Your data.
Your control.

Scope and operator

Channel Workflow Studio is maintained by the individual operator WANGWEN. Contact xiaotao5490@gmail.com for privacy or data requests. This notice covers the static information site and the independent local tool. Core code has passed offline tests. On November 8, 2026, the first private test video and thumbnail were uploaded and processing completed. A private broadcast and independent stream resource were created and bound: status ready, auto-start and auto-stop disabled, with no streaming started. Seven limited reads succeeded; operations, traffic and estimated-revenue Analytics returned empty rows, not zero values or zero revenue. The real operation recording is complete locally and is being reviewed and edited by the owner; it has not been published. Live streaming and real revocation and retirement validation remain pending. Implementation and validation boundaries are explained below.

The local tool uses YouTube API Services. Its use is also subject to the YouTube Terms of Service. See the Google Privacy Policy for Google’s handling of data it receives.

Website visits and contact

This site has no sign-in, Google authorization, upload forms, advertisements, third-party analytics scripts or embedded players. Demo tabs only change the display: they do not call channel APIs or write cookies or browser storage. Images, styles and scripts are site-local; fonts are system fonts.

Hosting and network services still receive request information needed to serve pages, such as IP address, request time, URL and browser information. Hosting infrastructure logs and access controls may involve separate processing. This site’s code does not itself collect that information, and the operator does not build visitor profiles.

If you email the operator, your address, message and attachments are received to respond to support or data requests. Do not send passwords, OAuth tokens, full state directories, stream keys or unredacted logs. Correspondence is retained only as needed to handle the request; you may request deletion by email, with any necessary dispute or legal retention explained.

Data handled by the local tool

The tool does not read your Google password. The operator does not sell channel data or use it for ad targeting. This independent version does not connect automated comment replies, CMS or AdSense accounts. The program has no built-in AI API calls and does not automatically send data to AI services.

If you ask an assistant such as Codex to run or troubleshoot the tool, the inputs you provide and the outputs it reads or displays are handled by that assistant service under its own terms and privacy rules. Share only what the task needs, without passwords, OAuth tokens, client secrets, SSH private keys, stream keys or full private state. The absence of built-in AI calls does not mean data always stays on your computer when an assistant is involved. This website itself does not integrate an assistant or provide data-collection forms.

Limited use of Google user data

Channel Workflow Studio’s use of information received from Google APIs, and its transfer to other apps, adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google user data is used only for the upload, livestream-management, channel-query and reporting features that the owner explicitly enables and that are visible in the tool. Necessary transfers must serve those features and the user’s consent. Data is not sold, used for ad targeting, transferred to data brokers or used to assess creditworthiness. Operator access is limited to specifically approved support, necessary security work, legal obligations or other cases permitted by the policy.

The operator does not use, or permit service providers to use, this Google user data or derived data to train, fine-tune or improve general-purpose AI or machine-learning models. Before involving a third-party assistant such as Codex, its actual service settings and data-handling arrangements must be checked against the same restrictions. Until that check is complete, do not provide Google user data or derived data to the assistant. The absence of built-in AI calls does not verify an external assistant’s data practices.

Authorization and recipients

You decide whether to grant access on Google’s authorization screen. Uploading videos with their metadata uses the relevant YouTube permission; channel reads, Analytics and estimated revenue request their applicable read-only or monetary-data permissions. A scope grant does not authorize arbitrary actions: the specific task still needs approval.

For approved operations, the local program communicates with Google OAuth and YouTube API services, sending necessary authorization material, media, metadata, query parameters and control requests. Data therefore does not always stay on the computer. If an explicit proxy is configured, requests pass through that proxy; its visibility depends on its configuration and the transport used.

This version has no cloud sync center, cross-device authorization sync or remote streaming-process management. Optional encoder handoff is limited to a receiving device explicitly configured and verified by the owner; its data scope and deletion responsibilities are described below. It is not enabled by default, and local state is not automatically uploaded to the operator.

Scopes follow the local authorization purpose: the default upload-localizations requests youtube.force-ssl, which covers video uploads, metadata changes and broadcast management; insights requests youtube.readonly; analytics adds yt-analytics.readonly to channel read access, and revenue also adds yt-analytics-monetary.readonly. For uploads, broadcast management, channel reads, analytics and estimated revenue in one authorization, explicitly select full-workflow, which requests these four scopes together. The old standalone upload authorization purpose is disabled; youtube.upload is no longer requested in addition. This does not replace or revoke existing grants. Reporting requires the applicable analytics read grant. As of November 8, 2026, the current code requests and the saved Google Cloud declarations are aligned to these four scopes; the app remains in testing mode. The designated test channel’s previously granted four full-workflow scopes have been verified. Review the names on Google’s authorization screen: declaration or a request does not mean permission has been granted.

Optional encoder handoff

The handoff module is implemented and has passed offline tests; real SSH transfer and streaming validation are pending. Transfer occurs only after the owner explicitly configures the receiving host, account, port, dedicated SSH key and verified host key, then approves this specific plan. There is no default device or inherited server configuration from another tool.

