Privacy Policy

Last updated: August 31, 2026

What we collect

• Account. Your email address and sign-in credentials, held by Supabase (our database and authentication provider). If you sign in with Google, we receive your email address from Google, and Supabase holds the sign-in identity record.
• Your podcast. The RSS feed URLs you connect and the episode metadata they carry (titles, descriptions, artwork URLs, chapters). Episode audio is fetched from your feed's public enclosure URL.
• Pipeline artifacts. Transcripts, waveform data, and rendered videos, stored in Cloudflare R2 under keys scoped to your account.
• Billing. A minutes ledger with your credit balance history, recorded payment amounts, and Stripe transaction identifiers. Your card details never touch Treehop — they are entered only on Stripe's hosted pages.
• YouTube connection. Your channel id and channel title, the scopes you granted, the access token's expiry, and the OAuth tokens that let Treehop upload to your channel — plus, for each published episode, the video id, its upload time, and any error text a failed upload returned. The complete list is in the Google user data section below. Tokens are stored only encrypted (AES-256-GCM); they are decrypted only on the server, only to perform the uploads and checks you asked for.

Processors we use

• Supabase — database and authentication.
• Vercel — hosting for the Treehop app itself.
• Railway — hosting for the background worker and its job queue, which is what performs your uploads.
• Cloudflare — DNS for our domains, plus the R2 storage above and the hosting of this marketing site.
• Cloudflare R2 — storage for audio, transcripts, waveforms, and rendered videos.
• AWS (us-east-1) — video rendering compute.
• Deepgram — transcription. Deepgram fetches your episode audio directly from your feed's public enclosure URL.
• Stripe — payments. Card data is entered only on Stripe's hosted pages and never touches Treehop.
• Google / YouTube — optional Google sign-in, and video uploads to the channel you connect.

We do not sell your data. No third party other than the processors named above receives it, except in the three narrow circumstances described under "Who we share Google user data with".

Google user data

Treehop uses YouTube API Services. When you connect a channel, Treehop calls the YouTube Data API on your behalf, under the permissions you grant. Your use of those features is also governed by the YouTube Terms of Service, and Google's own handling of your information is governed by the Google Privacy Policy.

Google data is covered here and in the section that follows it: what Treehop receives, what it keeps, what each permission is used for, who else holds it, how long we hold it, and what disconnecting does.

If you sign in with Google, Treehop receives your email address and a marker recording that the sign-in came from Google. The app uses the email address to identify your account and to show you which account you are signed in as. Supabase, our authentication provider, holds the sign-in identity record itself.

When you connect a YouTube channel, Treehop keeps exactly this from Google and nothing more:

• An access token, a refresh token, the moment that access token expires, and the list of scopes you granted.
• Your channel's id and your channel's title. We ask Google for the channel's snippet, so Google's reply also contains fields such as your channel description and your avatar image URLs; those exist only inside that one reply, in our server's memory, are never written to our database, and are gone when the request ends. We never ask for and never keep subscriber numbers, your video list, or contact details.
• For each video Treehop publishes for you: the video id Google assigns it, and that video's processing status. The video id also appears inside the billing ledger entry for that episode.
• If an upload fails, the error text Google's API returned. That text is recorded against the failed job and shown to you on your dashboard, so a failure is not a mystery.

When you connect a YouTube channel, Treehop requests exactly two OAuth scopes:

• https://www.googleapis.com/auth/youtube.upload — used to upload your episodes' finished videos to your channel.
• https://www.googleapis.com/auth/youtube.readonly — used to identify the channel you chose and to confirm that an uploaded video finished processing.

That is all the scopes are used for. Treehop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Videos Treehop uploads are created private on your channel. You decide when to publish them.

You can disconnect your YouTube channel at any time with one click from the dashboard; disconnecting deletes the stored connection, including the encrypted tokens.

Two honest notes about disconnecting. First, it deletes Treehop's copy of your tokens — it does not withdraw the permission at Google's end. To remove Treehop's access from Google itself, use the permissions page of your Google Account, at myaccount.google.com/permissions or the Google security settings page at security.google.com/settings/security/permissions. Second, episodes you have already published keep their video id and upload time on the episode record, so the link to your published video and its billing entry stay accurate.

If Google stops accepting a stored token — because the permission was removed, or because it expired — Treehop parks the connection, stops calling Google for your account, and asks you to reconnect. Parking on that answer deletes both stored tokens at that moment: the encrypted access token and the encrypted refresh token are blanked in the same write that parks the connection. Only your channel id and channel title are kept, so the reconnect prompt can name the channel; while a connection is working we refresh them from YouTube at least every 30 days, and once a connection stops working they are removed within 30 days — reconnecting restores them. Reconnecting writes fresh tokens and clears the parked marker together.

