ReplayBox Privacy Policy

Effective date: 29 October 2026. Last updated: 1 November 2026.

This ReplayBox Privacy Policy explains how ReplayBox accesses, collects, uses, stores, protects, shares and deletes information when you connect a Google Account and use our YouTube upload feature. It also explains the related account, device and service information involved in that feature. This page is public and can be read without an account or sign-in.

1. Who we are and what ReplayBox does

ReplayBox is a gameplay recording, replay-buffer, MP4 editing and screenshot application with an optional website library for sharing recordings. The service is operated by individual entrepreneur Pavel Nikolaevich Strukov, Moscow, Russian Federation. Our operator details identify the legal operator. For privacy questions and deletion requests, contact support@replaybox.ru.

ReplayBox uses YouTube API Services to upload a video you select from your ReplayBox library to your own connected YouTube channel and show you the resulting YouTube link. Connecting Google is optional. Local recording and editing do not require Google access, and connecting a channel does not start an upload.

By using the YouTube upload feature, you agree to the YouTube Terms of Service. Google's processing of information is also governed by the Google Privacy Policy. This page describes ReplayBox's handling of the information; it does not replace Google's policies.

2. Information we access and collect

• Google authorization information: a single-use OAuth authorization code, granted permissions, a temporary access token and a refresh token. These let the ReplayBox backend authenticate requests you authorize. You enter your Google password on Google's own pages; ReplayBox does not receive or store that password.
• YouTube channel information: the authenticated channel's identifier and title. We request the channel snippet from YouTube, process the response in memory and save the channel ID and title to identify the upload destination. We do not save a complete copy of the channel response or use other snippet fields for profiling.
• Upload and result information: the selected channel, transfer progress, upload status, YouTube video ID, resulting link and visibility reported by YouTube. A resumable upload-session address is temporarily retained so an interrupted transfer can continue safely.
• Content and settings you provide: the selected MP4 already stored in your ReplayBox library, its name, size and file identity, and the title, description, visibility and audience setting you choose for the upload.
• Related ReplayBox account information: your ReplayBox account ID, nickname, email, password hash, account/session status and paid-plan or trial entitlement. These identify the owner, authenticate the action and enforce access and upload limits. Your Google connection is linked to your ReplayBox account.
• Technical and security information: network and request information such as IP address, browser information, request time, security counters and error codes, as needed to deliver the service, prevent abuse and investigate failures. Google authorization codes, tokens and upload-session addresses are not intentionally included in ordinary application or access logs.

The YouTube integration does not request Gmail, Google Drive or contacts access. It does not retrieve your subscriptions, playlists or viewing history, and it does not edit or delete existing YouTube videos. General ReplayBox account, payment, support and media-library processing is further described in the general ReplayBox Privacy Policy and personal-data policy.

3. Permissions and why each is needed

• youtube.upload — https://www.googleapis.com/auth/youtube.upload. We use this permission to send the specific video you approve, with your chosen publication settings, to your connected channel and obtain its YouTube link.
• youtube.readonly — https://www.googleapis.com/auth/youtube.readonly. We use a channel lookup with channels.list(part=snippet, mine=true) to identify and verify the authenticated channel before uploading and to revalidate an existing connection. This read access is needed in addition to upload permission to check the destination without requesting broader account-management permissions.

Although these permissions can allow more operations at the API level, ReplayBox uses them only for the channel verification and user-approved upload functions described here. We do not use the connection as permission to perform unrelated actions.

4. How we use the information and your control

We use Google and YouTube information to connect and display your channel, verify that an upload still targets that channel, transfer the selected video, show progress and the resulting link, resume an interrupted transfer, and revoke access or delete connection data. We do not automatically publish videos merely because a Google Account is connected.

Before each upload, ReplayBox shows the channel, source file and publication settings. You separately approve that upload on the ReplayBox website or in the desktop application and accept the YouTube terms. The website and desktop application use your active ReplayBox session without asking for your ReplayBox password again. Connecting or disconnecting a channel on the website also uses your active browser session. Google completes authorization on its own pages. Google tokens stay on the server. A changed file or changed settings require a new draft and approval.

You can stop a pending or running transfer from the website. A video that YouTube has already accepted may remain on your channel; you control that copy in YouTube Studio. YouTube may apply processing or visibility restrictions of its own.

5. Sharing, recipients and processing locations

• Google and YouTube: our backend sends the authorization information needed to obtain, refresh or revoke access. After your approval, Google receives the selected MP4 and your chosen video metadata and settings. The video's audience depends on its YouTube visibility setting and YouTube's rules.
• Infrastructure providers: ReplayBox uses application hosting, a database and private object storage, including services supplied by Timeweb Cloud. These systems process the information needed to operate your connection and transfer. ReplayBox application instances operate in Russia and the Netherlands, so service requests may be processed across national borders.
• Authorized operational access: access to Google user data by people is limited to the specific data you agree to have reviewed for support, necessary security investigations or compliance with applicable law. Infrastructure access is limited to operating and securing the service.
• Legal disclosure: we may disclose information when required by applicable law or when necessary to protect the service and users from abuse, consistent with Google's data-use restrictions.

