SIGPwny Zoom-to-YouTube Uploader — Privacy Policy Effective date: October 27, 2026 1. Operator and scope SIGPwny ("we", "us") operates the Zoom-to-YouTube Uploader at https://zoom-upload.api.sigpwny.com. Contact hello@sigpwny.com for support, privacy questions, complaints, or data deletion requests. This policy covers this uploader and its public information pages, not unrelated SIGPwny services. The canonical policy is https://api.sigpwny.com/privacy. The uploader lets authorized SIGPwny editors submit a shared Zoom cloud recording for transfer to the configured SIGPwny YouTube channel as a private video. A channel administrator reviews, edits, and publishes it separately in YouTube Studio. The service uses YouTube API Services. We do not receive your Google, YouTube, Zoom, or GitHub password. 2. Information we access and collect Google and YouTube authorization: When a channel manager connects YouTube, Google supplies OAuth access and refresh tokens, granted permissions, and token expiry information. We access the authorized channel's ID, channel information, and upload eligibility to check that it is the configured destination. For videos created by the service, we obtain their video IDs, upload/processing status, visibility, and any rejection or processing-failure reasons. We request youtube.upload to upload new videos and youtube.readonly to verify the channel and check processing. The read permission can technically read other channel information, including private video metadata; our workflow uses it for the destination and submitted uploads, not to browse a channel's video library. We do not request video-deletion or existing-video-editing permissions, download YouTube videos, or upload captions. Recordings and submissions: We process the Zoom share URL you submit, optional title and description, selected recording layout, recording title, duration, file size, temporary media URLs and cookies needed to retrieve the recording, and its audio/video content. Audio/video may include participants' names, voices, faces, presentations, chats, or other information visible in the recording. We do not separately download or upload transcript/caption files. A transcript link, if present in Zoom's recording metadata, may be included in temporary job state. Job information: We store an upload-job identifier, encrypted source and submission metadata, resumable upload-session information, byte progress, YouTube video ID, timestamps, retry information, and sanitized error codes. We do not store a permanent copy of the video file on our uploader servers. Authentication and technical information: Cloudflare Access and the configured identity provider handle editor login and access policies. Cloudflare can process login identity (such as email or account identifiers), IP addresses, browser information, timestamps, and request/security events. The uploader validates Cloudflare's signed assertion; it does not maintain a separate editor profile database. Requests to the public information pages also pass through Cloudflare. If you contact us, we receive your message and contact information. 3. Purposes and shared channel access We use this information only to authenticate editors, verify channel access, transfer the recording selected by an editor, resume interrupted transfers, report upload/processing results, prevent duplicate submissions and abuse, protect the service, and respond to support or deletion requests. Connecting the channel authorizes the uploader to perform these actions for SIGPwny's authorized editors, who act as the channel manager's approved agents within this service. They can initiate uploads and see submitted job information and results. Channel managers should connect the channel only if they approve this shared-editor workflow. Cloudflare login alone does not confer YouTube Studio editing or publication permissions. We do not sell personal information; use Google user data for advertising, profiling, credit or eligibility decisions; or train generalized AI models with it. We do not use recordings for purposes unrelated to the requested transfer. Human access is limited to authorized editors carrying out the workflow and operators as needed for expressly authorized support, security investigation, or legal obligations. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy 4. Recipients and third-party services Zoom supplies the recording under the sharing settings selected by its host. Cloudflare provides the production compute, queues, database, network, and access-control infrastructure. Google/YouTube receives the video and submitted metadata to create and process the private upload. SIGPwny's authorized editors and channel managers receive the result. We may disclose information when required by applicable law or necessary to address abuse or protect rights, consistent with the restrictions on Google user data described above. A private video is still stored and processed by YouTube and accessible as permitted by YouTube and the channel's permissions. A channel manager can later change its visibility. Publishing a video or a URL in the website CMS is a separate action. Our deletion of an uploader record does not remove copies held by Zoom, YouTube, the website, or someone who already received the content. Provider policies apply to their own processing: Google Privacy Policy: https://policies.google.com/privacy YouTube Terms of Service: https://www.youtube.com/t/terms