Skip to main content

Legal

Privacy Policy

Last updated: February 8, 2026

1. Introduction

WavelyLabs ("we," "us," "our") operates Tube2Web (the "Service"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Service.

By using Tube2Web, you agree to the practices described in this policy. This policy should be read together with our Terms of Service.

2. Information We Collect

Account Information

When you create an account, we collect your email address and name. If you sign in via Google OAuth, we receive your Google profile information (name, email, profile picture). Passwords are hashed and stored securely via Supabase Auth.

YouTube Data

We fetch public video metadata (titles, descriptions, thumbnails, view counts), channel information, and playlist data via the YouTube API. This data is used to build and display your sites. We do not access private YouTube account data or store YouTube login credentials.

Transcripts & AI-Generated Content

We process video transcripts and send them to AI providers to generate summaries, articles, and chat responses. These AI outputs, along with transcripts, are stored in your account.

Site Configuration

We store your site names, branding settings, collection configurations, and preferences.

Usage Data

We automatically collect technical information such as IP address, browser type, operating system, pages visited, and feature usage patterns. This data helps us improve the Service.

Payment Data

When paid features become available, payments are processed by Lemon Squeezy as Merchant of Record. We do not store credit card numbers or bank account details. Lemon Squeezy may share transaction metadata (purchase date, amount, subscription status) with us.

3. How We Use Your Data

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Generate AI-powered summaries, articles, and chat responses
  • Authenticate users and manage accounts
  • Process payments (via Lemon Squeezy)
  • Send service-related communications (account notifications, updates)
  • Analyze usage patterns to improve features and performance
  • Prevent fraud, abuse, and unauthorized access
  • Comply with legal obligations

4. Third-Party Services

We share data with the following third-party services as necessary to operate the Service:

  • YouTube API Services — We send API requests to fetch public video metadata, channel info, and playlists. Subject to YouTube Terms and Google Privacy Policy.
  • Google Gemini / OpenAI — Transcripts and user prompts are sent to AI providers to generate summaries, articles, and chat responses. Subject to their respective terms and privacy policies.
  • Supabase — Hosts our database and handles authentication. Your account data and content are stored in Supabase infrastructure.
  • Cloudflare — Hosts and delivers the Service via its global CDN and Pages platform.
  • Lemon Squeezy — Processes payments as Merchant of Record when paid features are available. Handles billing, tax, and refunds.

We do not sell your personal data to third parties.

5. YouTube API Services Compliance

Tube2Web uses YouTube API Services and complies with the YouTube API Services User Data Policy, including the Limited Use Requirements.

  • We only access public video metadata necessary to operate the Service
  • We do not sell, lease, or monetize YouTube API data
  • We do not store YouTube login credentials
  • YouTube Data is used solely to display and enhance user sites

You can revoke Tube2Web's access to your YouTube data at any time via the Google security settings page. Upon revocation, YouTube API data associated with your account will be deleted.

6. Cookies & Tracking

We use the following types of cookies:

  • Essential cookies — Required for authentication and session management (Supabase Auth). These cannot be disabled.
  • Analytics cookies — May be used to understand how the Service is used and to improve performance. You can opt out of non-essential cookies via your browser settings.

We do not currently use third-party advertising cookies.

7. Data Retention

  • Active accounts — Your data is retained for as long as your account is active.
  • Deleted accounts — Personal data and User Content are removed within 30 days of account deletion.
  • AI-generated content — Deleted along with your account.
  • Backups — May persist in encrypted backups for up to 90 days after deletion.
  • Usage logs — Retained for up to 90 days for security and operational purposes.

8. Data Security

We take reasonable measures to protect your data, including:

  • HTTPS/TLS encryption for all data in transit
  • Row-Level Security (RLS) in our database to isolate user data
  • Access controls limiting who can view and modify data
  • Secure hosting on Cloudflare and Supabase infrastructure

No system is 100% secure. If you discover a security vulnerability, please report it to [email protected].

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access — Request a copy of the personal data we hold about you.
  • Correction — Request that we correct inaccurate or incomplete data.
  • Deletion — Request that we delete your personal data.
  • Portability — Request your data in a machine-readable format.
  • Restriction — Request that we limit how we process your data.
  • Objection — Object to certain types of data processing.
  • Withdraw consent — Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

11. International Data Transfers

Your data may be processed in the United States, the European Union, and other countries where our service providers (Supabase, Cloudflare, Google, OpenAI, Lemon Squeezy) operate. By using the Service, you acknowledge that your data may be transferred to and processed in countries with different data protection laws than your country of residence.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Service. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Operator & Contact

Tube2Web is operated by WavelyLabs.

For privacy-related questions or to exercise your data rights, contact us at [email protected].