Privacy Policy

1. Information we process

• Account and onboarding: your email address, Google account identity when used to sign in, password hash for email sign-in, questionnaire answers, consent records, referral attribution and onboarding progress.
• Connected YouTube information: channel identity, name, handle and image; subscriber and video information; and the performance, audience, analytics and monetary analytics available through the read-only permissions you grant. We store encrypted OAuth credentials so the service can access authorised information while your connection remains active.
• Campaign and payment information: campaign participation, content or scripts you submit, verification results, reward and payment records, and payment or wallet details you provide.
• Technical and support information: session identifiers, browser and request information, security and error logs, and information you send when contacting support.

2. How we use it

We use this information to create and secure accounts, save your progress, connect your channel, assess eligibility, match creators with campaigns, check campaign performance and submissions, calculate and administer rewards, provide reporting and support, and investigate errors or abuse. Automated checks assist these activities; you can contact us about an incorrect result.

Where data-protection law requires a legal basis, processing may be necessary to provide the service or fulfil campaign arrangements, comply with legal obligations, protect the service and its users, or act on consent where consent is required. Authorising a Google connection is separate from creating an Outfold account, and you can revoke that authorisation.

3. Google and YouTube

Outfold uses Google sign-in and YouTube API Services. Google’s consent screen identifies the permissions requested. YouTube access is read-only, including monetary analytics used for verification and rewards; it does not allow Outfold to upload, edit or delete your videos or channel. Google and YouTube information is used for the connection, verification, reporting and reward purposes described in this policy.

You can revoke access through your Google Account permissions. Revocation prevents further access using that authorisation, but does not by itself delete records previously stored by Outfold. Contact us to request deletion of your account or connected information. Google’s own processing is described in the Google Privacy Policy.

4. Sharing and service providers

Hosting, database, content-delivery, security, email and error-monitoring providers process information needed to run Outfold. These services include AWS, Cloudflare, DigitalOcean, Google, Resend and Sentry. When you use submission or script-checking features, relevant submitted content may be processed by automated assessment services.

Authorised team members, verification services and protocol validators may access information needed to operate the service, verify performance or administer rewards. Campaign participants may receive relevant creator and campaign-performance information needed for their campaign. Information may also be disclosed where required by law or to address fraud, security threats or disputes.

If you use a blockchain payment method, wallet addresses and transactions may be publicly visible on that network and cannot generally be removed by Outfold. Providers and networks may process information outside your country; the locations and applicable protections depend on the services involved.

5. Cookies and local storage

The portal uses cookies for sign-in, session expiry and account context. A referral cookie remembers referral attribution for up to 90 days. Browser storage also remembers preferences such as your display theme and supports account-connection flows. Browser controls can remove or block this storage, but blocking session cookies can prevent sign-in. Service providers may process technical request information for security and delivery.

6. Security and retention

Passwords are stored as hashes, and stored YouTube OAuth credentials are encrypted. Access controls restrict account and administrative operations. No internet service can guarantee absolute security.

Retention depends on why information is needed: operating an active account, fulfilling campaign and payment obligations, investigating abuse, resolving disputes, or meeting legal requirements. Backups and records required for these purposes may remain after an account closes. We do not state a single deletion period for all data. Contact us for information about a particular record or to request deletion; records on public blockchains are outside our ability to erase.

7. Your choices and requests

You can update available account settings, revoke connected Google access, or contact us to request account closure. Depending on applicable law, you may have rights to access, correct, obtain a copy of or delete personal information, restrict or object to processing, withdraw consent, or complain to a data-protection authority. Withdrawing consent does not undo processing that was lawful before withdrawal.

Email [email protected] with your request. We may need to verify that you are entitled to act for the account. Do not send your password, OAuth tokens or wallet recovery phrase.

8. Policy changes

We will identify updates with the publication date on this page. Any notice or renewed consent required by applicable law still applies. Contact us if you have questions about a change.