VidStats

GDPR overview

There is no explicit GDPR claim anywhere on the site. The word appears only in the meta keywords of the privacy policy, never in the body of any page. The policy does list rights that resemble the regulation's own — access, correction, deletion, portability and withdrawal of consent — and commits to encryption in transit, access controls and data minimisation, but it never names the regulation, never states a legal basis for processing and never mentions standard contractual clauses. No EU representative under Article 27 is designated, no data protection officer is named, and no dedicated privacy address is given: requests go to the general contact address. No data processing agreement is offered and no subprocessors are named. The policy is dated 21 November 2024 and has not been revised since.

Who owns the data?

The terms make VidStats the owner of the service, its content and its functionality; the user keeps their own account and channel data. YouTube data is read through the YouTube API Services only with the user's permission, and the terms state that YouTube login credentials are never stored. The privacy policy commits that Google user data is never sold, rented or transferred to third parties, and that data is shared only as needed to run the application. Users can request access, correction, deletion or a portable copy of their data, and can revoke the OAuth connection to their YouTube account at any time. No legal entity is named as the controller.

Reuse rights

The user reuses their own channel data freely: the insights, exports and generated titles, descriptions, tags and thumbnails are theirs to publish, and nothing in the terms restricts what they do with the output. The restriction runs the other way. The use licence covers only temporary, personal and non-commercial viewing of VidStats' own materials, and forbids copying them, using them commercially or publicly, reverse-engineering the platform, removing proprietary notices, or reselling, redistributing or sublicensing access to the service. Automated tools and bots may not be used to access the service without permission. On its own side, VidStats says it uses collected data only to deliver, maintain, personalise and improve the service, and may keep aggregated, de-identified data for internal analytics.

Data retention & training

Hosting summary

The site never states where user data is hosted: no country, no region, no hosting provider and no jurisdiction are named anywhere in the privacy policy, the terms or elsewhere. What it does describe is security practice rather than location: data in transit is encrypted with industry standard SSL/TLS, access is restricted to authorised personnel, security audits and vulnerability assessments are said to be conducted regularly, and only necessary data is collected and retained. The changelog mentions Supabase as the database layer, which is an implementation detail and not a hosting commitment. Independently of the site, the domain resolves to an IP address geolocated in the United States on an Amazon anycast node; that indicates a point of service on a content delivery network, not the place where data is stored. Anyone with a residency requirement should treat the hosting jurisdiction as unknown.