Other ReplayBox functions may use service-email, form-protection and optional analytics providers, as described in our general policies. They are not recipients of Google OAuth tokens or YouTube connection records for advertising or profiling. We do not sell Google user data or disclose it to data brokers or information resellers.

6. Google user data and Limited Use

ReplayBox complies with the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google user data.

Google user data is used for the user-facing connection and upload features described in this policy and their necessary security operations. It is not used for advertising, retargeting, creditworthiness decisions, lending, surveillance, or training or improving general-purpose AI or machine-learning models. ReplayBox does not provide AI image or video generation. A disclosure in this policy does not authorize an unrelated use of Google data.

7. Cookies, analytics and third-party pages

When you manually change the website language, ReplayBox stores replaybox_language=ru or replaybox_language=en in a cookie for 6 calendar months. Automatic language selection uses an offline IP-to-country database, then the browser language if the country is unknown; it does not set the language cookie or send the IP address to a third-party geolocation service. ReplayBox does not request your device's precise location. You can change this preference with the language switcher or delete the cookie in your browser.

ReplayBox uses necessary cookies or session credentials to keep you signed in and remember your cookie choices. Optional Yandex Metrica analytics and session replay on other website pages require your separate analytics consent. You can manage that choice through the website's cookie settings; browser controls can also block or delete cookies. See our Cookie Policy.

ReplayBox disables analytics tracking on the YouTube workspace, its in-account privacy page and the public information pages used for Google verification. It stops an active analytics counter before navigation into those pages and masks the YouTube workspace from session replay. Google API response data is not supplied as analytics event parameters.

The ReplayBox YouTube integration does not serve advertising. When you continue to Google's authorization pages or open a link on YouTube, those services may use their own cookies and process device or connection information under the Google Privacy Policy. A ReplayBox video preview uses the source file in our private storage rather than an embedded YouTube player.

8. Storage and security

Google authorization and upload requests are made by the ReplayBox backend. Network transfers use HTTPS or TLS. Refresh tokens and resumable upload-session addresses are encrypted on the server with a key stored separately from the database. Temporary access tokens are used in server memory rather than deliberately persisted in the database. Google tokens and the OAuth client secret are not sent to the desktop application or browser JavaScript.

Source videos are held in private storage. Access is checked against the owning ReplayBox account; browser playback uses time-limited links. Channel connections require an active browser session and Google authorization. Upload approval requires an active ReplayBox session and consent to unchanged publication details. Website actions also require a verified same-site request. Source-file verification, rate limits and server-side plan checks provide additional protection. These measures reduce risk but cannot guarantee that any online service is completely secure.

9. Retention periods

• Connection and refresh token: retained while the channel is connected and authorization remains valid. We check authorization and refresh channel information daily, retrying temporary failures. If there has been no successful refresh for 30 days, the connection and its related Google data are deleted and a new connection is required.
• Upload history: each job's metadata, result and YouTube link are retained for 30 days from creation. Older entries are hidden from the account/API and removed by cleanup. Save any links you want to keep.
• Temporary authorization records: connection requests expire after 10 minutes; expired state and verification records are removed by cleanup. Upload-session addresses are cleared on completion, cancellation or a final failure.
• After disconnection: the token, channel data and associated upload history are removed after successful revocation, and no later than 7 days after disconnection even if Google's revocation service is temporarily unavailable.
• Local quota accounting: a separate counter stores only the ReplayBox account ID, calendar month and number of approvals for the current and previous UTC months. It contains no Google token, channel ID, YouTube video ID or YouTube link, and is independent of deleted upload history.

The original recording in your ReplayBox library follows your plan's media-retention terms and the general privacy policy. Removing YouTube connection data or upload history does not itself remove that source recording or a video already uploaded to YouTube.

10. Disconnect, revoke permission and delete data

In ReplayBox: open your YouTube connection settings and choose Disconnect YouTube. This immediately blocks further use of that connection and cancels the remaining transfer. ReplayBox requests revocation from Google and retries temporary failures. The 7-day deletion deadline above still applies.

In Google: you can independently remove ReplayBox's access through Google Account third-party connections or Google security permissions. We detect revoked authorization at a subsequent check and delete the associated connection data. During a Google outage, the 30-day limit without a successful refresh still applies; you can also request deletion directly from us.

By contacting us: email support@replaybox.ru or use ReplayBox support. Identify your ReplayBox account and ask for deletion of your Google/YouTube connection data. Do not send passwords or tokens. We may verify account ownership to prevent someone else from deleting your data. Requests are handled as soon as possible and within 7 days. You can also ask questions about access, correction or the information we hold.

To remove a published YouTube video, use YouTube Studio. Deleting ReplayBox's copy of connection data does not erase information that Google independently processes under its own policies.

11. Changes and contact

The current version is always available at https://replaybox.net/legal/youtube. If we introduce a new use of Google user data or request additional data, we will update the policy and provide notice and obtain the necessary consent before that new processing begins.

For questions, complaints or deletion requests, contact the ReplayBox operator at support@replaybox.ru. Related documents: general Privacy Policy, personal-data policy, Cookie Policy and User Agreement. The general legal documents are available in Russian and English; downloadable original PDFs are in Russian.