Zoom Privacy Statement: https://www.zoom.com/en/trust/privacy/privacy-statement/ Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/ GitHub Privacy Statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement 5. Cookies, browser storage, and external content Cloudflare Access and the identity provider use authentication/session cookies. The uploader uses a short-lived, secure, HTTP-only OAuth state cookie to bind an authorization callback to the browser that initiated it. Its lifetime is 10 minutes; it is cleared after successful authorization. We do not set advertising cookies or add advertising or analytics scripts to the uploader or these information pages. Opening Google authorization or YouTube Studio sends your browser to those services, which apply their own cookie and privacy policies. If a CMS client shows a YouTube thumbnail or public metadata preview, requests to YouTube or Google may disclose your IP address and browser/request information to them. The uploader's own page does not embed a video player. The website CMS may separately store its own editing state; that is not an uploader database copy. 6. Storage, retention, and security Production uses Cloudflare's infrastructure. Processing may take place in the United States or other countries where our providers operate. We use HTTPS, server-side access checks, and application-level encryption for OAuth grants, OAuth state, and sensitive job state. Cloudflare stores deployment secrets separately from the public site. No system can guarantee absolute security. Video bytes are streamed through temporary runtime buffers to YouTube rather than saved as a permanent local media file. Job records, including stored YouTube data and source-access information, expire seven days after creation and are removed by the next scheduled cleanup (normally hourly). This includes failed and incomplete jobs; old job links and duplicate detection then expire. YouTube status responses are fetched on demand rather than kept as a separate long-lived status cache. OAuth states expire after 10 minutes and are removed on consumption or by scheduled cleanup. We retain the channel's encrypted OAuth grant while connected, to permit background uploads without repeated sign-in. Scheduled maintenance checks whether the grant can still obtain an access token. When Google definitively rejects a refresh grant, the stored grant is removed; transient network errors do not cause deletion. To request earlier removal of the grant or job data, use the process below. Infrastructure security logs and provider-managed recovery copies are subject to the relevant provider's configured retention, rather than the live database cleanup alone. They are not used as an active upload history. If data is restored for disaster recovery, deletion requests and retention limits must be reapplied before the service resumes. We retain support correspondence only as needed to resolve the request, document its handling, or meet legal obligations. 7. Your choices, revocation, and deletion You may decline Google authorization or stop using the uploader. A Zoom host can revoke or restrict a share link, which can interrupt an unfinished transfer but does not remove an already uploaded YouTube video. To revoke the application's access through Google, visit: https://security.google.com/settings/security/permissions Select the application's connection and remove its access. This stops future authorized use once existing credentials are rejected or expire. You can also ask SIGPwny to disconnect the shared channel and remove its stored authorization. For deletion, access, correction, or other privacy requests, email hello@sigpwny.com with the subject "Zoom uploader privacy request". Include the job ID, video URL, or channel identifier needed to locate the record. Do not send passwords, OAuth tokens, or recording passcodes. We may reasonably verify your identity or authority, especially for a shared channel, and will explain any information needed. We will delete the requested stored YouTube API data as soon as possible and within seven calendar days of a valid deletion request. Revoked authorization data is removed through the checks and retention process above, within the applicable YouTube retention requirements. Deleting service data does not delete videos from YouTube or recordings from Zoom. A channel manager must use YouTube Studio to edit or delete a YouTube video. The Zoom host controls the original recording. Copies of links saved in the website/CMS must be changed there separately. Applicable law may give you additional rights to access, correct, delete, restrict or object to processing, withdraw consent, or complain to a competent supervisory authority; contact us to exercise them. We do not discriminate for making a privacy request. 8. Participants, children, and changes Uploaders must have permission to transfer the recording, respect participants' privacy, and obtain any legally required recording/publication consent. This service is intended for authorized SIGPwny editors, not children under 13. We do not knowingly solicit personal information from children under 13. Contact us if you believe such information was submitted without appropriate authority. We will publish policy changes here with a revised effective date. Material changes to data use require notice and renewed consent before that new use. Questions or complaints: hello@sigpwny.com.