Privacy Policy
MathMotion Dashboard · Last updated 2 September 2026
1. The short version
MathMotion Dashboard (“the Dashboard”) is a private tool used by two people. The only personal data in it belongs to the two of us who sign in. It holds our own videos and captions, our own platform connections, and the public view and engagement counts of our own posts.
It collects nothing about the people who watch those videos. It has no advertising, no analytics, no tracking pixels and no third-party content. Nothing in it is sold, rented or shared with anyone beyond the service providers listed in section 8, and no data from it is used to train machine-learning models.
2. Who is responsible
The operators of the MathMotion channel, Thomas and Wannes, jointly run the Dashboard and are the data controllers for everything described here. Reach us at mathmotion97@gmail.com.
3. Whose data this is about
The Dashboard has exactly two users, both named on a server-side allowlist. There is no public sign-up and no third user. If you are not one of the two, the Dashboard holds no personal data about you — including if you have watched, liked or commented on one of our posts. Those interactions reach us only as totals, never as identities. See section 4.
The Dashboard is not directed at children and is not to be used by anyone under 16.
4. What is collected, and why
Sign-in identity
Your name, email address and profile picture, received from Google Sign-In. Used to check your address against the allowlist and to show who is signed in. Legal basis: our legitimate interest in keeping a private tool private.
Videos and planning data
The video files you upload, the poster frame taken from them in your browser, the watermarked copy produced from them, and the title, caption, posting date, format and owner recorded for each platform. Legal basis: performance of the arrangement between us — this is the tool doing its job.
Platform connection data
For each platform you connect: an OAuth access token and, where the platform issues one, a refresh token; the scopes actually granted; the token’s expiry; and the display name of the connected channel, Page or account, so the Connections page can tell you which account you are actually connected as. Tokens are encrypted at rest before they are written. Legal basis: your consent, given on the platform’s own permission screen, which you can withdraw at any time.
Your own posts and their statistics
For posts you link or import: the platform’s own post id, the permalink with tracking parameters stripped, the caption, the publish date, a thumbnail URL, and the counts of views, likes, comments and shares — plus the history of those counts over time, so the Insights chart can be drawn.
These are aggregate numbers. The Dashboard does not read, store or display comment text, commenter names, the identities of people who liked a post, follower or audience lists, demographics, or any other data about the people who watch and engage with the posts.
Technical data
A session cookie set when you sign in, so the browser stays signed in; and the ordinary request logs our hosting provider keeps (IP address, timestamp, path), which we do not enrich, analyse or link to anything else.
5. What the Dashboard does not do
- No advertising, no ad networks, and no third-party content served inside it.
- No analytics, no tracking pixels, no fingerprinting, and no cookies other than the one session cookie in section 13.
- No selling, renting or licensing of any data, to anyone, ever.
- No profiling and no automated decision-making.
- No collection of data about the audience of your posts.
- No use of platform data to train machine-learning or AI models.
- No transfer of platform data to any third party, beyond the processors in section 8 that host it on our behalf.
6. YouTube API Services
This section is required by the YouTube API Services Terms of Service and the YouTube API Services Developer Policies.
- The Dashboard uses YouTube API Services.
- By using its YouTube features you are also agreeing to be bound by the YouTube Terms of Service at https://www.youtube.com/t/terms.
- Google’s handling of your data is governed by the Google Privacy Policy at google.com/policies/privacy.
- You can revoke the Dashboard’s access at any time from the Google security settings page at https://security.google.com/settings/security/permissions. Revoking there takes effect immediately and does not depend on anything you do in the Dashboard. Disconnecting on the Connections page deletes the stored tokens as well.
What is accessed
Under the youtube.readonly scope: your channel’s name and id, the listing of your own uploads playlist (video id, title, description, publish date, thumbnail), and the public statistics of your own videos — view count, like count and comment count. Under the youtube.upload scope: nothing is read; it is used only to place your own video on your own channel as a private upload, which you then review and publish yourself.
What is done with it
It is displayed back to you inside the Dashboard, and nothing else. It is not shared, sold, published, or combined with data from any other source, and it is not used to calculate or substitute any other figure.
How long it is kept
- Authorisation tokens: for as long as the connection is active and used for the purpose you consented to.
