Tortma Privacy Policy
Effective date: June 26, 2026
Tortma ("we", "us", or "our") is a Chrome extension that helps you organize YouTube videos into playlists. This Privacy Policy explains what information we collect, how we use it, and your rights.
Information we collect
YouTube data
Tortma uses the YouTube Data API v3 and your Google account to:
- Read your YouTube channel profile (name, email address, profile picture).
- Read and manage your YouTube playlists (list, create, rename, delete, and add/remove videos).
- Read your liked videos when you use onboarding or playlist-suggestion features.
- Read your YouTube watch history only when you explicitly click "Suggest playlist from history".
We do not access your YouTube search history, comments, subscriptions, messages, or any data outside the scopes listed above.
Tortma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use YouTube data to provide the playlist organization features described in this policy and do not use it for advertising, sale, or any unrelated purpose.
Account and usage data
When you use Tortma, we store:
- Your Supabase user ID and email.
- A record of videos you drop into playlists ("drop logs") so we can enforce daily limits and sync your organization across devices.
- A cache of which videos are in which playlists.
- Telemetry events you trigger (for example, when you hit a usage limit).
Authentication tokens
Your Google access token and refresh token are stored locally in your browser using AES-GCM encryption. We never send your refresh token to our servers in plaintext. Access tokens are sent only to YouTube’s APIs when necessary.
How we use your information
- Organize videos: We send video titles, channel names, and descriptions to our AI service so it can suggest the best playlist.
- Sync across devices: We store drop logs and video-to-playlist mappings in Supabase so your organization state is available on any device where you sign in.
- Enforce limits: We count daily drops server-side to apply your tier limit.
- Process payments: If you upgrade, Polar.sh handles billing; we receive only your tier/license status, not payment details.
Data sharing
We do not sell your data. We share data only with the services required to run Tortma:
- Google / YouTube — for authentication and playlist management.
- Supabase — for authentication, database, and edge functions.
- Groq (via Supabase Edge Function) — for AI categorization of video metadata.
- Cloudflare — for the AI orchestration worker and checkout webhooks.
- Polar.sh — for subscription billing.
Each provider’s privacy policy applies to the data they process:
Data retention and deletion
- Drop logs and cached video mappings are retained while your account is active.
- You can request account deletion at any time from the extension settings. We will delete your profile and usage data from Supabase and revoke your Google tokens.
- You can also revoke Tortma’s access to your Google account at https://myaccount.google.com/permissions.
Security
- Google refresh tokens are encrypted locally before storage.
- Supabase uses Row Level Security (RLS) so you can only access your own data.
- All server communication uses HTTPS.
Changes to this policy
We may update this Privacy Policy. The latest version will always be available at the URL linked in the Chrome Web Store listing.
Contact
If you have questions about this Privacy Policy or your data, contact us through the support channel listed in the Chrome Web Store.