Privacy Policy

Smash Collab (“we”, “us”) helps YouTube creators find collaboration partners. This policy explains what we collect, why, and how you can have it deleted. Questions: support@smashcollab.com.

What we collect

• Google account basics (name, email address, and account ID) when you sign in with Google. Your email is used for sign-in and account support and is not shown to other creators.
• YouTube channel data (read-only): your channel ID, channel name/handle, profile picture, subscriber count, and total view and video counts (used to show an average views figure).
• Profile details you add: niches, a short bio, and optional country, state, and county.
• Activity on Smash Collab: who you pass on or send a collab to, collab notes, matches, and messages with your matches.
• Payments are handled by Stripe. We never see or store your full card number; we store your Stripe customer and subscription IDs and how long your Plus access lasts.

How we use YouTube data

We request the youtube.readonly scope only. We use it once, when you verify, to confirm you own the channel and to fill in your public creator card (channel name, picture, and size) so other creators can decide whether to send a collab to you. We never upload, edit, delete, comment, or post anything on YouTube, and we do not access your private videos, analytics, or messages. If YouTube does not answer on the first try, we keep the access token in a short-lived encrypted cookie (about 10 minutes) so you can load the channel again without another Google prompt. That cookie is deleted when verification finishes, when you sign out, or when it expires. We do not keep a refresh token, and we do not store the access token after verification.

Smash Collab uses YouTube API Services. By using Smash Collab you also agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy.

Google API Services User Data Policy

Smash Collab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not let humans read it except with your permission, for security, or when required by law.

Who can see your information

Signed-in creators can see your public creator card (channel name, picture, subscriber count, average views, niches, bio, and location if you add it). Collab notes are visible to the creator you send them to. Messages are visible only to you and the creator you matched with. We share data with service providers that run the app for us — Google Firebase (sign-in and database), Vercel (hosting), and Stripe (payments) — only as needed to provide the service. We do not sell, rent, or transfer Google user data (raw, derived, aggregated, or anonymized) to advertisers, data brokers, or any other third party, and we do not send it to any AI or machine-learning service or use it to train AI/ML models. We do not create aggregated or anonymized datasets from Google user data.

How we protect your data

The hosted Smash Collab site is served over HTTPS, so traffic between your browser and the app is encrypted in transit with TLS. Your profile and YouTube channel data are stored in Google Cloud Firestore, which encrypts data at rest. Firestore security rules let each signed-in creator read and change only their own profile. The verified YouTube channel record is closed to the browser; only our server writes it. The temporary YouTube access token is kept only inside an encrypted, HttpOnly cookie for about 10 minutes. On HTTPS that cookie is also marked Secure. The token is never written to our database or logs. We do not store Google refresh tokens.

Keeping and deleting your data

We keep your data while your account is active. You can ask us to delete your account and all associated data at any time by emailing support@smashcollab.com from the Google address you signed in with. We delete your profile, swipes, matches, and messages within 30 days of a verified request (Stripe keeps payment records it is legally required to keep). You can also revoke Smash Collab’s access to your Google account at any time at myaccount.google.com/permissions. If you revoke access, we keep only the channel details already shown on your creator card until you ask us to delete your account. We cannot read anything new from your YouTube account. Deleting your account removes your YouTube channel data from our database.

Cookies and local storage

We use essential, secure cookies to keep you signed in and to remember your Plus status, and your browser’s local storage to remember settings like filters. Logging out clears them. We do not use advertising cookies.

Anonymous, cookie-less visit statistics are collected via Vercel Web Analytics.

Age

Smash Collab is only for people 18 or older.

Changes

If we change this policy we will update the date above and, for material changes, tell you in the app.