TL;DW — Privacy Policy
Effective date: 2026-09-26
Changed 2026-09-26: the operator's name in §1 and §14 is now Andromeda Genius, Limited Liability Company, the name on the company's Texas Certificate of Filing. Earlier versions of this page named "Andromeda Genius, Inc", which was never formed — the company, its address, its contact and everything this policy says about your data are unchanged. Only the legal name is corrected.
1. Who we are
TL;DW summarises YouTube videos you have saved, and sends the summaries to you by e-mail.
- Operator: Andromeda Genius, Limited Liability Company
- Postal address: 5460 Babcock Rd, Suite 120 PMB 95234, San Antonio, TX 78240, United States
- Privacy contact: info@andromedagenius.com
2. What we collect
From your Google account, when you sign in
We ask for permission to see your YouTube account (youtube.readonly) and to
identify you. We store:
| what | why |
|---|---|
| your e-mail address | to send your summaries and identify your account |
| your first name | to address you in the interface |
| your Google account identifier | the stable key linking you to your data |
| an access token and a refresh token | to read your playlists on your behalf |
| the playlist you selected | so we know which videos to summarise |
Google also sends us your full name, profile picture, locale and hosted-domain values. We do not store them.
We only accept sign-in from Google accounts with a verified e-mail address.
What we read but do not store
When you load your dashboard we ask YouTube for the playlists on your account, including private ones. We use them to show you a list to choose from. We store only the identifier of the playlist you select.
For each video summarised we read its title, thumbnail and duration.
What we create
- Summaries, generated from the video's transcript.
- Transcripts, cached so a video already processed is not fetched twice. This cache is shared across users and records no information about who requested a video.
- Job records — an internal note that a summarisation is in progress.
What we do not collect
We do not log your IP address, your user-agent string, or the pages you visit. We verified this against our own logs. We use no analytics, tracking pixels, or advertising cookies.
3. Cookies
We set one cookie: a session cookie that keeps you signed in. It holds your internal user number, a freshness flag, and a value derived from your IP and browser used to detect session hijacking. It is not used for advertising.
Your browser also loads two code libraries from a public CDN
(cdn.jsdelivr.net), which can see your IP and browser as a consequence of
serving them. We receive nothing from it.
4. Who we send your data to
We do not sell your data and we do not use it for advertising.
| service | what it receives |
|---|---|
| Google (OAuth & YouTube Data API) | your tokens; requests for your playlists and video details |
| Google Gemini | the text of a video's transcript. Not your name, e-mail, account identifier, or the video's identity |
| Resend | your e-mail address and the summary, to deliver it |
| Oxylabs (network proxy) | the addresses of the YouTube pages we fetch. Nothing identifying you |
Neon (serverless Postgres, hosted on AWS us-west-2) |
your account record — e-mail address, first name, Google account identifier, access and refresh tokens, and your selected playlist |
| Amazon Web Services | our application logs (§6). Hosting |
When you open one of our e-mails, your mail provider loads thumbnail images from YouTube, so Google can see the message was opened — as for any e-mail containing images. Most clients can block remote images.
5. Google user data — Limited Use
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We use your YouTube data only to provide the summarisation feature you asked for.
- We do not transfer it to others except as needed to provide that feature (§4), or as required by law.
- We do not use it for advertising and we do not sell it.
- We do not allow humans to read your data, except where you ask us to, where it is necessary for security, or to comply with the law.
6. Logs
We write operational logs to Amazon CloudWatch in our own AWS account, recording what the service did and for whom.
These logs identify you by an internal user number and a shortened tag derived from your e-mail address — not by the address itself. They also record the identifiers and titles of the playlists and videos you process.
That tag is still information about you, and we treat it as personal data rather than as anonymous data. The tag cannot be run backwards, but that is not a guarantee of anonymity: anyone who already knows your address can confirm it matches.
Logs written before 5 September 2026 do contain e-mail addresses in full. Those logs are deleted on the same 30-day schedule as all others, so they expire in the ordinary course.
Logs are retained for 30 days, then deleted. They do not contain your access or refresh tokens; we verified this by searching for them.
7. How long we keep things
We keep your account record for as long as your account exists. It is stored in a managed Postgres database (Neon, §4), separately from the application, and it survives restarts and deployments.
- Your account, tokens and playlist selection persist until you delete your account or disconnect (§8).
- Cached transcripts are held in the running application and are discarded when it restarts. They contain no information about who requested a video.
- Logs are retained for 30 days and then deleted (§6).
If Google ends our permission to act on your behalf, you will be asked to sign in again. That is a sign-in prompt, not a loss of your data.
8. Your choices and rights
From within the service you can export your data, disconnect your Google account, and delete your account.
You may revoke our access at any time, independently, at Google's permissions page.
Depending on where you live you may have rights to access, correct, delete, export or restrict processing of your data, and to object to it. Contact us at the address in §1. You do not need an account to make a request.
9. Legal bases (UK and EEA)
- Performance of a contract — providing the summaries you requested.
- Legitimate interests — keeping the service running, secure, and diagnosable.
- Consent — access to your YouTube account, granted through Google's consent screen and withdrawable at any time (§8).
10. Security
Credentials are held in AWS Secrets Manager. Traffic is served over HTTPS. Access to our AWS account is restricted to the operator.
Your Google access and refresh tokens are encrypted in our database.
No service is perfectly secure and we do not claim to be.
11. Children
TL;DW is not directed at children under 13 (under 16 in the EEA/UK) and we do not knowingly collect their data. Contact us if you believe otherwise and we will delete it.
12. International transfers
Our infrastructure runs in the United States (AWS us-west-2), and our providers
may process data in the United States and elsewhere. If you are in the UK or EEA,
your data is transferred outside your region.
13. Changes
We will update the effective date above. Material changes will be described at the top of this page.
14. Contact
Andromeda Genius, Limited Liability Company
5460 Babcock Rd, Suite 120 PMB 95234
San Antonio, TX 78240, United States
info@andromedagenius.com