YouTube Parental Control LogoYouTube Parental Control

Privacy Policy

This policy explains how YouTube Parental Control handles information when a parent uses our Chrome extension, website, and associated services.

Last Updated: August 12, 2026

1. Information We Process

  • Account and authentication information: If you create an account or sign in, we process your email address, account identity, authentication/session data, and related security information so we can provide account-scoped features.
  • Parent settings: We store settings such as age limits, channel allow/block lists, flagged words, overlay preferences, history choices, and parental-control configuration so the extension can apply the parent's rules.
  • Active YouTube video content: To provide the extension's core safety feature, the extension processes the active video's transcript or captions and basic context such as the YouTube video ID, title, and channel. It sends the information needed for analysis to our backend, which returns an age classification, summary, safety indicators, and block/allow decision shown by the extension.
  • Optional activity history: Activity history is off by default. If a parent enables it, the parent's account may store YouTube video IDs, titles, channels, timestamps or other viewing context, classification results, and watched, blocked, or allowed outcomes for the activity viewer and monitoring features. This is web browsing/history and user-activity data, even though it is limited to YouTube.
  • Account-linked service activity: Even when detailed history is off, signed-in analysis creates operational records used for quota/credit enforcement and the service's decision workflow. Those records use a generated activity/video identifier instead of intentionally retaining the real YouTube video ID, title, or channel, but can retain credits used, decision/classification outcomes, and content-derived analysis fields. This is user-activity data.
  • Subscription information: We process plan, entitlement, status, and usage information needed to provide free and paid features. Stripe handles payment-card entry; the extension does not receive or store full payment-card details.
  • Feedback and diagnostics: If you email support, we process the message and the contact information supplied by your email provider. The extension never sends diagnostic information automatically. You may prepare, review, and manually copy diagnostic details into an email if you choose.

2. Optional Protection Features

The optional Protection Wizard can provide administrator-policy downloads and an optional heartbeat for stale-install or tamper awareness. The heartbeat is off unless a signed-in parent with an active Premium or Ultimate plan affirmatively enables it after seeing the in-product disclosure. If enabled, each heartbeat sends exactly a random install-specific UUID, browser-reported install type, extension version, and coarse platform category. The server records the receipt time. It does not send the parent's email or account ID, visited websites, YouTube video IDs, titles, channels, transcripts, browsing history, a full user agent, or self-management status. Turning it off or signing out clears the extension's heartbeat schedule and random identifier; heartbeat availability does not change core video filtering.

The heartbeat service accepts only the configured Chrome extension, verifies the signed-in account, associates the installation record with that verified account's UUID, and checks paid entitlement on the server before storing it. Final retention and legal language remain subject to the verification and counsel-review steps in Section 8; this engineering description does not promise an unverified retention period.

If Chrome removes the extension, the browser opens the fixed guidance page https://www.youtubeparentalcontrol.com/api/uninstall. The URL contains no query string, device identifier, extension ID, timestamp, token, account ID, or other uninstall telemetry. The page provides reinstallation and administrator-policy guidance.

3. Chrome Extension Permissions

The intended Chrome Web Store package requests only the permissions and website origins described below.

  • identity: Used for Google and GitHub sign-in through Chrome's WebAuthFlow and PKCE. The extension does not request identity.email and does not use this permission to read the Chrome profile email.
  • storage: Used for extension settings, local feature state, and background-owned authentication state. If a parent enables optional heartbeat monitoring, it also stores the random installation identifier needed by that feature.
  • alarms: Used only to schedule the optional Protection Wizard heartbeat after the required affirmative parent choice.
  • https://www.youtube.com/*: Used for the extension's single purpose: detecting the active YouTube video or Short, obtaining transcript/caption and basic video context, and displaying or enforcing the parent's visible block/allow decision. This grant does not include mobile YouTube, YouTube Music, embedded youtube-nocookie players, or unrelated websites.
  • https://www.youtubeparentalcontrol.com/* and https://youtubeparentalcontrol.com/*: Used for our own APIs, account and checkout pages, safe authentication-status checks, and the one-time website-to-extension authentication handoff.

The extension does not request host access to accounts.google.com, GitHub, or another OAuth-provider origin. Chrome's WebAuthFlow displays Google and GitHub provider pages without granting the extension broad host access to those sites. The two exact HTTPS YouTube Parental Control website origins above are the only externally connectable sites.

4. Account Sign-In

The launch sign-in choices are email/password, magic link, Google, and GitHub. Twitter/X is not a launch sign-in provider. Google and GitHub use Chrome's WebAuthFlow and PKCE. Email/password and magic-link sign-in occur on the HTTPS product website. hCaptcha runs only on ordinary website account forms and is not packaged or executed as extension code.

For website-mediated sign-in, the website sends the named extension only a short-lived, single-use code and state. The extension background worker redeems that code directly using PKCE. Website page scripts, content scripts, URLs, and external-message responses do not receive raw access tokens, refresh tokens, cookies, or full sessions.

5. How We Use Information

  • Provide the extension's YouTube parental-control and safety-classification features.
  • Authenticate parents and provide account-scoped settings and subscription features.
  • Apply parent-selected age, channel, flagged-word, history, and monitoring settings.
  • Operate optional support, feedback, diagnostic, and Protection Wizard features.
  • Protect the security, reliability, and integrity of the service.
  • Meet applicable legal obligations.

6. Service Providers And Disclosure

We use service providers to operate the product, including Supabase for authentication and database services, Stripe for subscription payments, hosting infrastructure, hCaptcha for abuse prevention on ordinary website account forms, and providers used by the backend to perform the requested content analysis. These providers process information for the services they perform for us. We may also disclose information when required by applicable law or as part of a legally permitted corporate transaction.

Final processor, international-transfer, sale/share, advertising, and corporate-transaction language must be reviewed against our current contracts and production practice before final publication.

7. Security

We use administrative and technical safeguards intended to protect information, including encrypted transport, access controls, server-side secret handling, least-privilege extension origins, one-time authentication handoffs, and diagnostic redaction. No method of transmission or storage can be guaranteed to be completely secure.

8. Retention And Deletion

We retain information only as needed for the purposes described here, account controls, security and support needs, billing administration, and applicable legal obligations. The final policy will state verified retention and deletion schedules for analysis/history, feedback and diagnostics, authentication handoff records, heartbeat records, billing records, logs, and backups after those schedules have been confirmed in production and reviewed by counsel. We do not invent or promise an unverified retention period.

Turning off activity history stops future detailed history collection under that setting; available deletion controls and account-deletion requests apply as described by the final, verified policy. To request account or data deletion, contact us using the address below.

9. Your Choices And Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of certain personal information. Parents can manage extension settings, optional activity history, feedback-log attachment, and—once released—the optional heartbeat control in the product. Contact us to make a privacy request.

10. Children's Privacy

The service is designed for parents or guardians to manage YouTube content for children. The parent controls the account and settings. Final child/privacy and parental-consent language must be reviewed for the jurisdictions in which the service will be offered.

11. Chrome Web Store Limited Use

Our use and transfer of information received through Chrome extension APIs is intended to comply with the Chrome Web Store User Data Policy, including its Limited Use requirements. YouTube transcript/caption text and related active-video context are used to provide the prominently disclosed content-safety classification and parental-control experience. Final Limited Use, advertising, transfer, and human-access statements require legal review against actual production practice before store submission.

12. Changes To This Policy

We may update this policy to reflect product, operational, legal, or regulatory changes. We will post the updated policy and change the date above when we do so.

13. Contact Us

Questions or privacy requests may be sent to parental.controls.extension@gmail.com.