Privacy Policy

Last updated: August 23, 2026

1. What we collect

• Google profile: name, email, avatar, to create and identify your account.
• YouTube data (read-only, via the YouTube API Services): your video list, titles, durations, thumbnails, and performance metrics (views, watch time, retention, traffic sources, subscriber changes) for channels you explicitly connect.
• Data you enter: manual labels, notes, feedback on insights, support messages.
• Usage records: AI-analysis counts for plan metering, payment history.
• IP address: used only to determine your country when you view pricing or attempt a purchase, so we can show accurate payment-method availability (for example, our payment processor cannot currently settle payments from India). We also use it to work out which country your visit appears to come from, so we can show the cookie notice where it is required. Not used for tracking, profiling, or advertising, and not stored against your account.
• Advertising and analytics cookies: our public website at shortlens.shop sets a small number of cookies for advertising measurement and for product analytics, which includes a replay of how you moved through a public page. The app at app.shortlens.shop uses advertising measurement only, so we can tell whether an advertisement led to a signup or a purchase. No analytics or session replay tool runs anywhere in the app, and nothing at all runs on the sign-in page. Both sites work from the same choice: whichever one you answer on, the answer applies to the other, and nothing optional runs on either until you have answered. These cookies record pages you viewed on our own sites and a pseudonymous identifier we generate. They never carry your Google account data or your YouTube data. Section 3 explains who receives what, and section 9 lists every cookie and how to change your choice.

2. How we use it

Exclusively to provide the Service: computing channel-relative benchmarks, generating AI insights, and operating your subscription. We do not sell your data. We never use your Google account data or your YouTube data for advertising, and we do not use it to build profiles of you.

We do measure our own advertising, which is a separate and much narrower thing: whether a visit to our site resulted in a signup or a purchase. That measurement covers pages on our own sites and the fact of the signup or purchase. It never draws on the data described in section 1 beyond that, and it never involves your YouTube data. Section 3 sets out exactly what is sent and to whom.

We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models. Data sent to our AI providers is used only to generate the insight you asked for, and is returned to you.

3. Who we share, transfer, and disclose data to

We do not sell, rent, or trade your information. We do not transfer or disclose Google user data to third parties except as described in this section: to the service providers below who process it on our behalf so the Service can function, with your consent, or where required by law.

Every provider in the list below is bound by its own agreement with us to use the data only to provide its service to ShortLens, and not for its own purposes. These are the service providers that process data on our behalf. One further recipient, our advertising measurement provider, does not work on that basis and is described separately underneath the list.

• AI processing providers (text analysis): receive pre-digested performance figures for the Short being analyzed, its title, duration and publish day, your channel's median figures for comparison, and any manual labels or notes you added. Used only to write the insight returned to you.
• AI processing providers (video analysis, used only for Advanced Insights): receive the same figures, plus the public YouTube URL of the video so the model can review the video itself. Only videos you have published publicly are ever sent. Private and unlisted videos are never sent.
• Hosting and database provider: operates the servers and database where the Service runs, so it processes the data described in section 1 as our infrastructure provider.
• Email delivery provider: receives your name, email address, and the contents of service emails we send you, such as a welcome message or a payment receipt.
• Payment processor: receives an internal payment reference and the amount only. Our payment processor receives no Google account data and no YouTube data. Any card or bank details you enter are collected by the payment processor directly, and ShortLens never sees or stores them.

Website measurement providers. Separately from the service providers above, our public website uses a small number of third-party tools to measure how the site itself performs. We describe them by what they do, because the specific tools change over time. Section 9 always names the ones currently in use. There are three categories, and only the first two are in use today.

• Advertising measurement: reports that a visit resulted in a free signup or a paid purchase, the amount and currency for a purchase, and a pseudonymous identifier we generate so one event is not counted twice. That identifier is a one-way cryptographic digest, and the provider cannot resolve it to you or to your ShortLens account. The provider also receives standard web request information, such as your IP address and the address of the page you were on.
• Product analytics and session replay: records how visitors move through our public marketing pages, including page views, clicks, scrolling, mouse movement, and a replay of that interaction with the page. It runs on the public website only. It is not present anywhere inside the ShortLens app, so it never sees your videos, your metrics, your insights, or your email address. The provider receives your IP address, your browser and device type, and the pages you visited.
• Error monitoring: if and when we use one, it records the technical details of a failure, such as the error itself, the page it happened on, and your browser and device type, so that we can fix it.

Unlike the service providers listed above, these providers process what they receive for their own purposes under their own terms, and not solely on our behalf. That is why we ask for your consent before any of them run, wherever consent is required, and why you can withdraw it at any time. None of them receives Google account data or YouTube data: not your videos, titles, metrics, retention, or channel. None of them has access to the signed-in pages of the app, with the single exception of the advertising measurement tag described in section 1, which reports only that a signup or a purchase happened.

We never share your Google credentials or OAuth tokens with anyone. Apart from the website measurement described in this section, we use no tracking or profiling services, and no third party receives your data for those purposes. Your YouTube data is never used for advertising, retargeting, or audience building, and is never sent to any advertising service. If ShortLens is ever involved in a merger or acquisition, we will give you notice before your information is transferred and becomes subject to a different privacy policy.

4. YouTube API Services

ShortLens uses YouTube API Services. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's own handling of your data is governed by the Google Privacy Policy. In addition to ShortLens's own deletion process, described in section 6, you can revoke ShortLens's access to your data at any time through the Google security settings page at security.google.com/settings/security/permissions, also reachable at myaccount.google.com/permissions.

