Privacy Policy

Last updated 9 September 2026

scrubb.io is a small set of image tools for subscribers of the Vibe Coder Videos YouTube channel. This page says exactly what the site collects, what it does not, and how long anything is kept. It is short because the site does very little.

The short version. This site never learns your name or your email address — it does not ask Google for them. Nothing from your Google account is stored on our servers — not your subscription list, not your token, not even the answer to the subscription check. We never download the list of channels you follow: the request is filtered to one channel ID and capped at one record, so only the fact that you do or do not subscribe to this one channel is ever returned, held in memory for a few seconds, and discarded. There is no database, no analytics and no advertising, and we do not sell or share anything. The only thing kept about you is a sign-in cookie in your own browser, which you can delete by signing out. Images you upload are deleted within 30 minutes, and the metadata stripper never uploads anything at all. The one piece of third-party code on the site is YouTube's own Subscribe button, described below.

Signing in with Google

The tools are for channel subscribers, so signing in with Google is the only way in. When you sign in, the site asks Google for one permission and nothing else: read access to your YouTube subscriptions (youtube.readonly).

We do not ask who you are. We do not request the profile or email scopes, and we never call Google's userinfo endpoint, so your name, your email address and your Google account ID are never sent to this site at all. It does not know your name. The only thing it learns about you is a single yes/no.

That permission is used to ask one question, once: are you subscribed to the channel UCi8JS4LBD-1jvHKVGeq8U_g?

We never download your subscription list. The request we send to Google is filtered before it leaves this site, so the list is narrowed on Google's side and never on ours:

forChannelId is set to that one channel ID, so the query can only ever match that single channel — the other channels you subscribe to are not part of the question we are allowed to ask.
maxResults is set to 1, so even in the worst case the response cannot carry more than a single record. This is a deliberate second limit on top of the first.
The reply is reduced immediately to a single true/false: are you subscribed, yes or no. Nothing else in the response is read, copied or kept.

We do not read, store or look at the rest of your subscription list, your watch history, your videos, or anything else in your account. We could not produce a list of the channels you follow if we were asked to, because we never request one.

youtube.readonly is the narrowest permission Google offers that can answer that question. There is no "is this person subscribed" permission, which is why the request looks broader than what is actually used.

How that data is protected

The protection is that the data is never stored. Data that is not retained cannot be leaked, breached, or stored insecurely. That is the whole of our approach to sensitive data, and everything below follows from it.

Identity is never requested. We ask for one scope, youtube.readonly. Not profile, not email. Your name, email address and Google account ID never reach this site, so they cannot be exposed by it.
Minimised before it is requested. The filters above mean the sensitive part — which channels you follow — is never sent to us in the first place.
Held in memory only. Your Google access token and the subscription answer exist only in the server's memory, for the few seconds the check takes, and are then discarded. Neither is written to a file, a database, or a log.
No database. This site has no database. There is no user table, no subscriber list, and no record of who has signed in.
No long-lived credential. We request access_type=online, so Google never issues us a refresh token. We cannot reach your account when you are not actively signing in, and there is no stored credential to compromise.
Encrypted in transit. The site is served over HTTPS only, and the call to Google's API is HTTPS.
Tamper-proof sign-in cookie. The one cookie we set is cryptographically signed, so it cannot be edited to fake a subscription. It lives in your browser, not on our server.

To be exact about the one thing that is written down: we keep a running count of how sign-ins end — a timestamp, whether it succeeded, and whether the account was subscribed. That line deliberately carries no name, no email address, no Google account ID, no IP address and no browser details, so it is a tally of how often the tool is used and not a record about any person. It cannot be linked back to you.

Retention and deletion of Google user data

Nothing obtained from Google is stored on our servers, so for that data there is nothing to retain and nothing to delete. Precisely:

Google data	Where it exists	Retention
Your Google access token	Server memory only, during the sign-in request.	Seconds. Discarded as soon as the subscription check returns. Never written to disk. No refresh token is ever issued or held.
Whether you subscribe to the channel	Server memory during the check, then a signed cookie in your own browser.	Not retained by us at all. The answer is used once to open the door and is not recorded on our side.
Your name, email address and Google account ID	Nowhere. Never requested, never received — the scopes that would provide them are not asked for.	Not applicable.
The yes/no result and when it was checked	A signed cookie in your own browser. Not on our servers.	Until you sign out or clear your cookies, whichever comes first. Signing out deletes it immediately. The subscription is re-checked after 12 hours.
Your subscription list, watch history, videos, playlists	Nowhere. Never requested, never received.	Not applicable.

