Privacy Policy for Tortma

Last Updated: September 30, 2026

Overview

Tortma (“we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our browser extension (available for Chrome and Firefox) and related services.

Information We Collect

1. YouTube Data

When you organize videos with Tortma, we access and process the following YouTube data:

  • Video Metadata: video ID, title, channel name, thumbnail URL, description, and duration (if available).
  • Playlist Information: playlist names and IDs so we can display available playlists and add videos to your selected playlists.
  • YouTube Account: your Google account email obtained through Google OAuth to identify your account, access your playlists, and perform playlist operations on your behalf.

2. Google OAuth Scopes

Tortma requests only the minimum Google OAuth scope required to provide playlist organization:

  • https://www.googleapis.com/auth/youtube

    Used to read your YouTube playlists and video metadata, and to add organized videos to your selected playlists on your behalf. We only modify playlists when you ask us to (filing, clearing, or deleting). We do not request broader YouTube scopes than this.

3. Authentication Data

  • Google OAuth: your Google account email, and OAuth access and refresh tokens. The tokens are stored only on your device, encrypted with AES-GCM. We do not store your tokens in our database, so we cannot revoke them for you. To keep you signed in, your refresh token is sent over HTTPS to our own token-refresh function, which exchanges it with Google for a new access token and discards it without saving it. To revoke Tortma's access to your Google account, visit https://myaccount.google.com/connections?filters=3,4.

4. Usage Data

  • Drop Counter: number of videos organized per day, tier level (Free/Pro), trial status, Drop Pack balance, and last login timestamp.
  • Tier/License Information: your current subscription tier and license status, provided by Polar.sh.

5. Device Data

  • Extension Logs: error messages, performance metrics, browser version, and operating system (used for debugging only).

6. Website Analytics (Google Analytics)

When you visit our marketing website at tortma.com, we use Google Analytics 4 (installed via the Google tag) to understand how the site is used so we can improve it. This applies to the website only — the browser extension itself does not use Google Analytics.

We only activate Google Analytics after you give consent through the cookie banner on our website. Until you accept, the Google tag runs with Consent Mode defaults of “denied” and no analytics cookies are set. You can change your choice at any time via “Cookie preferences” in the site footer.

Once consented, Google Analytics may collect:

  • Pages and interactions: which pages you view and clicks on key buttons or links.
  • Traffic source: the referrer or how you arrived at tortma.com.
  • Device and browser: browser type and version, operating system, screen resolution, and language.
  • Approximate location: country and region derived from your IP address (Google truncates IP addresses before storage).
  • Cookies: Google Analytics sets cookies on your device (such as _ga and _ga_*) to distinguish users and remember visits over time. We also use Cloudflare Web Analytics (cookie-free) for aggregate traffic counts.

Google processes this data on our behalf under Google's terms. You can opt out by disabling cookies for tortma.com in your browser or by installing the Google Analytics opt-out browser add-on.

How We Use Your Information

  • Core Functionality: to enable drag-and-drop video organization to your YouTube playlists.
  • AI Categorization: to suggest appropriate playlists. When you drop a video, we send its title, channel name, and a short description excerpt, plus the names of your existing playlists, to our AI provider (TypeSafe, via our Cloudflare Worker). We do not send your account details or tokens. Separately, we use Alibaba Cloud (Qwen) and Groq as primary and fallback providers to suggest names for new playlists.
  • Usage Limits: to enforce tier-based drop limits — Free: 15/day & 200/month, Pro: 60/day & 800/month.
  • Subscription billing: Polar.sh handles billing; we receive only your tier/license status, not payment details.
  • Service Improvement: to identify bugs and improve extension performance.
  • Website Improvement: to understand how visitors use tortma.com (via Google Analytics, only after your consent, and Cloudflare Web Analytics) and improve our marketing site.

Data Storage & Security

Where Data is Stored

  • Supabase PostgreSQL: user profiles, drop counts, video-to-playlist mappings, feedback messages, and license information.
  • Local and Edge Caches: video metadata is cached on your device and on Cloudflare's edge for short periods. Playlist-categorization results expire after 24 hours and suggested playlist names after 7 days. These caches are keyed by YouTube video ID rather than by your account, so we cannot identify and remove an individual cached entry for you.
  • Google Servers: YouTube OAuth tokens and playlist data.

Encryption

  • OAuth refresh tokens are stored only on your device, encrypted with AES-GCM. They are never written to our servers.
  • Access tokens are stored temporarily in the browser extension storage (1-hour expiry).
  • All data transmission uses HTTPS.

