we protect your data below.
We treat data obtained through Google APIs — including YouTube account, channel, and playlist data — as sensitive user data, and protect it with the technical and organisational measures described in this section.
All traffic between your browser and MyFreshTools, and between MyFreshTools and Google's APIs, is encrypted in transit using HTTPS/TLS 1.2 or higher. Requests sent over plain HTTP are redirected to HTTPS, and every call we make to the YouTube Data API and to Google's OAuth endpoints is made over TLS.
Your YouTube OAuth refresh token — the most sensitive credential we hold — is encrypted with AES-256-GCM authenticated encryption, using a unique random initialisation vector per token, before it is written to our database. A copy of our database on its own therefore cannot be used to reach your YouTube account. The 256-bit encryption key is injected into the application at runtime from server-side environment configuration; it is never stored in the database, never committed to our source code, and never sent to the browser. Account passwords are never stored in readable form: they are one-way hashed with bcrypt (cost factor 12), so we cannot recover or read them.
Every request that touches YouTube data must carry a valid signed session token, and each request is scoped to the authenticated account's own records — one user can never read another user's tokens, channel details, or exports. The OAuth consent flow is itself protected against cross-site request forgery by a signed, short-lived state parameter that expires after 10 minutes, and post-consent redirects are restricted to a same-origin allowlist to prevent open-redirect attacks.
We request the narrowest scope that makes each feature work. Our export, backup, finder and analysis tools operate on youtube.readonly alone and hold no write, upload or delete permission whatsoever — for those tools, even a total compromise of our credentials could not alter or destroy content on your YouTube account.
The tools that modify your playlists, likes, subscriptions or video details ask for youtube.force-ssl in a second, separate consent step that only happens if you choose to use one of them. Two consequences worth being explicit about: connecting to a read-only tool never escalates your grant, and if you hold only the read-only grant those tools will refuse to run rather than quietly asking for more. Where we hold the write permission we constrain its use in code — ownership is verified against your connected channel, we issue only the operations listed under Changes we make to your YouTube account, and every change requires your explicit selection and confirmation.
You can withdraw the write permission at any time without giving up the read-only features, by disconnecting and reconnecting from a read-only tool, or withdraw everything at https://myaccount.google.com/permissions.
Access to production systems, databases, and encryption keys is restricted to the authorised personnel who operate MyFreshTools, using individually issued credentials protected by multi-factor authentication, and is granted only where necessary to run, secure, or support the service. No member of our team reads your YouTube data except as strictly required to investigate a security incident, to comply with applicable law, or with your prior affirmative consent — for example, when debugging a support request you filed.
We keep sensitive data only for as long as the feature you asked for requires it. Playlist and video metadata is processed in memory and discarded once your export file has been generated. Export files are retained only so that you can re-download them from your export history, and are permanently deleted — from both our records and the storage provider — as soon as you delete the history entry; on the free plan, only the two most recent exports are kept and older files are deleted automatically. Disconnecting your YouTube account immediately revokes our token at Google and permanently deletes the encrypted refresh token and the stored channel metadata.
When you use the Playlist Duplicate Remover we keep a record of what was removed — the playlist, the video titles and identifiers, the positions, which copy you chose to keep, and the outcome. We keep it because the deletion is irreversible and YouTube reports nothing back to us: without a record, neither you nor we could establish afterwards what a clean-up actually changed. This record describes changes you asked us to make to your own playlist; it contains no video content, is never used for advertising or profiling, and is deleted along with the rest of your data when you delete your MyFreshTools account. You can request a copy or its deletion at any time using the contact details below.
We use a small number of vetted providers to run the service — application and database hosting, encrypted file storage for your generated export files, and transactional email delivery. These providers process data solely on our instructions in order to deliver the feature you requested, are contractually prohibited from using it for their own purposes, and are never given access to your YouTube OAuth tokens. We do not sell, rent, or transfer Google user data to advertisers, data brokers, or any other third party, and we do not use it to develop, improve, or train generalised artificial intelligence or machine-learning models.
We monitor application and authentication errors to detect abuse and failures, keep our software dependencies patched, hold all secrets in server-side environment configuration rather than in source code, and review changes before they reach production. If we ever become aware of a breach affecting your personal data or your Google user data, we will investigate immediately, revoke affected credentials, and notify you and the relevant authorities without undue delay — within 72 hours of becoming aware, where the law requires it.
MyFreshTools' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not share, sell, rent, or transfer YouTube data accessed through the YouTube Data API to any third party for that party's own use. The only data that leaves our servers is the export file generated for you, which is delivered back to you and — so that you can re-download it from your export history — held by our encrypted file storage provider acting solely as our processor under the terms described in Service providers above. Deleting the history entry deletes the stored file. No human at MyFreshTools reads your YouTube data except as strictly required to investigate a security incident, comply with applicable law, or with your prior affirmative consent (for example, debugging a support request you filed).
You can disconnect your YouTube account from MyFreshTools at any time by clicking the Disconnect button on any tool that shows the YouTube connection status (for example, the YouTube Playlist Export or Channel Backup pages). Disconnecting immediately revokes our access token at Google and permanently deletes the encrypted refresh token and associated channel metadata from our database.
You can also revoke MyFreshTools' access directly from your Google account at any time by visiting https://myaccount.google.com/permissions. If you would like us to delete any other data we hold about you, please contact us and we will action the request within a reasonable timeframe.
By using MyFreshTools features that access YouTube data, you agree to be bound by the YouTube Terms of Service. MyFreshTools' handling of your information is also governed by the Google Privacy Policy.
Your continued use of our website will be regarded as acceptance of our practices around privacy and personal information. If you have any questions about how we handle user data and personal information, feel free to contact us.