One honest exception, so this is not read as more than it is. A connection is also parked if our own server cannot decrypt what it stored — a key problem on our side, not an answer from Google. In that case the connection is parked and unusable in exactly the same way, but the stored ciphertext is left in place rather than blanked, because destroying it would turn a recoverable mistake of ours into a permanent loss of your connection. Nothing reads it while the connection is parked, and reconnecting or pressing Disconnect replaces or deletes it.

How long we keep Google user data. We keep it only while your YouTube connection exists or your account is open. Disconnecting deletes the stored tokens, channel id and channel title immediately. When you ask us to delete your account, the Google user data held for it — the channel id and title, the granted scopes, the stored video ids and upload times, and any Google API error text — is deleted within 30 days of the request.

Who we share Google user data with

In the ordinary running of the service, Google user data is disclosed to the infrastructure providers that run Treehop and to no one else. In full, those providers are:

• Google / YouTube — both the source and the destination. Tokens go back to Google to refresh them, to upload your video, and to check that the upload finished.
• Supabase — our database and authentication provider. Supabase stores your encrypted YouTube tokens, your channel id and channel title, the list of scopes you granted, the token expiry and reconnect timestamps, the video id and upload time of each published episode, and any error text a failed upload recorded. If you sign in with Google, Supabase also holds that sign-in identity record.
• Vercel — our application host. The connect flow runs there, so the authorization code Google returns and your tokens pass through Vercel's compute at the moment you connect.
• Railway — the host of our background worker and its job queue. The worker is what decrypts your tokens, in memory only, to refresh them and to upload and confirm your videos. Its log output records video ids and any error text Google returned.
• Cloudflare — DNS for our domains. Where Cloudflare's proxy is enabled on a record, it also relays that traffic in transit. It stores none of this data.

That list is complete for the ordinary running of the service; the three narrow exceptions are named just below. Our other processors receive no Google user data at all: Cloudflare R2 holds only your audio, transcripts, waveforms, cached chapter data, and rendered videos; Deepgram receives your episode's public audio URL and fetches the audio from it directly; Stripe receives only a price identifier and your Treehop account id. AWS receives the render inputs — your show and episode titles, publication date, transcript words, waveform, chapters, your show's artwork URL, your accent colour, and a six-hour signed link to your audio — and, because the renderer runs there, AWS also writes the finished video to its own staging bucket, which we delete once the copy into our own storage is verified. None of that is Google user data.

Treehop does not sell Google user data, does not use it for advertising, does not use it to train any AI or machine-learning model, and does not use it for any purpose beyond delivering the uploads and checks you asked for. The app carries no analytics, tracking, or error-reporting service of any kind — there is nothing in it to send your data anywhere else.

Beyond the providers above, there are exactly three circumstances in which Google user data could be disclosed, and no others:

• To comply with applicable law. If a law, regulation, subpoena, court order, or other valid legal process requires us to disclose Google user data, we may do so. Where we are permitted to tell you, we will.
• For safety and security. Where disclosure is necessary to investigate suspected abuse, fraud, or a security incident, or to protect the rights, property, or safety of our users, of Treehop, or of the public.
• Business transfer. If Treehop is merged or acquired, or its assets are sold, Google user data may transfer to the acquiring entity. We will give you notice before that happens and before your Google user data becomes subject to a different privacy policy, and the acquirer remains bound by the Limited Use requirements.

Treehop is operated by Ribbitech. No other affiliate, subsidiary, or related company receives Google user data. We disclose it to no advertisers, no data brokers, and no credit-reporting agencies, and we do not sell or rent it.

How we protect your data

These are the protections that actually exist in the product, named plainly. What is missing is listed directly underneath them.

