ACAutomation CenterAPI disclosure

YouTube API Services disclosure

How Automation Center uses YouTube

The YouTube integration is used only for channels explicitly connected by their owner inside a private operator-controlled application.

OAuth scope

youtube.upload

Performs videos.insert to upload the operator-approved MP4, title, description and privacy setting to the explicitly selected channel.

OAuth scope

youtube.readonly

Performs channels.list with mine=true after OAuth to display the exact destination channel, and videos.list for status and statistics of videos handled by Automation Center.

OAuth scope

yt-analytics.readonly

Reads watch time, average view duration, average percentage viewed, shares and subscriber change for the operator's own published videos.

Complete operator flow

  1. The operator selects a brand and starts Google OAuth in a standard external browser.
  2. After consent, Automation Center displays the exact YouTube handle and channel name.
  3. The operator creates or reviews a vertical video and its platform-specific description.
  4. The operator chooses immediate publication or a schedule. Automatic publication is enabled only by an explicit operator setting.
  5. The application reads video-level performance for private reporting and creative format comparison.
  6. The operator can revoke the connection or permanently delete API-derived data.

Why these are the minimum relevant scopes

youtube.upload

This is required for the user-facing Publish to YouTube action. Read-only scopes cannot call videos.insert or transfer the selected video file. Automation Center does not request broader YouTube account-management permission.

youtube.readonly

This is required to call channels.list?mine=true and display the exact channel name and handle immediately after connection, preventing publication to the wrong owned brand. It is also required for videos.list to show the publication status and base statistics of the application's own uploaded video. The upload scope alone does not grant these read operations.

yt-analytics.readonly

This narrower analytics-only scope supplies retention and watch-time reports that are not returned by the YouTube Data API. The reports are used only for the operator's private performance screen.

These permissions support one active workflow: connect and confirm the destination channel, publish an approved video, then monitor that publication. No requested scope is reserved for an unrelated or future feature.

What the verification demonstration shows

  1. The complete Google OAuth consent flow and the requested permissions.
  2. The channel name and handle returned to the Connections screen after authorization.
  3. A reviewed local video, its YouTube metadata and the operator pressing Publish.
  4. The successful upload result and the same video in the selected YouTube channel.
  5. The publication status and private performance area, followed by revocation and deletion controls.

Data accessed and data not accessed

Accessed

  • Channel identifier, handle and display name
  • OAuth grants and encrypted tokens
  • Identifiers of videos handled by the application
  • Views, engagement, watch time and retention

Not accessed

  • Private messages or contacts
  • Viewer identities or viewer profiles
  • Unrelated channel content libraries
  • Passwords or Google account credentials

Storage, sharing and security

Google API traffic is protected by HTTPS/TLS. Tokens are encrypted at rest with AES-256-GCM using a fresh random nonce and authentication tag for every value. The 256-bit key is stored separately in server-side environment configuration, not in the database, source code or browser. Token exchange, refresh and API calls are server-side, and tokens are never displayed after connection.

The operational panel and database run in the operator-controlled local installation. This public information website cannot access OAuth tokens or private analytics. API data is not sold, licensed, used for advertising, or shared with data brokers.

Automatic metric collection uses decreasing frequency and stops 30 days after publication. Public performance statistics and independently generated creative scores may be retained for private historical comparison subject to YouTube API Services policies. The operator can delete the stored copy at any time.

User controls and policy links

Access can be revoked in Automation Center or through Google Account permissions. Permanent local deletion is described in the data deletion instructions.

Use of YouTube information is also governed by the YouTube Terms of Service, Google Privacy Policy, and applicable YouTube API Services policies.

Questions about this integration: kontakt@tarovia.pl