Your data / Clear boundaries

Privacy policy

How the privately operated E1 / M1 Media Automation tools access, use, store and share information.

Updated October 30, 2026. The operator is the private owner of E1 / M1 Media Automation. The application name is not a claim of a separately incorporated business. Questions and requests: pvelifer@gmail.com.

Website visitors and support email

This public website is static. It has no account registration, Google login, OAuth callback, forms, embedded videos, advertising or analytics scripts, and sets no application cookies. Vercel hosts these pages and may process connection and request information, including IP address and browser information, to deliver and protect the site. See Vercel's privacy policy. External links take you to the named provider; opening an email link uses your email application. Support email sent to our Gmail address is processed by Google and includes the address, message and attachments you choose to send. No fixed deletion period for support correspondence has been established.

Information used by the private tools

E1 and M1 use YouTube API Services for the operator's authorized channels. They are not an open public service. The following information may be handled according to the workflow and permissions in use:

• YouTube channel and video information: channel and video IDs, titles, descriptions, publication and visibility information, duration, thumbnails, playlists, public counts and API retrieval metadata.
• Comments: comment and reply text, identifiers, timestamps, thread relationships, and author/channel identifiers used to distinguish viewer and channel replies. Some processing paths keep only hashes and review status; the strategist can retain comment text without author names or author IDs. This does not make that text anonymous.
• Authorized Analytics: returned channel/video performance reports, including views, watch time, average viewing duration, retention, traffic sources, subscriber changes, likes and comment counts where available. These are channel reports, not a list of individual viewers' private viewing histories.
• Drive and source media: selected folder/file IDs, names, MIME types, sizes, modification times, checksums, parent relationships, links and available media metadata; downloaded source audio/video; source and rights evidence; transcripts, word timings, captions, frames, rendered videos and thumbnails.
• Operational records: workflow state, model prompts/results in retained evidence, QC results, hashes, original thumbnail copies, application receipts, API errors, approval records and diagnostic logs. Private approval infrastructure stores passkey public-key and verification records; it does not receive Face ID images or the device's private passkey.

Purpose, permissions and actions

E1 uses source evidence to transcribe, assess, edit and validate videos and prepare review packages. M1 uses channel data to produce private reports, track comments, prepare recommendations, and create and compare thumbnail concepts. Read-only M1 access uses YouTube read and Analytics read permissions. E1's configured integrations use Drive read/file permissions and separate YouTube read/upload permissions. Scope capability is not blanket authority to publish.

Authorized delivery paths can upload files to Google Drive and private review videos to YouTube. Public release requires separate authority. M1's ordinary-video thumbnail writer is implemented but not activated for live use; it requires separate channel-bound consent and approval of the exact image. Shorts currently receive an image and Studio handoff, not automatic API application. Visiting this website authorizes none of these actions.

AI processing and local infrastructure

The inspected E1/M1 editorial, comment-assistance and thumbnail-evaluation paths send selected transcripts, source evidence, comment context or images to locally hosted Ollama models, including Qwen. Local whisper.cpp performs transcription; Tesseract performs OCR; FFmpeg processes media. These are local processing tools, not identified cloud AI recipients. The inspected paths do not send that material to hosted OpenAI, Anthropic or ElevenLabs APIs and contain no general-purpose model-training operation. Model downloads or software installation are distinct from processing user media.

E1's application records are stored in PostgreSQL, with local disk/Docker storage for media and evidence. Its Hatchet workflow engine uses a local database; the inspected configuration does not establish Hatchet Cloud as a data recipient. M1 primarily uses local JSON/JSONL files for state, reports and ledgers. These storage arrangements do not establish a blanket encryption, backup or deletion guarantee.

External services and sharing

• Google / YouTube / Drive: OAuth and API requests, channel/Analytics queries, source retrieval and separately authorized media delivery or thumbnail actions. Google also processes mail sent to the support Gmail address.
• Telegram: enabled private owner notifications can contain video/comment references, review text, metrics and nightly reports. Bot requests include the recipient chat identifier. Provider acceptance does not prove the owner read a message. Local cleanup does not delete Telegram's copy.
• Tailscale: existing private remote access carries owner approval or enrollment traffic and supplies authenticated connection identity. It is separate from this public website and is not an OAuth consent grant.
• Vercel: serves these public pages; Google credentials and private media are not bundled in this static deployment.

Private operating records are available to the operator and authorized people or processes with access to that environment. The inspected application paths contain no sale or advertising distribution of Google data. Google/YouTube and other service providers control their own retained copies; deleting an application's local records does not erase provider-held data. See the Google Privacy Policy.

