Privacy Policy

Channel Stats MCP is run by Little Planet Labs, LLC ("Little Planet Labs", "we", "us"). It's a remote MCP server that lets Claude, or another MCP client, read stats for YouTube channels you connect.

• We store your Google name, email address and profile picture link, the YouTube channels you connect with an encrypted Google token for each, which MCP clients you've connected, and a log of which tools ran.
• Stats, video details and comments go straight from YouTube to the MCP client that asked for them. We don't store them. Thumbnail impressions and click-through rate are the exception: we download them daily and keep them for up to 36 months.
• We don't sell your data or show ads, and we share it only with the MCP clients you connect and the service providers listed below.
• Disconnect a channel, or delete your account and everything in it, any time from the dashboard.

Channel Stats MCP uses YouTube API Services to read data about the channels you connect. Google's handling of that data is covered by the Google Privacy Policy.

Channel Stats MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your account

When you sign in with Google, we ask only for your basic profile and email address. We store your name, your email address (Google must have verified it), the link to your profile picture, and Google's ID for your account. We also store the access token Google issues at sign-in, encrypted at rest. Channel Stats MCP never uses that token, and we don't store Google's ID token at all.

Connected YouTube channels

Connecting a channel is a separate step, with its own Google consent screen. It asks for read-only access to your YouTube account and your YouTube Analytics reports. For each channel you connect, we store its YouTube channel ID, title, handle and thumbnail link, the ID of the Google account that granted access, the permissions Google says you granted, and the refresh token Google issues. The refresh token is encrypted at rest. We also note when the connection was made, last checked and last used.

Comments access is off by default. If you turn it on for a channel, Google asks you for one more permission, and that channel's connection records that you granted it.

Reach statistics

YouTube only provides thumbnail impressions and impressions click-through rate as a daily bulk report from the YouTube Reporting API. To get it, we set up a reporting job for each connected channel at Google, then download the new reports once a day. We store, for each video and day, the number of thumbnail impressions and the click-through rate exactly as YouTube reports them, along with the video's ID. Google keeps the reporting job after you disconnect, but we stop downloading from it.

Video notes

A connected client can save a short note on one of your channel's videos for you, such as which upload is the vertical Shorts version of another, so later conversations don't have to work it out again. For each note, we store its text (up to 500 characters), the video's ID, the channel connection it belongs to, and when it was saved. Notes are never sent to YouTube, and only you, through your connected clients, can see them.

Your license

If your account has a license, which is what lets connected clients use the tools, we store its status, where it came from (such as early access), its plan, when it was granted, when it expires or was revoked, when it last changed, and an optional note we add.

Sign-in sessions

Each time you sign in, we start a session and store the IP address and browser user agent it started from.

Connected clients

When you connect an MCP client such as Claude, we store which client you connected, the scopes you approved for it, and hashed copies of the refresh tokens issued to it, so we can enforce those scopes and let you revoke access. If a client asks for a token that isn't tied to the MCP server, we also store a hashed copy of that short-lived access token. It stops working after 15 minutes, and the copy stays until you disconnect the client or delete your account. While you approve a client, we also hold a one-time authorization code for up to 10 minutes. The signed access tokens clients use to call the MCP server expire after 15 minutes and aren't stored.

Tool-call activity

Every time a connected client calls a tool, we log which tool ran, which channel and client it ran for, whether it worked (with an error code if it didn't), how long it took, and when it happened. We never log the tool's arguments or its results.

Rate limiting

We keep short-lived counters in Upstash Redis, keyed by your account and channel, to enforce rate limits on tool calls and on connecting channels.

Analytics and performance

We use Vercel Web Analytics and Vercel Speed Insights, which are cookieless. They give us aggregate page-view and performance data and don't identify you individually.

When a connected client calls a tool, Channel Stats MCP uses your channel's refresh token to get a short-lived access token from Google, reads what the tool needs from the YouTube Data API or the YouTube Analytics API, and passes the result to the client that asked. Depending on the tool, that's channel and video counts, your list of uploads, Analytics reports (such as views and watch time by traffic source, country, device, age and gender, or Shorts versus long-form), or a video's audience retention.

The comments tool only works on channels where you turned on comments access. It reads top-level comments, including each commenter's display name, the comment text, and its like and reply counts.

None of that is stored. See Tool-call activity for the one record we keep about each call. The reach tool reads the reach statistics we already stored and makes no call to YouTube.

Channel Stats MCP only reads from YouTube. It never uploads, edits or deletes anything on your channel.

• To run the service: authenticate you, check your license, read from YouTube on your behalf when a tool runs, download your daily reach reports, and enforce scopes and rate limits.
• To keep stored channel details current. Once a channel's title, handle and thumbnail are 20 days old, we refresh them from YouTube and check that its access still works, in a daily background check or the next time a tool uses the channel.
• To show you your own channels, connections and activity in the dashboard.
• To investigate problems and abuse.
• To reply when you contact us.

