Privacy Policy

1. What we collect

Bluumvault collects the information you provide when creating an account (name, email address) and data from social platforms you choose to connect — specifically, metadata about content you have saved or bookmarked (titles, descriptions, authors, dates, playlist names, thumbnails). We do not collect passwords or payment details directly; those are handled by Clerk and Stripe respectively.

2. How we use your data

Your saved content metadata is used solely to generate AI insight reports for your own use, displayed only to you (or to people you explicitly share a report link with). We do not sell or share your personal data, do not use it for advertising, and do not use it to train AI models — yours or any third party's. Anonymised, aggregated taxonomy signals (for example, how often a content tag like "photography" appears across all users) may be used to improve the product.

3. Third-party services

We use the following third-party services: Clerk (authentication), Supabase/PostgreSQL (database), Anthropic (AI report generation), YouTube Data API (content ingestion), Stripe (payments), Vercel (hosting), and Resend (email). Each operates under its own privacy policy.

4. YouTube and Google user data

Bluumvault's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request. When you connect your YouTube account, we request the https://www.googleapis.com/auth/youtube.readonly scope. This is read-only access — Bluumvault cannot modify, upload, comment on, or delete anything in your YouTube account.

What we read. The metadata of your playlists (including Liked Videos and Watch Later, plus any public playlist URL you paste) and the metadata of the videos within them: title, description, channel name, tags, duration, view count, thumbnail, publish date.

What we do with it. We store this metadata in our PostgreSQL database (encrypted at rest, hosted on Supabase) so we can generate insight reports for you on demand. We send a structured summary of this metadata to Anthropic's Claude API to generate the report; Anthropic processes the request transiently and does not retain it for training (per their commercial terms).

What we do not do. We do not use Google user data for advertising, do not sell or transfer it to third parties for any purpose other than as required to provide and improve Bluumvault to you, do not allow humans to read your Google data except (a) with your explicit consent, (b) for security investigations, or (c) to comply with applicable law, and do not use Google user data to develop, improve, or train generalised AI models.

How to revoke access. You can disconnect YouTube at any time from your Connections page, which removes our stored OAuth tokens. You can also revoke Bluumvault's access directly from your Google Account at myaccount.google.com/permissions. Revocation stops all future ingestion. To also delete the metadata we have already stored, see Data retention below.

5. Data retention

Your data is retained for as long as your account is active. You may request deletion of your account and all associated data — including all ingested YouTube metadata and generated reports — at any time by emailing us at nychemarketing@gmail.com. We will permanently delete your data within 30 days of the request.

6. Cookies

We use cookies strictly necessary for authentication and session management. We do not use tracking or advertising cookies.

7. Contact

Questions? Email us at nychemarketing@gmail.com.