Privacy Policy

At a glance

The public website

aivulix.com is a static website. It has no accounts, forms, advertising, analytics or JavaScript, and we set no cookies. Its fonts and images are served from the site itself.

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes the information a browser sends to load a page, including your IP address, browser details, the page requested and the time. It uses this to deliver the site and protect it from abuse. We do not run a separate web server for the site or keep our own visitor logs. Our Cloudflare account shows us traffic totals, which we do not use to identify anyone.

Two Cloudflare features can involve your browser:

• Security checks. If Cloudflare decides to challenge a request, it may set a security cookie to remember the result.
• Network error reports. Cloudflare’s responses ask browsers to report connection failures to Cloudflare, so it can keep its network working.

The site does not track visitors across other websites, so a browser’s Do Not Track signal does not change how it behaves.

We have turned off Cloudflare’s Web Analytics beacon for this site. Cloudflare describes its own handling of data in the Cloudflare Privacy Policy.

The site links to other sites, including our YouTube channel. When you follow a link, that site’s own terms and privacy practices apply.

Business inquiries

If you email us at business@aivulix.com, we receive your email address, your name if you include it, your message and any attachments. We use these to reply, to handle your inquiry and to keep a record of our business correspondence. We do not add you to a mailing list.

Email to our addresses passes through Cloudflare Email Routing and is forwarded to a mailbox hosted by Google. We have no fixed deletion schedule for correspondence. We keep it for as long as it is useful for the inquiry and our records, and you can ask us to delete it.

AIVULIX Publisher

AIVULIX Publisher uses YouTube API Services. It is the name we use for the internal software that runs our YouTube channel. It has two parts that share one Google authorization: a channel administration tool and a film upload tool. An AIVULIX operator runs them on private servers, sometimes through an AI coding assistant.

Current status: we have paused new use of AIVULIX Publisher until additional data-protection tools are installed. Until then, the deletion and revocation steps on this page are carried out by hand.

AIVULIX Publisher is not a website or a public product. Website visitors cannot sign in to it or use it, and we do not offer it to other channels. The only Google account connected to it is the one that manages the AIVULIX channel.

Use of YouTube API Services is subject to the YouTube Terms of Service. Google describes how it handles data in the Google Privacy Policy.

Google and YouTube data

Permissions we request from Google

youtube.upload

Upload our films and their thumbnails.

youtube.readonly

Confirm which channel is connected, and read its channel, video, playlist, section and caption details.

youtube.force-ssl

Edit channel branding, video details, thumbnails, playlists and channel sections. Correct a video’s details or privacy setting after upload, or delete one of our own videos. The software can also moderate comments and post replies with this permission, but we have not used those features.

AIVULIX Publisher never receives a Google password. It does not request an email address, contacts, YouTube Analytics data or data from other Google services.

What it reads and keeps

Authorization record

The Google refresh token, the permissions granted, the channel ID, title and handle, and the date of authorization.

Channel information

Title, description, keywords, language, country, trailer, banner, playlists, channel sections and statistics. The software reads these when it needs them. It saves before-and-after copies of settings when we plan or apply a change, and we may save a snapshot when we audit the channel.

Videos

Video ID, title, description, tags, category, thumbnails, privacy setting, processing status, file details, statistics and caption list. The upload tool also keeps a local record of each upload: the file’s hash, the video ID, the upload status and a verification report.

Comments

None. As of the effective date above, we have not retrieved or stored any YouTube comments. Before we use the software’s comment moderation, we will update this policy to say what it stores and who receives it.

Activity records

A timestamped log of actions and changes, which can include copies of channel settings, and a count of API calls per day to stay within quota.

Session records

Logs of AI-assisted sessions on our server, and files those sessions saved, which hold channel, playlist and video details.

How we use it

We use this data only to operate the AIVULIX channel: to publish our work, keep channel details correct and confirm that each action had the intended result. We do not sell it, use it for advertising or use it to assess creditworthiness, and AIVULIX does not itself train AI models on it.

The Google API Services User Data Policy, including its Limited Use requirements, applies to our use and transfer of information received from Google APIs. We have not finished reviewing our practices against that policy, including the AI tool use described below.

Who else handles data

We do not sell personal information or share it for advertising. These companies handle data for us:

Google

Receives AIVULIX Publisher’s requests to YouTube API Services and issues its tokens. It also hosts the mailbox our email is forwarded to.

Hetzner

Hosts our main server, which holds the Google authorization and the software’s stored data. See the Hetzner privacy policy.

DigitalOcean

Hosts a second server that we used to finish and upload a film. The upload tool ran there with a short-lived access token, and upload records such as the video ID, video details and verification results are stored there. A search of its main folders by file name found no refresh token or client credential files. See the DigitalOcean privacy policy.