When a tool runs, its result goes to the MCP client you connected, such as Claude by Anthropic. From then on, that client's own terms and privacy policy govern the data, so check them before you connect it. You choose which clients to connect, and you can disconnect them any time.

We also use a small set of service providers to run Channel Stats MCP. Each one handles data only to provide its service to us.

• Vercel hosts the website and the MCP server, keeps request logs, and provides Web Analytics and Speed Insights.
• PlanetScale hosts our Postgres database, which holds accounts, licenses, connected channels and their encrypted tokens, reach statistics, client connections, and activity records.
• Upstash hosts the Redis store we use for rate limiting.
• Google provides Sign in with Google and the YouTube APIs the tools read from.

We may also disclose information if the law requires it, to protect the rights or safety of our users or others, or as part of a merger, sale, or transfer of Channel Stats MCP, in which case this policy would still apply to the information we hold.

• We don't sell or rent your information.
• We don't use your information, or any data we get from Google, for advertising, and we don't share it with advertisers.
• We don't share your YouTube data with anyone but the MCP clients you connect and the service providers above.
• We don't use data we get from Google to train AI or machine learning models.
• We don't track you across other companies' websites or apps.

• We refresh a channel's title, handle and thumbnail link from YouTube once they're 20 days old. If the daily check still can't refresh them once they're 28 days old, we delete the channel with its encrypted token, reach statistics and video notes, and you'd need to connect it again.
• When a channel's access stops working (you revoked it at Google, it expired, or the channel no longer exists), the dashboard shows it as needing to be reconnected. If you don't reconnect it, we delete it, with its encrypted token, reach statistics and video notes, within 30 days of when it stopped working.
• Reach statistics are kept for up to 36 months, then deleted. They are also deleted along with their channel.
• Video notes are kept until you remove them, or until their channel is deleted, which deletes them too.
• Account, license, client connection, and activity records are kept until you delete them or your account. That includes licenses that were revoked or expired.
• A sign-in session is deleted when you sign out. One that expires is deleted the next time your browser presents it, and any that are left are deleted with your account.
• Activity records outlast a channel you disconnect, but they no longer point to that channel.
• Rate-limit counters are short-lived and expire automatically.
• Hosting logs and analytics are kept for the periods Vercel sets for our plan.

• Disconnect a channel from the dashboard's Channels page. We delete the channel, its encrypted token, its reach statistics and its video notes right away, and ask Google to revoke our access. We skip that last step if another connected channel still uses the same Google account, because revoking would cut that channel off too.
• Revoke access at Google on the Google Account permissions page. We find out the next time we use the connection, the channel then shows as needing to be reconnected, and we delete its stored data as described above.
• Disconnect an MCP client such as Claude from the dashboard's Connections page. That deletes your approval and its refresh tokens, and any access token it still holds stops working right away.

• Delete your account from the dashboard's Account page. It immediately deletes your account, your sign-in sessions, your license record, your connected channels with their encrypted tokens and reach statistics, your client connections, and your activity log. We then ask Google to revoke our access to your channels, unless another connected channel still uses the same Google account.
• Email us at channelstats@littleplanetlabs.com from the address on your account if you'd rather we do it. We'll delete your data within 7 days.
• Ask about your information. Depending on where you live, you may have the right to access, correct, delete, or object to how we handle your personal information. Email us and we'll help.

We only set the cookies the service needs to work:

• A session cookie that keeps you signed in. It lasts up to 7 days and is renewed while you keep using the site.
• Short-lived cookies that tie Google's reply back to your browser while you sign in with Google, or while you connect a channel or turn on comments access. These expire within 10 minutes.

We don't use advertising or tracking cookies.

Channel Stats MCP is served over HTTPS. Each channel's Google refresh token is encrypted at rest with its own data key, which is itself protected by a versioned master key. Google's sign-in tokens are encrypted with a separate key. No system is perfectly secure, though, so we can't promise that information will never be accessed without permission.

Channel Stats MCP is a tool for people who run YouTube channels. It isn't directed at children under 13, and we don't knowingly collect personal information from them. If you think a child has sent us personal information, email us and we'll delete it.

Channel Stats MCP is run from the United States, and our service providers may process data in the United States and other countries. If you use it from outside the United States, your information may be processed somewhere with different data protection laws than where you live.

If we change this policy, we'll update it here and change the "Last updated" date at the top. If a change meaningfully affects how we handle your information, we'll make it more visible, for example with a notice on the site.

Questions or requests about privacy go to channelstats@littleplanetlabs.com.

See also our Terms of Service.