PRIVACY
WITHOUT
THE CORPORATE
NONSENSE.
Scrub. — built by Synn Studio — is designed to be the infrastructure layer for the next generation of creators. We believe that access to monetization and brand partnerships should never come at the cost of your privacy.
This policy exists to tell you, plainly and completely, what data we handle, why we handle it, and how you remain in control of it. We value transparency, responsible analytics, and ethical creator onboarding above all else. No dark patterns. No hidden clauses. No exploitation.
How Scrub. uses your
Google data
Scrub.'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Below is a complete disclosure of how we interact with your Google user data.
1. Google User Data Accessed
Scrub. requests the following Google OAuth 2.0 scopes. Each scope grants access to specific, limited data from your Google Account:
2. How We Use Your Google Data
We process your Google user data strictly for the following purposes:
- Authentication & Account Creation: Your Google email, name, and profile picture are used to create your Scrub. account, log you in securely via OAuth 2.0, and display your identity within the platform.
- Creator Profile Population: Your YouTube channel information (channel ID, title, thumbnail, subscriber count, total views, video count) is used to automatically set up your creator profile, saving you from manual data entry.
- Analytics Dashboard: YouTube Analytics data (views, watch time, demographics, traffic sources, device stats, search keywords, top videos) is fetched and displayed on your personal Scrub. analytics dashboard so you can track your channel performance.
- Brand-Creator Matching: Aggregated performance metrics (engagement rate, reach, audience demographics, niche) are used to match you with relevant brand collaboration opportunities on the platform.
- Campaign Performance: Historical analytics data is retained to track campaign effectiveness and improve the quality of future creator–brand matches.
3. Data Sharing
We are transparent about if, when, and how your Google user data may be shared:
- Brand Partners (Limited Profile Data Only): When you opt into a brand campaign on Scrub., limited aggregated profile information — such as your niche, subscriber count, engagement rate, and audience reach — may be shared with the partnering brand. This is solely to facilitate the campaign collaboration. Raw Google API data (such as OAuth tokens, full analytics reports, or your email address) is never shared with brand partners.
- Infrastructure Providers: We use trusted service providers for hosting (Railway), database (Neon PostgreSQL), and media storage (Cloudinary). These providers may process data as part of their service but are contractually bound to protect it and cannot use it independently.
- No Sale of Data: We do not sell, rent, lease, or trade Google user data to any third party — ever.
- Legal Obligations: We may disclose data if required by law, regulation, or valid legal process (e.g., court order, subpoena).
4. Data Storage & Protection
We take the security of your Google user data seriously and employ the following safeguards:
- Encryption in Transit: All data transmitted between your browser, our servers, and Google's APIs is encrypted using TLS 1.3 (HTTPS).
- Encrypted Database Storage: Google OAuth access tokens and refresh tokens are stored in our PostgreSQL database. The database is hosted on Neon with SSL-enforced connections. Tokens are used exclusively for server-side API calls and are never exposed to the client-side or browser.
- Password Security: User passwords (for non-Google accounts) are hashed using bcrypt before storage.
- Session Management: Authentication is handled via JSON Web Tokens (JWT) with a 30-day expiration. Tokens are regenerated on each login.
- Access Controls: Only authenticated users can access their own data. Role-based access controls (Creator, Brand, Admin) ensure users can only access data relevant to their role.
- Minimal Data Storage: We store only the Google user data that is necessary to provide our services (profile info, channel stats, analytics metrics). We do not store raw API responses beyond what is needed.
5. Data Retention & Deletion
You are in full control of your data at all times:
- Retention Period: Your Google user data is retained for as long as your Scrub. account is active and you maintain your Google authorization. Analytics data is periodically refreshed (synced) from Google's APIs to keep your dashboard current.
- Revoking Google Access: You can revoke Scrub.'s access to your Google data at any time by visiting your Google Account Permissions page. Once revoked, we will no longer be able to fetch new data from your Google account.
- Account Deletion: You can request complete deletion of your Scrub. account and all associated data (including all Google user data) by contacting us at synncstudio@gmail.com. Upon receiving a valid deletion request, we will permanently erase all your data — including Google OAuth tokens, YouTube analytics, profile information, and backups — within 30 business days.
- Data Export: You can request a full export of all data Scrub. holds about you at any time by emailing us at the address above.
- Cascading Deletion: When your account is deleted, all related data — creator profiles, analytics records, OAuth tokens, campaign history, and payment records — are automatically and permanently deleted from our database via cascading deletes.
Google API Services Limited Use Disclosure
Scrub.'s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Google user data to provide and improve the user-facing features described in this privacy policy.
- We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable laws, or as part of a merger/acquisition with advance user notice.
- We do not use Google user data for serving advertisements.
- We do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, to comply with applicable law, or our use is limited to internal operations with aggregated and anonymized data.
Six pillars of
data integrity
Information We Collect
We collect only what's necessary to power your creator journey — your name, email, Google profile picture, platform handles, audience demographics, and content performance metrics you explicitly connect. When you sign in with Google, we access your email address and basic profile information (name, profile picture) through your Google Account. No shadow profiles. No scraped data. Nothing we haven't told you about.
Creator Analytics
Our analytics engine uses YouTube Analytics API data (views, watch time, demographics, traffic sources) and YouTube Data API data (channel info, video metadata) to surface engagement trends, audience growth patterns, and monetization signals — purely to match you with better-fit brand deals. This data is never sold, never rented, and never used to profile you outside Scrub.'s ecosystem. You own your numbers.
Brand Collaboration Data
When a brand campaign is initiated through Scrub., limited profile data — reach, niche, engagement rate — is shared with the partnering brand under strict contractual confidentiality. Campaign outcomes are stored to improve future matching. Nothing beyond what powers the deal.
Third-Party Integrations
Scrub. integrates with YouTube and Instagram via official OAuth 2.0 protocols. We request only the minimum permissions (scopes) required to read performance metrics and account information. You can revoke access at any time from your Scrub. dashboard or from your Google Account permissions page at https://myaccount.google.com/permissions — instantly, permanently.
Account Security
All data in transit is encrypted with TLS 1.3. Passwords are hashed with bcrypt. Session tokens rotate on each login. OAuth tokens from Google are stored encrypted in our database and are never exposed to the client. We monitor for anomalous access patterns and will notify you immediately of any suspected breach — not after 72 hours, immediately.
Data Transparency
You can request a full export of every data point Scrub. holds on you at any time. You can request deletion and we'll wipe it within 30 business days — including backups and all Google user data stored on our servers. Our data practices are reviewed annually and we publish what changed. No legalese. Just clarity.
Creators deserve
transparency.
Scrub. was built with a single conviction: smaller creators — the YouTube channels with 5,000 subscribers, the Instagram creators with 15,000 engaged followers — deserve access to the same monetization infrastructure that mega-influencers take for granted.
Our platform matches micro and nano creators with brand partnerships using transparent analytics, not black-box algorithms. Every match is explainable. Every campaign outcome is visible to the creator. No hidden fees. No unexplained rejections.
We've built onboarding systems that respect your time and your data. Our analytics layer surfaces growth insights — not to profile you, but to arm you with the numbers that get brands to say yes. Creator growth is infrastructure, and infrastructure should be trustworthy.
We read every message.
If anything in this policy is unclear, or if you want to exercise any of your data rights — including requesting data export, account deletion, or revoking Google access — reach out directly. A real human responds.
synncstudio@gmail.com