Anthropic

We use Claude Code, Anthropic’s AI coding assistant, to help build and run this software. Channel, playlist and video details that appeared in those sessions, including details of private videos, have been sent to Anthropic for processing. We have not confirmed whether Anthropic may use this information to improve its models. That depends on its terms and our account settings. Our search of the session logs on our main server on November 7, 2026 found no copy of the Google refresh token or client secret. See the Anthropic privacy policy.

OpenAI

An AIVULIX operator has also shared information from our Google and YouTube accounts with ChatGPT, OpenAI’s AI assistant, while working on the channel and this software. This happens outside our servers, so our search of them does not cover it. We have not confirmed whether OpenAI may use this information to improve its models. That depends on its terms and our account settings. See OpenAI’s policies.

Cloudflare

Hosts the website and routes our email, as described above.

Our review on November 7, 2026 of the other AI tools we run on our main server found no YouTube account data in their records. We will update this policy before sending this data to another AI provider.

We may also disclose information if the law requires it, or if it is needed to investigate a security problem or protect people’s rights or safety. These companies may process data outside your country.

How Google tokens are stored and protected

Sign-in

Authorization uses Google’s own OAuth flow with PKCE. Passwords go only to Google. All traffic between the software and Google uses HTTPS.

Access tokens

These are short-lived. The software gets one from Google when it needs one and holds it in memory during that run. For a film upload, one was passed in memory from our main server to the second server. The software does not write access tokens to disk.

Refresh token

We store this so the software can keep working without a new sign-in. It sits in a file in a private folder on our main server, outside the source code. File permissions make it readable only by the server’s administrative account, and the software refuses to use a record that other accounts can read. Tools running under that account, including AI assistants, could technically read it.

Client credentials

The application’s Google client credentials are stored separately under the same restriction. They are not encrypted.

Encryption

The stored refresh token is not encrypted at rest, and disk encryption is not configured on the server. Its protection depends on file permissions and on control of access to the server.

No system is perfectly secure, and we cannot promise that data will never be exposed.

How long we keep data

Refresh token

Until we replace it with a new sign-in, revoke it or delete it. Google can also end a token, for example one left unused for six months.

Stored YouTube data

YouTube’s developer policies require us to confirm our authorization, and to delete or refresh stored YouTube data, at least every 30 calendar days. An AIVULIX operator does this by hand. Nothing runs automatically.

Disconnecting a channel

If we disconnect a channel ourselves, we revoke its token with Google right away and delete the data from that authorization within 7 calendar days, subject to the recovery hold below.

Recovery hold

Our main server is under a preservation hold while we recover from an operational incident. While the hold lasts, we are not deleting data from our servers or from the main server’s recovery snapshot, so data there can outlast the time limits on this page. The snapshot contains copies of the token record, client credentials and stored data. A token in the snapshot stops working when it expires or is revoked.

Removing access and deleting data

To remove Google access

Anyone who has authorized AIVULIX Publisher can remove its access at any time, without contacting us. Open the Google security settings page, select AIVULIX Publisher, and remove its access. After that, the software can no longer get access tokens for that account.

We delete the related YouTube data within 30 calendar days of the revocation, subject to the recovery hold above. Email us at business@aivulix.com if you would like us to confirm when that is done.

To ask us to delete data

Email business@aivulix.com with “Data deletion” in the subject, and tell us the channel or account concerned and what you would like deleted. We may need to confirm who you are. We will tell you what we hold, or that we hold nothing. We will delete it as soon as possible and within 7 calendar days. If the recovery hold above prevents that for a copy on our servers or in the snapshot, we will tell you, and we will finish the deletion when the hold ends.

If you commented on an AIVULIX video, your comment lives on YouTube, and you manage it there. We do not store comments.

Your choices

You can ask us what personal information we hold about you, and ask us to correct or delete it, by emailing business@aivulix.com. Depending on where you live, including California, privacy law may give you further rights, such as the right to complain to a regulator. We may need to confirm who you are before acting on a request.

Children

aivulix.com is for a general audience, is not directed at children under 13, and includes descriptions of horror films. We do not knowingly collect personal information from children under 13. If you believe a child has emailed us, tell us and we will delete the message.

Changes to this policy

When we change this policy, we will post the new version on this page and update the effective date. If a change affects how AIVULIX Publisher uses Google user data, we will also make any notice or new authorization that Google requires.

Contact

AIVULIX is the operating brand, based in California, United States, responsible for this website and for AIVULIX Publisher. Send questions or complaints about this policy, or about our use of Google or YouTube data, to business@aivulix.com.