Skip to content

Privacy Policy

Last updated 2026-09-18. Questions: support@example.com

1. In short

TubeMarq is built to need as little about you as possible. Without an account the Extension keeps your watch list only in your own browser and sends us nothing. With an account we hold your email address, the watch list you choose to sync, and — if you subscribe — the identifiers Stripe needs to bill you. We do not sell your data, we do not advertise, we do not profile you, and we do not track you across websites. This policy explains the rest: what we hold, why, for how long, who helps us process it, and the rights you have over it under the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”).

2. Who is responsible for your data

[Company legal name] (Ideias Tecnológicas), [Registered address], Portugal, tax number [NIF], is the controller of the personal data described in this policy. You can reach us about anything in it at support@example.com or through our contact form.

We have not appointed a Data Protection Officer, because our processing does not meet any of the conditions in Article 37 of the GDPR. Privacy questions go to the address above and are handled by us directly.

3. What this policy covers

It covers the TubeMarq browser extension (the “Extension”), this website, and the optional account and synchronisation features (“Sync”). It does not cover YouTube itself. The Extension runs on YouTube pages to read the video you are watching and your position in it, but we are not affiliated with YouTube or Google, we receive nothing from them, and your use of YouTube stays subject to Google’s own privacy policy.

4. Using the Extension without an account

The Extension is fully usable signed out. In that mode it reads the video id, title, channel name, duration and your playback position from the YouTube page you are on and writes them, with your settings, to Chrome’s local extension storage on your own device. None of it reaches our servers, and we have no way to see it. It is not transmitted, backed up or shared. Uninstalling the Extension deletes it, and so does clearing the extension’s data from your browser.

Because that data never leaves your device, we are not the controller of it, and the rights in section 11 have nothing for us to act on — the data is already entirely in your hands.

5. What we collect when you use an account, and why

This is the complete list. For each purpose it gives the data, the legal basis under Article 6(1) of the GDPR, and section 9 gives how long we keep it.

5.1 Creating and running your account

  • What: your email address, a salted hash of your password (never the password itself), the date you created the account, your acceptance of the Terms, and sign-in timestamps.
  • Why: to create the account, let you sign in on the web and in the Extension, send you the confirmation and password-reset emails, and answer you when you contact us about the account.
  • Legal basis: performance of a contract, Article 6(1)(b) — we cannot give you an account without it.

5.2 Sync

  • What: the watch list entries you sync — video id, title, channel name, playback position, duration, the times you added and last changed each entry, and a marker recording that you deleted an entry.
  • Why: to make the same watch list available on your other devices and to resolve conflicts between them. The deletion marker exists so that removing a video on one device also removes it on the others.
  • Legal basis: performance of a contract, Article 6(1)(b).

5.3 Subscription and payment

  • What: your Stripe customer and subscription identifiers, subscription status, whether it is set to cancel, and the current period end date, plus the invoices Stripe issues in our name.
  • Why: to take payment, to decide whether Sync is active on your account, and to keep the accounting records the law requires of us.
  • Legal basis: performance of a contract, Article 6(1)(b), for the subscription itself; compliance with a legal obligation, Article 6(1)(c), for invoices and tax records.
  • Card details never reach us. Payment pages are hosted by Stripe; your card number, expiry date and security code go straight to Stripe and are not stored on, or passed through, our systems.

5.4 The contact form and support email

  • What: the name, email address and message you type, plus your IP address and the signals Cloudflare Turnstile collects to tell a person from a bot.
  • Why: to read your message and reply to it, and to stop the form being used to send spam.
  • Legal basis: our legitimate interests, Article 6(1)(f) — being reachable by people who do not have an account, and protecting the form from automated abuse. You can object to this processing; see section 11.

5.5 Security and technical logs

  • What: server and platform logs containing your IP address, the time of the request, the page or endpoint reached, and general browser information.
  • Why: to keep the Service running, to investigate errors, and to detect and stop attacks such as credential stuffing or scraping.
  • Legal basis: our legitimate interests, Article 6(1)(f), in the security and integrity of the Service. We consider those interests not to be overridden by your own, because the data is limited, kept briefly, and never used to build a profile of you.

6. Do you have to give us this data?

Only if you want the parts of the Service that need it. An email address and password are a contractual requirement for having an account — without them we cannot create one, and Sync cannot work. The billing data in section 5.3 is required for a paid subscription. Everything else is optional: the Extension works without an account, and you never have to use the contact form. No law obliges you to provide any of it.

7. Who else processes your data

We do not sell personal data, rent it, or share it for anyone else’s marketing. We share it only with the service providers below, who process it on our documented instructions as processors under Article 28 of the GDPR, and only as far as each needs to do its job:

  • Supabase — authentication and database hosting; holds the data in sections 5.1, 5.2 and 5.3.
  • Stripe — payment processing, invoicing and fraud prevention. For its own payment and anti-fraud purposes Stripe is an independent controller, under its own privacy policy.
  • Vercel — hosting and delivery of this website; sees the request logs in section 5.5.
  • Cloudflare — the Turnstile anti-bot check, which sees your IP address and browser signals on the contact page only.
  • Resend — delivery of your contact form message to our inbox.
  • Our transactional email provider — delivery of account emails such as confirmation and password reset.

