stesso

YouTube Connected-Account Privacy Notice

Effective Date: July 25, 2026
Last Updated: July 25, 2026

About this Notice

This Notice describes how Stesso, Inc. ("Stesso," "we," "us") accesses, uses, stores, and deletes information from a YouTube channel that a creator connects to Stesso. It supplements Stesso's general Privacy Policy at https://stesso.com/legal/privacy. Where the two differ with respect to connected YouTube accounts, this Notice controls.

Stesso's creator tools use YouTube API Services. By connecting your channel you also agree to the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

What Stesso Does with a Connected Channel

Stesso reads the comments left on a connected creator's own videos, drafts a suggested reply to each one in that creator's voice, and posts a reply to YouTube at the creator's direction. Stesso does not read or reply to comments on any channel other than the one connected, and does not interact with videos, analytics, monetization, or subscriber data.

A reply is posted only at the creator's direction: either the creator approves that specific reply, or the creator has explicitly switched on automatic posting for replies that clear the safety and quality checks they configured. Automatic posting is off unless a creator turns it on.

Permissions We Request

When a creator connects a channel, Google asks them to grant Stesso two permissions:

  • Manage your YouTube account (youtube.force-ssl) — the narrowest permission YouTube offers for posting a comment reply. There is no read-comments-and-reply-only permission. Stesso uses it for exactly two things: reading the comments on the creator's videos, and posting the replies the creator directs it to post.
  • Your email address (userinfo.email) — so the creator can see which Google account is connected.

We request no other scopes. Before any access is enabled we verify, through the YouTube Data API, that the Google account granting permission actually owns the channel being connected; if it does not, the connection is refused.

Information We Receive from YouTube

  • Comments on the creator's videos: the comment text, the commenter's public display name, the commenter's public channel ID, the like count, the published timestamp, and the comment and video IDs.
  • Video information: titles, descriptions, thumbnails, durations, publication dates, and public statistics such as view counts, for the creator's own videos.
  • Channel information: channel ID, channel name, thumbnail, and public statistics.
  • Video transcripts: where captions are available for the creator's own videos, used so that a drafted reply can reference what the video actually shows.
  • Connected-account data: the Google account email address, and the OAuth tokens needed to act on the connected channel.

Information About Commenters

Comments on a creator's videos are written by people who are not Stesso users. We receive only what YouTube already publishes with a public comment — the text, the public display name, and the public channel ID — and we use it for one purpose: helping the creator answer that comment. We do not use commenter information to build advertising profiles, we do not sell it, and we do not combine it with data from other sources to identify anyone.

If you have commented on a creator's video and want the copy we hold deleted, write to privacy@stesso.com and we will delete it within 7 days. Deleting your comment on YouTube also removes it from public view there.

How We Protect Connected-Account Data

OAuth access and refresh tokens are encrypted at rest using AES-256-GCM. They are never displayed in the product and never written to logs in plaintext. Access to connected-channel data inside Stesso is limited to members of that channel.

Retention and Deletion

How long we keep it. The comment data we receive from YouTube — the comment text, the commenter's display name, the commenter's channel ID, and the like count — is either re-verified with YouTube or deleted within 30 days. We continuously re-read the comments on a creator's videos on a rotating schedule; each time a comment comes back from YouTube we confirm it is still there and keep our copy. Anything we cannot re-verify within 30 days — because the commenter deleted their comment, the video is no longer available, or the channel has been disconnected — has that data erased automatically. What remains afterwards is the creator's own content: the reply they published, the record that they published it, and the timestamps.

When a creator disconnects. Disconnecting revokes Stesso's access with Google immediately, deletes the stored OAuth tokens, and erases the comment data we received for that channel — the comment text, the commenter's display name, the commenter's channel ID, and the like count. Replies the creator already published stay on YouTube, and the creator keeps the record of what they published, which is their own content. This happens as part of the disconnect itself, and in every case within 7 days of revocation.

On request. Any creator, or any person who has commented on a connected creator's video, may ask us to delete the data we hold about them by writing to privacy@stesso.com. We complete such deletions within 7 days.

How to Revoke Stesso's Access

There are two ways, and either one is enough:

  • In Stesso: open Settings for the channel and choose Disconnect channel. This revokes access with Google and deletes the stored data as described above.
  • In your Google account: visit https://security.google.com/settings/security/permissions and remove Stesso's access. If you revoke access this way, we delete the data described above within 7 days.

Sharing

We do not sell connected-channel data or commenter data, and we do not share it for advertising. We disclose it only to service providers that operate Stesso on our behalf — cloud hosting, database, and AI model providers that generate the suggested replies — under contracts limiting them to that purpose, and where the law requires disclosure.

Changes to this Notice

If we change how we handle connected-YouTube data, we will update this Notice and its Last Updated date before the change takes effect.

Contact

  • Privacy: privacy@stesso.com
  • General support: support@stesso.com

Stesso, Inc., a Delaware corporation, United States.