Data Retention

  • Drop Records: retained while your account is active, and deleted when you request account deletion.
  • Feedback: messages you submit are retained while your account is active, and deleted when you request account deletion.
  • OAuth Tokens: access and refresh tokens are stored only on your device, encrypted with AES-GCM. Removing the extension or clearing its site data deletes them from your device.
  • Tier/License Information: retained while active and removed upon cancellation or deactivation.
  • User Profile: retained until account deletion.

Third-Party Services

We use the following third-party services to operate Tortma:

  1. Supabase

    Purpose: user authentication, database storage, and Edge Functions.

    Data Shared: user email, drop counts, license information.

    https://supabase.com/privacy
  2. Google / YouTube

    Purpose: OAuth authentication and playlist access.

    Data Shared: your YouTube account and playlists.

    https://policies.google.com/privacy
  3. Google Analytics (Google tag)

    Purpose: website usage analytics on tortma.com (enabled only after your consent).

    Data Shared: pages viewed, interactions, traffic source, device/browser details, approximate location (IP truncated by Google), and Google Analytics cookies.

    https://policies.google.com/privacy
  4. TypeSafe

    Purpose: AI-powered categorization of a dropped video into one of your existing playlists.

    Data Shared: video title, channel name, a short description excerpt, and the names of your existing playlists. Your user ID, account details, and tokens are never included in these requests.

    https://typesafe.ai
  5. Alibaba Cloud (DashScope / Qwen)

    Purpose: AI-generated playlist-name suggestions for new playlists.

    Data Shared: video title, channel name, and a short description excerpt.

    https://www.alibabacloud.com/privacy-policy
  6. Groq

    Purpose: fallback provider for the same playlist-name suggestions when our primary provider is unavailable.

    Data Shared: video title, channel name, and a short description excerpt.

    https://groq.com/privacy
  7. Cloudflare

    Purpose: the AI orchestration Worker, checkout webhooks, and a short-lived cache. Categorization results are cached for up to 24 hours and suggested playlist names for up to 7 days. The cache is keyed by YouTube video ID rather than by your account, so we cannot delete individual entries on request.

    https://www.cloudflare.com/privacypolicy/
  8. Polar.sh

    Purpose: subscription billing and license provisioning.

    Data Shared: tier/license status (no payment details).

    https://polar.sh/legal/privacy

Your Rights

You have the right to:

  • Access: request a copy of your personal data.
  • Deletion: request deletion of your account and associated data. Email [email protected] from the address on your account. We verify your identity, then delete your data. We aim to complete deletion as soon as verification is done, and in any case within 30 days of your request.
  • Opt-Out: disable or uninstall the extension at any time.
  • Transparency: understand how your data is used.

To exercise these rights, contact us at [email protected].

Your Google tokens: we do not hold your tokens, so we cannot revoke them for you. To revoke Tortma's access to your Google account, visit https://myaccount.google.com/connections?filters=3,4. You may also wish to remove the extension, which deletes its locally stored tokens.

Data We Do NOT Collect

  • Browsing History: we do not track which videos you watch.
  • Personal Information: Beyond your Google account email used for authentication, we don’t collect names, phone numbers, physical addresses, or government IDs.
  • Analytics: the browser extension does not use Google Analytics or similar tracking services. Our website (tortma.com) does use Google Analytics 4 (Google tag) and Cloudflare Web Analytics as described in “Website Analytics” above. Limited technical data (error messages, browser version, OS) may appear in extension logs solely for debugging.
  • Cookies: the extension does not use cookies. Our website sets Google Analytics cookies (_ga, _ga_*) only if you accept them via our cookie banner, as described above; we do not use advertising or other third-party tracking cookies.
  • Video Content: we do not store or analyze video content itself.

Security Measures

  • All API calls use HTTPS encryption.
  • OAuth access tokens expire after 1 hour.
  • OAuth refresh tokens are stored only on your device, encrypted with AES-GCM, and are never written to our servers.
  • The extension only runs on YouTube domains.
  • We request minimal permissions (YouTube access only).
  • We conduct regular security audits of our code.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by:

  • Updating the “Last Updated” date.
  • Posting the new policy in the extension.
  • Requesting your consent if required by law.

Contact Us

For privacy concerns or data requests, contact us at: [email protected]
Website: https://tortma.com

Compliance

Tortma complies with:

  • Chrome Web Store Developer Program Policies
  • Firefox Add-on Policies
  • GDPR (General Data Protection Regulation)
  • CCPA (California Consumer Privacy Act)
  • YouTube Terms of Service
← Back to home