Inside our organisation, access is limited to the people who need it to run the Service. Our internal dashboard shows only the account list — email address, plan and subscription status. It gives no one access to anyone’s watch list.

We may also disclose data where the law requires it — a valid order from a court or other competent authority — or to establish, exercise or defend legal claims. If the business is ever merged or sold, your data may transfer with it, and we will tell you before it does.

8. Transfers outside the EEA

We choose EU hosting where a provider offers it. Some of the providers in section 7 are established in the United States or process data there. Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses under Article 46(2)(c) of the GDPR, together with the provider’s certification under the EU–US Data Privacy Framework where it holds one, and on the technical measures in section 10. Write to support@example.com for a copy of the safeguards that apply to a particular provider.

9. How long we keep it

  • Account data — for as long as your account exists. Deleting the account from Account → Settingserases it immediately; if you ask us by email instead, within 30 days.
  • Synced watch list — the same: deleted with the account. Individual entries you delete in the Extension stop being shown at once, but we keep a marker recording the deletion for as long as the account exists, so the deletion keeps propagating to your other devices. The marker holds the video id, not the title or channel.
  • Invoices and accounting records — 10 years, the period Portuguese tax law requires. These survive the deletion of your account, because we are obliged to keep them.
  • Contact form messages and support email — up to 24 months, so we still have the history if an issue comes back.
  • Technical logs — a short period set by our hosting providers, in no case more than 30 days.
  • Backups — deleted data can persist in encrypted backups for a short window afterwards. It is not restored into the live service, and it ages out with the backup.

10. How we protect it

All traffic between you, this website, the Extension’s sync endpoint and our providers runs over TLS. Passwords are stored only as salted hashes. Every row of account and watch list data is isolated per user by database row-level security, so one signed-in user cannot reach another user’s rows even if the application layer is wrong. Administrative access is limited, and the keys that could bypass those checks are held only by server-side functions — never by this website or the Extension. No system is perfectly secure, but these are the measures we consider appropriate under Article 32 of the GDPR for the data we hold.

If a breach ever occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the GDPR requires it.

11. Your rights

Under the GDPR you have the right to:

  1. Access the personal data we hold about you and get a copy of it (Article 15).
  2. Rectify data that is wrong or incomplete (Article 16).
  3. Erasure — delete your account yourself from Account → Settings, or ask us to (Article 17). We must still keep the records in section 9 that the law obliges us to keep.
  4. Restrict our processing while a dispute about it is resolved (Article 18).
  5. Portability — receive the data you gave us, including your synced watch list, in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible (Article 20). Account → Settings → Export my data gives you the whole file as JSON, at once and without asking us.
  6. Object at any time to the processing we base on legitimate interests — the contact form and security logging in sections 5.4 and 5.5 (Article 21).
  7. Withdraw consent wherever we rely on it, without affecting processing already carried out.

Export and erasure you can carry out yourself, right now, from your account settings. For anything else, write to support@example.com from the address on the account. We answer within 30 days; if a request is unusually complex we may extend that by up to two further months, and will tell you why within the first month. Exercising these rights is free, and we will not treat you differently for it.

If you think we have got it wrong, you can complain to the supervisory authority — in Portugal the Comissão Nacional de Proteção de Dados (CNPD) — or to the authority in the EU country where you live or work. We would rather you came to us first.

12. Cookies and local storage

This website sets only the cookies strictly necessary to operate it: the session cookies that keep you signed in, set by our authentication provider when you log in and cleared when you log out. They are not used for advertising, analytics or measurement. Under Article 5(3) of the ePrivacy Directive, strictly necessary cookies need no consent — which is why you see no cookie banner.

Two other things are stored on your device and are worth naming. The Extension uses Chrome’s extension storage for your watch list, your settings and, if you sign in, your session token; that storage is local to your browser. And on the contact page only, Cloudflare Turnstile may store a short-lived value in your browser to carry out its anti-bot check.

13. No advertising, profiling or automated decisions

We do not sell or transfer your data to data brokers, we run no advertising or analytics trackers, and we do not use your data to build a profile of you or for any purpose unrelated to the Service. Nothing we do involves automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the GDPR. Whether Sync is switched on for your account follows directly from your subscription status; there is no scoring or judgement about you in it.

14. Children

The Service is not directed at children. You must be at least 16, or the minimum age of digital consent in your country if that is lower, to create an account, and we do not knowingly collect data from anyone younger. If you believe a child has given us personal data, write to support@example.com and we will delete it.

15. Changes to this policy

We will post any new version on this page with a new “last updated” date. If a change materially affects how we use your data, we will email account holders at least 30 days before it takes effect, so you have time to object, export your data or close your account.