Credential storage and logs

M1 OAuth client and refresh-token files are stored outside the repository in the Windows user profile and separated by channel; the prepared thumbnail writer uses a separate token directory. M1's public-read API key and Telegram credentials use Windows Credential Manager. E1 loads credentials from local configuration and environment files. These are different storage mechanisms: this policy does not claim every credential is encrypted in a dedicated vault. Other processes with the same Windows-user authority may access user-scoped credentials.

M1 includes redaction for known credential fields and patterns, and uses hashes/status records to reduce retained material in several reporting paths. This is not a guarantee that every log, prompt, media filename or archive is free of personal information. Operational logs and retained model evidence have no verified universal expiry.

Actual retention and cleanup

• Classified M1 API copies: raw catalog, comment and Analytics snapshots now have an effective 28-day retention limit, including legacy records that previously carried a longer expiry. Classified catalog/Analytics aggregates, generated API-analysis reports and public-statistics history also receive scoped expiry. Cleanup runs through the existing scheduled observer and on ledger access. Longer Analytics storage is not enabled: the system uses the shorter limit instead of claiming that recurring authorization and video-status checks have been demonstrated.
• Observation caches and live statistics: the scheduled maintenance pass validates and expires identified observation, verification and statistics-cache records independently of a successful API collection. The standard statistics watcher's existing live-persistence admission remains disabled; its live results and the daily briefing's metrics/body remain session-only. This does not mean every M1 record is session-only.
• Scoped E1 execution: existing storage accounting now includes cleanup of explicitly classified, disposable Google API-cache envelopes in a dedicated namespace. Those envelopes expire after 28 days. Generic scratch candidates remain report-only. Existing production database rows, transcripts, source media, bundles, rights evidence, thumbnails and unclassified legacy files are not swept indiscriminately.
• Short-lived strategist backups: the existing scheduled entry can create a minimal backup at most once per day when work is not busy and data has changed. Validated backups expire within seven days, sooner when their copied API data expires. Raw API rows are not backed up. Original E1 recovery-evidence copies can be included. Controlled restore checks hashes, scope, expiry and deletion markers; expired copies and legacy snapshots without the required retention metadata are not automatically restored.
• Minimal operational receipts: new cleanup/deletion receipts and daily API-retrieval counters retain counts, timestamps and status for 90 days, without deleted payloads or raw channel/file identifiers. A retrieval counter does not certify authorization revalidation. Separate pseudonymous deletion markers are kept to prevent old copies from returning; those markers are not treated as anonymous data or expired with routine receipts.
• Preserved and unresolved records: original production assets and recovery evidence are separated from disposable API copies. Mixed historical experiment records, manually authored reviews, unknown files, broad production database/log archives, existing recovery copies outside the controlled mechanism and provider-held copies still require scoped review. Some existing review/delivery receipts have their own terminal-state cleanup; unresolved work can remain. No universal 28-day or 90-day lifetime is claimed for these other records.

Automatic cleanup depends on the host and existing schedules running. Expired classified copies are rejected or cleaned by the relevant controlled access/restore paths; a stopped computer does not physically erase files. Busy locks are respected and retried by later maintenance. There is no demonstrated all-system deletion guarantee covering every database, historical archive, provider or manually restored copy.

Access, deletion and revoking consent

Email pvelifer@gmail.com for access, correction, deletion, or privacy complaints. Identify the channel/video or record concerned and the requested action; see request instructions. Do not send passwords, access/refresh tokens, passkeys or private authentication links. Requests require operator handling; this website does not automatically read the support mailbox. The operator can register a scoped strategist deletion or confirmed revocation request with a seven-calendar-day target. It is recorded before cleanup, blocks new ingestion/restoration in that scope, removes verified eligible copies and backups, and resumes through scheduled maintenance if work was busy. Unknown, protected and external copies are reported as requiring review rather than falsely marked deleted. Completion across all databases, files, logs, backups and delivered copies is not yet demonstrated, so seven days is a handling target, not an assertion that every copy has already been erased.

Independently review or revoke access in Google's security permissions settings. Revocation removes future authorized access but is separate from deleting previously stored application data. Deleting local records does not delete videos, comments or other data held by YouTube; use YouTube's own controls for that.

Google API data use is governed by the Google API Services User Data Policy, including Limited Use, and the YouTube API Services Developer Policies. Publication of this notice is not a claim of Google verification or approval. New authorization flows present this privacy notice and terms within the existing desktop OAuth interaction and record a purpose-version acceptance after successful authorization. Material new purposes require a changed purpose version and renewed acceptance; existing same-purpose credentials are preserved. No acceptance receipt for an existing credential is fabricated. The desktop loopback flow is not a working iPhone callback. Material changes in data use require updated disclosures and any required renewed Google consent.