- The per-video public statistics described above, and their history over time: retained as the Developer Policies permit for that class of data, with the authorisation re-checked at least every 30 days. If it is no longer valid, the data is removed.
- All other YouTube API data: refreshed from the API rather than accumulated, and not kept for longer than 30 calendar days.
- On a deletion request, YouTube API data is deleted as soon as possible and within 7 calendar days.
Questions or complaints
About this section, or about our privacy practices generally: mathmotion97@gmail.com.
7. Facebook, Instagram and TikTok
Meta (Facebook and Instagram)
Permissions requested: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, instagram_manage_insights, read_insights and business_management.
With them the Dashboard reads the list of Pages you administer and their names, the Instagram professional account linked to the Page, your own recent media (permalink, caption, timestamp, thumbnail) and the aggregate view, like, comment and share counts of your own posts; and it publishes or drafts a reel when you ask it to. Nothing else. You can remove the Dashboard under Facebook Settings → Apps and Websites, or Instagram Settings → Apps and Websites.
TikTok
Scopes requested: user.info.basic, video.upload and video.list.
With them the Dashboard reads your account’s basic profile (open id, display name, avatar) so the Connections page can name the connected account, lists your own recent videos, and reads their view, like, comment and share counts. video.upload places a video in your own TikTok inbox as a draft — you pick the sound, finish the edit and post it yourself. The Dashboard never posts to your feed. You can remove it under TikTok Settings → Security and permissions → Manage app permissions.
8. Who else processes the data
- Vercel — hosting and private Blob storage. Videos, records and the connection file live in a private store and are served only through an authenticated route, never from a public URL.
- Google — sign-in identity, and the YouTube Data API.
- Meta and TikTok — their own platform APIs, only for the accounts you connected.
There is no one else: no analytics vendor, no error-tracking service, no email platform, no advertising partner. Some of these providers process data outside the European Economic Area; where they do, the transfer relies on the European Commission’s standard contractual clauses as incorporated in that provider’s own terms.
9. How long things are kept
| Data | Kept |
|---|---|
| Session cookie | Until you sign out, and in any case no more than 30 days |
| Sign-in identity | For as long as your address is on the allowlist |
| Videos, watermarked copies, thumbnails, captions, schedule | Until you delete the library entry |
| Platform access and refresh tokens | Until you disconnect, the token expires, or you revoke it at the platform |
| Post statistics and their history | While the library entry exists; YouTube figures as set out in section 6 |
| Cached listing of your recent posts, used by the import screen | Replaced whenever it is older than 30 minutes |
| Hosting request logs | Under our hosting provider’s own retention schedule |
On a deletion request everything above is removed within 30 days, and YouTube API data within 7 days.
10. Security
- Production has no password bypass and no development mode.
- Google establishes who you are; the server then checks that address against an explicit allowlist before anything is returned.
- Platform credentials are encrypted with AES-256-GCM before they are written, under a key derived by HKDF from a secret that is not the sign-in secret. The browser never receives a stored secret — only a masked tail of it.
- Original videos live in a private blob store behind an authenticated download route, never on a guessable public URL.
- The OAuth state parameter is signed and expires after ten minutes, so a callback cannot be replayed.
No system is perfect and we make no absolute promise. What helps most here is the shape of the thing: two accounts, no public surface, and no data about anyone else to lose.
11. Your rights
Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how it is processed, to receive it in a portable form, and to withdraw consent for anything based on consent. Withdrawing consent does not affect processing that already happened.
Write to mathmotion97@gmail.com and we will answer within 30 days. You also have the right to complain to a supervisory authority — in Belgium, the Gegevensbeschermingsautoriteit / Autorité de protection des données, gegevensbeschermingsautoriteit.be.
12. Deleting your data
There is a page for exactly this, with the self-service steps, the email route and how to revoke access at each platform: data deletion instructions.
13. Cookies
One cookie: the session cookie set when you sign in with Google. It is strictly necessary — without it the Dashboard cannot tell one request from another — and it is cleared when you sign out. There are no analytics cookies, no advertising cookies and no third-party cookies, which is why you are not being asked to consent to any.
14. Changes to this policy
Changes are published here with a new date at the top. If a change means using data in a way this policy does not already describe, we will ask for consent again before doing it.