How to delete it. Because the only place any of it persists is your own browser, you delete it yourself and it is gone at once: press Sign out, or clear this site's cookies. You do not need to contact us, and there is nothing left on our side afterwards because there was never anything there. You can also revoke this site's access to your Google account at any time — see Revoking access below.

If you would like written confirmation that we hold nothing about you, email vibecodervideos@gmail.com and we will confirm.

What is kept, and for how long

What	Where it is kept	How long
Whether you are subscribed (a yes/no), and when that was checked	A signed cookie in your own browser. It is not written to our database, because there isn't one. Your name and email are not in it, because we never receive them.	Until you sign out or clear your cookies. The subscription is re-checked after 12 hours.
Your Google access token	Held in memory only, for the few seconds it takes to ask the subscription question.	Discarded immediately. Never written to disk, and no refresh token is requested. See Retention and deletion of Google user data above.
Images you upload to the watermark test or the denoiser	A temporary folder on the server, reachable only by the random unguessable ID given to your browser.	Deleted automatically within 30 minutes, or immediately when you press the delete button. Nothing survives a server restart.
Images used in the metadata stripper	Nowhere. That tool is JavaScript running inside your browser and never sends your files anywhere. It works with your network switched off.	Not applicable.
Web server logs (IP address, browser type, page requested, time)	Standard hosting logs kept by our web host.	Rotated by the host on its normal schedule. We do not analyze them or link them to your account.

Limited Use disclosure

scrubb.io's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google is used only to provide and improve the sign-in gate described above. It is never transferred to anyone else except as needed for that purpose, never used for advertising, never sold, and no human reads it.

Your uploaded images

The watermark test and the denoiser have to run on the server, so those images are uploaded. They are used only to produce the result you asked for. They are not inspected by a person, not used to train anything, not kept as examples, and not shared. Press the delete button on a result and it is gone from the server straight away; otherwise it goes on its own within 30 minutes.

If you would rather nothing leaves your computer at all, the metadata stripper runs entirely in your browser, and you are welcome to use it offline.

Cookies

One cookie of our own, for sign-in. It is cryptographically signed so it cannot be edited, and it holds only whether the subscription check passed and when it was checked — no name, no email address, no Google account ID, because the site never receives any of those. There are no advertising cookies and no analytics cookies.

YouTube's Subscribe button

The sign-in page, and the prompt shown if your account turns out not to be subscribed, embed YouTube's official Subscribe button. That button is a small frame served by Google, not by us, so loading it tells Google you visited the page and it may set Google cookies in your browser, exactly as it would on any site that embeds one. We do this so you can subscribe and carry on without leaving, rather than being sent away and losing your place.

We receive nothing from that button: no click, no confirmation, no data. The site only learns whether you are subscribed when you choose to continue and the check described above runs again. Google's handling of that frame is covered by Google's privacy policy. If you would rather not load it, subscribe on YouTube directly and come back; the site works the same either way.

Revoking access

You can withdraw this site's access to your Google account at any time, from Google's own settings. You do not need to ask us, and it takes effect immediately.

Revoke access here:
https://myaccount.google.com/permissions

Find scrubb.io in the list of third-party apps with account access and choose Remove access. Google also lists it under Data & privacy → Third-party apps & services in newer versions of the interface.

Revoking means the site can no longer ask YouTube anything about your account. The next time you sign in you would be asked to grant permission again.

Separately, signing out of scrubb.io clears the sign-in cookie, which is the only thing this site keeps. Since nothing about you is stored on our side, there is nothing further for us to delete, but if you want that confirmed in writing, email vibecodervideos@gmail.com and we will confirm.

Children

This site is not directed at children under 13 and we do not knowingly collect information from them.

Changes

If this policy changes, the date at the top changes with it. If a change ever meant collecting something new, we would say so plainly here before doing it.

Contact

Questions about privacy, or a request about your data: vibecodervideos@gmail.com.