1. What we collect

Account — name, email, profile image from Google or Facebook when you sign in (via Auth.js).
OAuth tokens — YouTube / Facebook access & refresh tokens so we can upload on your behalf. Stored encrypted (AES-256-GCM, key tube-v1) and never logged.
Content — audio files, thumbnails, titles, artist names, descriptions, visualizer choice (bars/circular) and color. Held in R2/S3 under audio/<userId>/…, artwork/…, social-videos/<jobId>.mp4.
Video jobs — job status (queued → done/failed), duration, preset, destination results (externalId, videoUrl, error).
Analytics — page path, truncated IP, user-agent for aggregate visit counts on /api/analytics/visit. No fingerprinting, no cross-site tracking.
Support — messages you send via Contact.

2. How we use it

Generate your 1080p video with ffmpeg (showwaves + circular canvas) and cache it in R2 for fast re-upload.
Publish to the YouTube channel / Facebook Page you selected, using your tokens and chosen visibility/schedule.
Run your dashboard (/dashboard, /dashboard/jobs) and admin aggregates (counts of visits/users/uploads per user).
Serve AdSense ads on public pages only — homepage, How it works, FAQ, About — never on login, dashboard, jobs, or admin.
Security, abuse prevention, debugging and legal compliance.

We do not use your audio or thumbnails to train models, and we do not sell personal data.

3. Legal bases (EEA/UK)

Where GDPR applies: contract (to provide Karhari Tube), legitimate interests (security, analytics, service improvement), consent (AdSense personalization, optional features), and legal obligation.

4. Cookies & tracking

Essential: NextAuth session cookie (httpOnly JWT) to keep you signed in.
Analytics: first-party visit ping only; no third-party analytics on dashboard.
Ads: Google AdSense may set cookies for ad delivery/measurement on public pages. Manage at Ads Settings and My Ad Center. Use of AdSense is subject to Google’s ad policies.

5. YouTube & Facebook data

If you connect Google, we request youtube.upload, youtube.readonly and youtube to list your channels (youtube/v3/channels?mine=true) and upload via resumable uploads. If you connect Facebook, we request pages_show_list, pages_read_engagement, pages_manage_posts to list Pages and publish via Graph API v19.0 file_url. Use of these APIs is governed by Google Privacy Policy + YouTube API Services Terms and Meta Privacy Policy. You can revoke at any time: Google Permissions and Facebook Business Integrations — revoking immediately stops future uploads.

5.1 How we share Google user data

We do not sell, share, transfer, or disclose Google user data to third parties for advertising, marketing, or any unrelated purpose. We only transfer Google user data as strictly necessary to operate Karhari Tube as you directed:

To Google itself – via the YouTube Data API (googleapis.com) to list your channels (youtube/v3/channels?mine=true) and to upload the video you created (youtube.videos.insert resumable upload). This happens only when you click Create Video and select a YouTube destination.
To our service providers acting as data processors under contract – MongoDB Atlas (encrypted storage of your OAuth tokens with AES-256-GCM), Cloudflare R2 (temporary storage of social-videos/<jobId>.mp4), and Vercel/Render (app hosting). They may not access or use your Google data for their own purposes and are bound by confidentiality and, where required, Standard Contractual Clauses (SCCs).
As required by law or with your explicit consent – if we must comply with a legal obligation or you give us permission to do so.

We never allow humans at Karhari Media to read your Google data, we never use it for ads or personalization, and we never use it to train AI models. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time at Google Permissions — revocation immediately deletes/disables your tokens on our side (see §6).

6. Retention & deletion

Source audio/artwork: removed from temp after processing; R2 copy kept ~24h for retry, then purged.
Generated video: cached at social-videos/<jobId>.mp4 for fast re-upload; deleted on your request or after ~30 days.
Tokens: deleted when you disconnect the provider in Settings → Connections or delete your account.
Account deletion: email support@karharimedia.com — we erase PII within 30 days, keeping only anonymized aggregates (counts) where needed for legal/financial records.

7. Security

Tokens encrypted with AES-256-GCM; R2 bucket private with signed URLs; HTTPS everywhere; least-privilege access; logging redacts secrets. No system is 100% secure — use a strong, unique password for your Google/Facebook account and enable 2-step verification.

8. Your rights

Depending on your region you may have rights to access, correct, delete, export, object to or restrict processing, and withdraw consent. To exercise them, email support@karharimedia.com. You can also export or delete jobs from your dashboard. For EEA/UK you may lodge a complaint with your supervisory authority.

9. Children & international transfers

Karhari Tube is not directed to children under 13 (16 in the EEA). We do not knowingly collect data from children. Data may be processed in India and in regions where our providers (MongoDB Atlas, Cloudflare R2, Vercel/Render) operate, under contracts and safeguards (SCCs where required).

10. Changes & contact

We’ll post updates here and change the “Last updated” date above. Material changes will be highlighted on the homepage or by email. Questions: email support@karharimedia.com or Contact us. Related: Terms & Conditions.