WatchHighlights for YouTube Privacy Policy

FunCove operates WatchHighlights for YouTube, a browser extension, including for Microsoft Edge, and its supporting service at watchhighlights-for-youtube.funcove.dev. This policy explains how we handle information when you use the extension, request AI highlights or summaries, chat about a video, manage a subscription, or contact us.

Information we handle

• Account identifiers and preferences. The extension creates a random browser account ID and saves it in extension-local storage. Our server receives that ID to recognize your account and manage access and usage. No Google sign-in is required. Your default summary length, playback speed, and summary prompt are saved locally.
• Video and website content. When you request highlights, a summary, or a follow-up answer, the extension sends the current YouTube video ID, title, duration, timestamped transcript, and relevant request settings to our server. Reading captions may make a request to YouTube using the page's existing session. Caption access tokens stay on the YouTube page. We do not upload the video's audio or video files.
• Prompts and conversations. Your summary prompt, follow-up questions, previous answers, and full conversation are sent with chat requests. Our server forwards the video title, transcript, duration information, and relevant prompts and conversation to the AI service to generate an answer or select highlights. A saved text summary can also be sent as a reference when you request highlights.
• Local summaries and chat history. Completed text summaries and chat turns are saved in extension-local storage, associated with the video and browser account. They remain available after a refresh or browser restart and do not automatically sync between browsers. Transcripts and highlight plans are also held temporarily in the current page's memory.
• Read aloud. When you choose Read aloud, the selected answer is sent through our server to OpenRouter and xAI to generate speech. Generated audio is held temporarily in the page's memory for playback and replay. Our application does not save the answer or audio in its server database.
• Payments and subscriptions. Stripe processes payments on its hosted checkout and billing pages. Our service receives and stores payment email addresses, Stripe customer, subscription, checkout and invoice identifiers, purchased plans, payment or renewal status, and billing-period information. We do not store full payment-card numbers or card security codes.
• Account recovery and authentication. If you restore a paid account, we process the payment email address you enter, a recovery request ID, your requesting account ID, a one-time confirmation code, and verification attempts. Our database stores a hash of the confirmation code. The email address and code are sent through Cloudflare Email Service for delivery.
• Usage and security records. Our server stores analysis request IDs, the associated account and billing period, request timestamps, processed video duration, and completion status to enforce allowances and administer the service. It also stores account and subscription status and internal administrator notes about account changes and support. Account recovery processes your IP address and stores hashed rate-limit keys derived from IP addresses and email addresses to limit abuse.
• Support information. If you email us, we receive your email address and the information you choose to include, such as your Support ID or a description of a problem.

We do not collect your general browsing history outside the YouTube videos you use with the extension, browser fingerprints, precise GPS location, or health measurements as a dedicated feature. IP addresses are processed as described above. Prompts or transcripts can contain personal or sensitive information; avoid submitting information you do not want processed by the AI services.

How we use information

We use this information to generate requested highlights, summaries and answers; restore saved conversations and preferences; recognize browser accounts; measure allowance usage; process subscriptions and renewals; restore paid accounts; prevent abuse; and respond to support requests. We do not sell user data, use it for targeted advertising, or use it to determine creditworthiness or lending eligibility. The extension does not include advertising analytics, session replay, or general keystroke tracking.

Service providers and disclosures

• Cloudflare hosts our API and account database and delivers recovery emails. It processes requests, network information, account and billing records, and the content passing through our service. See Cloudflare's privacy policy.
• OpenRouter and AI model providers process the video content, prompts, relevant summaries, and conversation needed to answer your requests. Our current AI integration uses OpenRouter to reach the configured model provider. Our application does not automatically add your payment email, payment-card details, or browser account ID to its AI request body. Information you include in prompts or video content is forwarded as part of that content. Provider retention and possible use for model improvement depend on their policies and service settings; we do not guarantee zero retention or a no-training restriction across every model provider. See OpenRouter's privacy policy and model provider information.
• Stripe processes checkout, subscription payments, invoices, and billing management. Information you enter on Stripe's pages is subject to Stripe's privacy policy.

SponsorBlock is disabled in the current extension release, and no sponsor-segment lookups are made. The extension currently retains its SponsorBlock host permission. If that feature is enabled in a future release, we will update this policy and the relevant disclosures before that release.

We may disclose information when required by applicable law or to address fraud, security incidents, or legal claims. Our providers may process information in countries other than the country where you live.

Storage and retention

Local preferences and conversations remain in this browser profile until you clear them or remove the extension's stored data. Choosing New chat and confirming removes the saved conversation for the current video and account. Refreshing or navigating away clears the page's temporary transcript and highlight cache.

Our application processes transcripts, prompts, and conversations during AI requests but does not persist them in its server database. Application request logging is disabled. Infrastructure and AI providers may retain information under their own policies; this is separate from the extension's local storage and our database.

Account, billing, and completed usage records currently have no automatic deletion schedule. Contact us to request deletion. We may need to retain some records for payment administration, security, dispute handling, or applicable legal obligations. Clearing the extension's local storage does not delete server or Stripe records or cancel a subscription.

Recovery codes expire after ten minutes, and recovery rate-limit entries expire after one hour. Expired recovery and rate-limit records are removed when subsequent recovery requests trigger cleanup; expiration does not guarantee immediate physical deletion.

Your choices and requests

You can choose whether to request an AI summary or send a chat message, change locally saved preferences, start a new chat, clear extension storage, restrict the extension's site access, or uninstall it. Restricting access or clearing data can prevent features from working or create a new browser account. Paid-account recovery requires access to the original payment email.

Use Manage subscription in the extension's Plans tab to open Stripe's billing portal and cancel future renewals. Uninstalling the extension or clearing its data does not cancel recurring payments.

To request access to, correction of, or deletion of information associated with your account, email support@funcove.dev. Include your Support ID from Preferences or the payment email associated with your purchase. We may need to verify ownership before acting. Applicable privacy rights depend on your location, and we will explain any records that must be retained.

Security

Network communications use HTTPS. Provider credentials stay on the server, and recovery codes are hashed, time-limited, and subject to attempt limits. The extension renders AI answers as text and restricted Markdown rather than executing returned code. These measures reduce risk but cannot guarantee absolute security.

Changes and contact

We will update this page and its revision date when our data practices change, and provide additional notice or obtain consent where required. This policy describes current practices rather than authorizing unrelated future collection.