5. How we protect your data

Security procedures are in place to protect the confidentiality and integrity of your data, including Google user data. Specifically:

• Encryption in transit. All traffic between you and ShortLens, and between ShortLens and every provider named in section 3, is encrypted with HTTPS/TLS. Connections that cannot be established securely are refused rather than downgraded to an unencrypted one.
• Encryption at rest for credentials. Your Google OAuth tokens are encrypted before they are written to our database, using authenticated encryption that detects tampering as well as preventing reading. The encryption key is held separately from the database, as a protected environment secret.
• Sensitive data is never exposed to the browser. Your OAuth tokens are used only server-side. They are never sent to your browser, never included in any page, and never shared with the AI providers in section 3.
• Authenticated sessions. Sign-in sessions use cryptographically signed cookies that cannot be forged or altered. Administrative access uses a separate credential and a shorter session, and staff passwords are stored only as strong one-way hashes, never in a readable form.
• Access control. Every request for your data is checked against your account, so one account can never read another's videos, metrics, or insights. Access to production systems is limited to the operator named in section 7.
• Data minimization. We request read-only YouTube permissions, so ShortLens cannot post, edit, or delete anything on your channel. We send AI providers only the pre-computed figures needed for the insight, never your credentials.

YouTube metrics and generated insights are stored so your history and patterns work without re-fetching. We retain data while your account is active. No method of transmission or storage is completely secure, so while we work to protect your data we cannot guarantee absolute security. If a breach affects your data, we will notify you at the email address on your account.

6. Deletion

Disconnecting a channel stops syncing; removing a channel deletes its stored data; deleting your account (Settings, Account actions) removes your account and all associated data. Signing in again afterwards starts a brand-new account. Stored YouTube data for a disconnected source is refreshed or deleted consistent with the Google API Services User Data Policy.

7. Governing law and operator

ShortLens is operated by Devendra Singh Baghel, an individual based in Gurugram, Haryana, India. This policy is governed by the laws of India, and any dispute arising from it is subject to the exclusive jurisdiction of the courts of Gurugram, Haryana.

8. Contact

Privacy questions, or to exercise a data request: use the support form in Settings, see the support page, or email support@shortlens.shop (Devendra Singh Baghel, responding to privacy and grievance requests).

9. Cookies and your choices

This section covers both our public website at shortlens.shop and the ShortLens app at app.shortlens.shop. You are asked once, and the answer applies to both.

Your choices

If you are visiting from the European Union, the European Economic Area, the United Kingdom, or Switzerland, we ask before anything optional runs. Until you choose, no analytics or advertising cookie is set and no optional tool is loaded on the page. Nothing is pre-ticked, and refusing takes exactly the same single click as accepting.

If your browser sends a Global Privacy Control signal and you are visiting from one of those places, we treat it the same as pressing Reject all: the notice is not shown, and nothing optional runs. You can still choose to allow analytics or advertising at any time from the Cookie settings link in the footer, which overrides the signal for that browser.

Everywhere else, these tools run by default, and you can turn them off at any time using the same control.

To change or withdraw your choice, use the Cookie settings link in the footer of any page on this website, or, if you are signed in to the app, the Privacy and cookies card in Settings. Either control changes the same single choice, so you do not need to answer twice. If you are not signed in, use the website footer link. When you turn a category off, we stop loading its tool, we delete the cookies it set on our own domain, and we tell the provider to stop. Cookies that a provider set on its own domain can be cleared from your browser settings. Changing your cookie choice never affects your account, your plan, your remaining credits or anything ShortLens has already generated for you. Your choice is remembered for 180 days if you accepted and 365 days if you declined, so declining means we ask you less often. After that, or if we add a tool to a category, we ask again.

The legal basis

• Strictly necessary cookies: used on the basis of our legitimate interest in operating a working website and in honouring the choice you made. They do not require your consent.
• Analytics and advertising cookies in the EU, the EEA, the UK, and Switzerland: used only with your consent, which you give through the cookie notice and can withdraw at any time. Withdrawing consent does not affect anything done before you withdrew it.
• Analytics and advertising cookies elsewhere: used on the basis of our legitimate interest in understanding how our website performs and in measuring our own advertising, subject to the local law that applies to you. You can opt out at any time using the same control.

To work out which of these applies, we check where your visit appears to come from. First we read the time zone your browser reports. That involves no network request and nothing leaves your device. If the time zone does not already place you in Europe, we then confirm the country from your IP address. In the app that confirmation is done by our own server, so your browser contacts no one else at all before you have answered. If either check fails for any reason, we treat you as though you were in the EU and ask for your consent.

We also use your browser's session storage to remember the result of that check for the length of your visit, so it runs once instead of on every page. It is cleared when you close the tab.

Cookies we use

Verified against a live capture of this website on August 22, 2026. Names and lifetimes set by a provider are theirs to change without telling us, so treat this as accurate at that date rather than permanently. If you find a cookie on this site that is not listed here, please tell us at support@shortlens.shop and we will correct it.

Two of these are worth calling out plainly. Our product analytics provider is part of a company that also runs an advertising business, and some of the cookies above are set on that company's own advertising domains rather than ours. Our advertising measurement provider sets a cookie on an advertising domain of its own in the same way. We do not send either company your Google account data or your YouTube data, and we do not use either to advertise to you elsewhere. Declining the matching category above stops them being set.

What these cookies never do

• They never read your YouTube data. That data is only ever handled by the app, on our servers, under the Google permissions you granted.
• They are never used to build an advertising profile from your channel or your videos.
• Session replay runs on our public marketing pages only. It is not present anywhere inside the app.
• Nothing optional runs on the sign-in page, so nothing is set or loaded while you are reading what ShortLens will access, before you decide whether to connect your channel.