Privacy Policy
VideoIndex is an open-source project. This site (videoindex.org) is a static page. The demo (videoindex.app) lets signed-in visitors ask questions about a fixed set of public YouTube videos. This policy describes what those services collect and what happens to it. It is written to be read, not skimmed; it is short because we collect little.
1. What we collect
1.1 Sign-in with Google or GitHub
To use the demo you sign in with a Google or GitHub account. We request only basic profile
scopes (Google: openid, email, profile; GitHub:
read:user, user:email). From the provider we receive and keep in your
session: your account identifier, display name, e-mail address and profile picture URL, and which
provider you used. We do not receive your password, your contacts, your repositories, your
calendar or anything you post on those services, and we never write to your account.
1.2 Session cookie
After sign-in we set one cookie, vi_session, containing the profile fields above, a
signature and an expiry. It is HttpOnly, Secure and valid for 7 days. Signing out deletes it.
A short-lived vi_oauth cookie (10 minutes) protects the sign-in handshake. There are
no advertising, analytics or third-party tracking cookies.
1.3 Questions you ask
The questions you type are sent to our server, which searches the video index and forwards the question together with excerpts of the videos (transcript, on-screen text, selected frames) to a large language model provider (currently Anthropic's Claude) to compose the answer. The provider processes this under its own terms; we send no account information with it. We keep a per-account count of questions per day to enforce the demo allowance; the count is held in memory and resets daily. Questions and answers may appear in application logs for debugging and are not linked to a profile beyond that.
1.4 Server logs
Like every website, our web server records the IP address, time, requested URL, status code and browser user agent of each request. Cloudflare sits in front of our servers and keeps its own logs under its policy. We use these logs for security and operations only and rotate them within 30 days.
1.5 Embedded YouTube player
The demo plays videos through YouTube's embedded player. When a video loads, your browser connects to YouTube (Google), which may set its own cookies and collect data under the Google Privacy Policy. We do not control that collection.
2. What we do not do
- We do not sell, rent or share personal data with third parties for their own purposes.
- We do not use your data for advertising or profiling.
- We do not train models on your questions.
- We do not store your e-mail address or profile outside the session cookie in your own browser; there is no user database.
3. Why we process this data
Sign-in exists to keep the demo available: it lets us give each person a fair daily allowance of questions, which cost money to answer, and to block abuse. Processing rests on our legitimate interest in operating the service and, for the sign-in itself, on your request to use it.
4. Retention
- Session cookie: 7 days, or until you sign out.
- Daily question count: until the end of the UTC day.
- Server and application logs: up to 30 days.
5. Your rights and choices
You can sign out at any time, which removes the session cookie. You can revoke the demo's access from your Google account permissions or GitHub authorized applications; because we store nothing about you server-side, revocation plus signing out removes everything we hold except transient log lines. Depending on where you live you may also have rights of access, correction, deletion and objection; contact us and we will honour them.
6. Children
The demo is not directed at children under 16 and we do not knowingly collect their data.
7. Changes
We will post any change to this page and update the effective date above. The page history is public.
8. Contact
Questions about this policy or your data: open an issue in the VideoIndex repository or write to the support e-mail shown on the sign-in consent screen.