Privacy Policy

Effective October 22, 2026

125x ("we") gives you AI summaries of YouTube videos. This policy explains what data we collect, how we use it, and your choices.

What we collect

Google account basics — your name, email address, and profile photo, via Google OAuth sign-in.
YouTube subscription list — read-only, via the youtube.readonly scope. We use it to build your personalized feed. We never modify your YouTube account, playlists, or subscriptions.
App activity — videos you open and save, stored on our servers keyed to your Google account ID so your Viewed and Saved lists sync across your devices.
Video transcripts — fetched from YouTube's public caption tracks to generate summaries and answer your questions.
Import screenshots (optional) — if you use screenshot import instead of signing in, the screenshots you choose to upload are sent to Google's Gemini API to read the channel names visible in them. They are processed in memory for that purpose only and are never stored on our servers.

How we use it

To build your personalized video feed and rank it by your interests.
To generate AI summaries (takeaways, action steps, lessons) and answer questions about videos. Transcripts are processed by Google's Gemini API, subject to Google's API terms.
To keep you signed in across visits (encrypted refresh tokens, 30-day sessions).

Who we share data with

We share Google user data only with the service providers that run 125x, and only so they can operate the service for us:

Cloudflare — hosts 125x and stores the data described above (your account basics, your subscription list, and your Viewed/Saved activity) on its infrastructure.
Google — your sign-in and YouTube data come from Google's APIs. Video transcripts processed by Google's Gemini API to generate summaries are public video caption data, not your personal data.

That is the complete list. We do not sell your data, we do not share it with advertisers or data brokers, and we do not disclose it to any other third party, except if required by law.

What we don't do

We don't sell your data or share it with advertisers.
We don't write to your YouTube account — our access is strictly read-only.
We don't collect your YouTube watch history beyond what you open inside 125x.

Google API compliance

125x's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data storage & security

We protect the data we store — including Google user data — with the following data protection mechanisms:

Encryption in transit — all traffic between your browser, our servers, and Google's APIs uses HTTPS/TLS.
Encryption at rest — data is stored on Cloudflare's infrastructure (KV storage), encrypted at rest; OAuth refresh tokens are encrypted at rest.
Server-side tokens only — your Google access and refresh tokens are stored only on our servers and are never exposed to or stored in your browser; your browser holds only a session identifier.
Least-privilege access — we request a single read-only scope (youtube.readonly). We cannot modify your YouTube account, and we never request broader access.
Session limits — sessions expire after 30 days; signing out deletes your server session immediately, and revoking access at Google instantly cuts our access to your data.
Access control — stored data is keyed to your Google account ID and is used only to provide the service to you.

Your choices

Sign out any time — this deletes your server-side session.
Revoke access at myaccount.google.com/permissions — this instantly cuts our access to your Google data.
Delete everything — email us (below) and we'll delete your stored Viewed/Saved data and sessions.

Children

125x is not directed at children under 13, and we don't knowingly collect their data.

Changes

We'll post policy updates here and update the effective date.

Contact

Questions or deletion requests: [email protected]