• In transit. Every connection Treehop makes to Google, Supabase, Vercel, Railway, Deepgram, Cloudflare R2, Stripe, and AWS is HTTPS, and the Treehop app and this site are served over HTTPS only.
• Your YouTube tokens, at rest. Both tokens are written to the database only as AES-256-GCM ciphertext, with a fresh random 12-byte initialization vector for every encryption and a 16-byte authentication tag. A plaintext token is never written to any column.
• The key that encrypts them. Every encryption written since our August 2026 hardening uses a 32-byte subkey derived from a server-only master key with HKDF-SHA256, under a label used for nothing else — not the master key itself — and the anti-forgery signature on the connect flow uses a second, different subkey. If ciphertext fails its authentication check, decryption fails with a generic error that reveals nothing, and the connection is parked for reconnect.
• Database access control. Row-level security is on for all seven product tables, under 22 policies that are every one of them scoped to the owning account and granted only to signed-in sessions. No policy grants the anonymous or public role, so a request with no valid session reads zero rows — including from the table holding the encrypted tokens. We have a script that checks this against the live database; we run it by hand rather than continuously.
• A server-only boundary. The code that decrypts tokens cannot reach your browser. A test walks every source file and goes red if any browser-side module imports the encryption, YouTube, worker, admin, storage, queue, or payment code. The only two configuration values shipped to the browser are our Supabase URL and its public key, and that list is pinned by a test as well. Your own data is of course sent to your own dashboard — your channel name, your episode titles, your video links, and any error text — over your signed-in session. Nothing runs those tests automatically; we run them by hand, like the database check above.
• Stored files. Every object in Cloudflare R2 is written and read through authenticated, signed requests, under a key that begins with your account id. No object is given a public URL. The one exception is a temporary signed link to your episode audio, valid for six hours, handed to the renderer so it can read the audio.
• URLs you give us. Before fetching a feed or an episode enclosure, Treehop resolves the address and refuses private, loopback, and internal cloud addresses, then re-checks every redirect hop — so a feed cannot aim our servers at something private.
• Internal access. Our internal operations view requires both an email address on a short allowlist and a Google sign-in, so it is reachable only by signing in to that Google account and inherits whatever protections — two-step verification included — that account itself carries. A password session with an allowlisted address is refused. The view is read-only apart from one action that re-runs a stuck pipeline stage, its queries exclude the two encrypted token columns entirely, and a test fails if those column names appear anywhere in the internal data-access module.
• What a person here may read, and why. Treehop has no anonymised internal view, so an operator with internal access can see every account's email address, every connected YouTube channel's name, every published video id, and the error text recorded against any failed job. Where any of that is information received from Google APIs, a person here reads it only on the grounds Google's Limited Use requirements permit: with your explicit consent; where it is necessary for security purposes, such as investigating a bug or abuse; where it is necessary to comply with applicable law; or where the data has been aggregated and de-identified for internal operations. Never to browse it, and never for any other reason.

What we do not have yet

Stated so you are not left to assume otherwise. Only the YouTube tokens are encrypted by Treehop itself; everything else — feed metadata, transcripts, waveforms, rendered videos, billing records, channel names, email addresses — is stored as ordinary data with the providers named above, and whatever disk encryption those providers apply is theirs rather than something we built. The master key is an environment variable on our hosts: there is no hardware key store, no managed key service, and no rotation schedule. TLS for our own pages comes from our hosts, not from our code. Podcast feeds are fetched over whatever address the feed publishes, so a feed served over plain http is fetched over plain http. We do not require multi-factor sign-in on creator accounts; we run no rate limiting, no intrusion detection and no security monitoring; and we do not currently keep a log of internal reads. Treehop holds no security certification, has had no penetration test, and runs no bug bounty. Nothing expires or is deleted on a schedule: audio, transcripts, waveforms, and rendered videos stay in storage until a deletion request is handled by a human.

Cookies

This marketing site sets no cookies and loads no third-party resources. The Treehop app uses session cookies to keep you signed in, plus one short-lived cookie during the YouTube connect flow to protect against cross-site request forgery. There are no advertising or tracking cookies anywhere.

No analytics

Neither this site nor the Treehop app contains analytics or tracking of any kind.

One note of transparency: our hosting provider, Cloudflare, serves every page of this site and may run its own network-edge bot protection as part of that service. It operates at the serving layer rather than in our pages' code, reports nothing about your visit to us, and shares nothing with anyone else.

Data deletion

• YouTube connection: the Disconnect button deletes the stored connection immediately.
• Feeds: removing a feed stops all processing for it and hides it from your dashboard. Your billing history is preserved, as required for accurate accounting.
• Account and data: to delete your account and its data, reach us via the contact page. Self-serve account deletion does not exist yet — we say so here honestly rather than pretend otherwise — and deletion requests are handled by a human.

Changes

This policy may be updated; material changes will be reflected on this page with a new "last updated" date.

Your rights

Whatever your location, you can ask us for the following, and we will act on the request within 30 days:

• Access. A copy of the personal data we hold about your account, including the Google user data listed above.
• Correction. Correction of anything inaccurate. Your channel id and title come from Google and are corrected by reconnecting the channel.
• Export. Your data in a portable, machine-readable form.
• Deletion. Deletion of your account and its data, as described under "Data deletion" above. Disconnecting your YouTube channel deletes the stored connection immediately and needs no request.
• Objection and restriction. You can object to, or ask us to restrict, a particular use of your data. In practice Treehop uses your data only to run the service you asked for, so the usual answer is to stop processing a feed, disconnect the channel, or delete the account.
• Complaint. If you are unhappy with how we handled a request, you can complain to your local data protection or privacy supervisory authority. We would rather you told us first, but you do not have to.

Use the contact page for any of these, with the subject line it gives for privacy requests, and include the account email the request concerns so we can be sure we are answering the right person.

Where your data is processed

Treehop is run from the United States, and every processor named above processes data there — the render compute runs in AWS's us-east-1 region specifically. If you use Treehop from outside the United States, your data is transferred to and processed in the United States, whose privacy laws differ from those where you live.

Contact

Treehop is operated by Ribbitech, which is the controller responsible for the personal data described in this policy. Privacy questions, and any of the requests above: reach us via the contact page.