The specified receiving device gets the approved video and encoder-private.json, which contains channel/broadcast identifiers, ingest addresses and stream keys. A manifest and receipt include task/device information, media hashes and some local paths. OAuth tokens, OAuth client secrets and SSH private keys are not sent to the receiving device. Transfer uses SSH with host-identity verification; this is not a promise of encryption at rest on that device.

Received files are stored under /home/USER/channel-workflow-studio-encoder/PROFILE/TASK/ (uppercase segments are configured values). Directory and file permissions restrict access, but the device account holder and administrators may still read them. The recipient is responsible for keeping and deleting the video, private configuration, manifest and receipt. The tool does not provide scheduled remote cleanup, remote deletion, deployment, process start/stop or streaming management.

Locally, credentials/encoder/ stores the explicitly configured device profile, SSH private key and host-key file. .cws-state/encoder-transfer-intents/ stores task digests and handoff status. Temporary transfer files are cleaned up on normal exit; check for remnants after an abnormal interruption. Ingest data in the original broadcast record follows the task-cleanup rules. Local cleanup does not erase remote copies.

Storage and retention

Within the dedicated installation, credentials/ holds this tool’s OAuth client configuration and account credentials. .cws-state/ holds its task, privacy, authorization and control records. Original media stays at the location selected by the owner; this website does not receive it.

Queries and insights cache is stored in .cws-state/insights-cache/, isolated by project, client, grant and channel, with a maximum 30-day read-validity period. data-retention-check inspects all cache partitions offline; cache-expired-purge actually deletes cache past its retention period, without network requests or separate channel sign-ins. Reporting downloads do not automatically save the raw CSV; you choose whether to save returned results.

Cache cleanup runs only when explicitly invoked, with no background timer. Expired files are not guaranteed to be deleted while the computer is asleep, off or the command is not run. This command does not remove task records, credentials, owner-created report exports, saved files, email attachments, system backups or remote copies.

The candidate version adds retention-audit, an offline inventory of this installation’s cache, tasks and control records. It reports categories, counts, calculable deadlines and items requiring review; it does not read credential contents or call Google. Deadlines use original collection or creation times, not file modification times. Unknown or anomalous timestamps cannot be reported as compliant. Credentials, minimal safety summaries and unclassified files still need separate review; a control record is not an exemption for indefinite retention.

deletion-request-plan, deletion-request-register and deletion-request-check record and inspect a whole-installation deletion request. Registration preserves the first locally recorded request’s seven-day deadline. An earlier request received by email or another channel requires a separately tracked earlier deadline based on its actual receipt. Registration does not delete data, revoke access, stop tasks or prove deletion; actual retirement still requires separate scope review and confirmation. Managed-data erasure and external-copy status are separate. A request record disappearing during retirement is not evidence that every copy was erased.

Terminal-task cleanup retains a minimal duplicate-prevention summary and cannot delete unfinished or unknown-result tasks. To remove data held by the entire installation, use the retirement process below, which also permanently disables that installation. Retirement, cross-partition cache cleanup and invalid-grant blocking have passed offline tests; deletion with a real account has not been executed or validated.

Required retention and deletion timelines: Under the YouTube Developer Policies, a direct deletion request or revocation through the tool requires deletion of related data as soon as possible and within 7 calendar days. After revocation through Google’s security settings, related data must be deleted as soon as possible and no later than 30 calendar days after revocation, with periodic checks that authorization remains valid. Except for applicable authorization tokens and qualifying authorized statistics, Analytics and Reporting data, other authorized API data and temporarily stored non-authorized API data must be deleted or refreshed within 30 days. Authorized analytics, reports or statistics retained longer still require authorization and relevant resource-status checks every 30 days.

These are requirements to fulfill, not a claim of complete deadline enforcement. The tool does not poll Google on a timer to discover revocation. Exports, backups, remote copies and handling while a device is not running still require review. Complete deadline enforcement, external copies and real-account validation remain pending; this development edition is not a verified long-term archive.

Revoke access and delete data

You can revoke access at any time through Google Account connected-app settings. Locate the connection for Channel Workflow Studio and verify its name and account. Revoking that grant affects access that relies on it.

The tool provides plan-first, confirmation-based revocation and local deletion flows. Revocation disables future local access and attempts Google revocation; it does not automatically erase every credential file, task, export or backup. Google revocation may affect this user’s scopes and related OAuth clients across the project, beyond one channel. Acknowledgment does not mean propagation is immediate. Deleting local data does not automatically delete content on YouTube.

Retire the entire installation: retire-plan displays the scope before owner-confirmed retire execution. It deletes managed data in this installation’s .cws-state/ and credentials/ offline, including account credentials, tasks, cache and local encoder SSH keys. Only a constant retirement marker containing no channel, task or hash information, and empty lock files, remain. The installation is permanently disabled and cannot be reinitialized or used to take over old tasks.

Retirement can also erase local records of active or unknown-result tasks, but removes the ability to recover or continue those tasks from this installation. Close any old-version local worker processes before execution; this does not call for stopping or restarting a VPS. Retirement does not revoke Google access, end remote livestreams, delete online content, original media outside the managed directories or external copies. If revocation is required, perform it before removing credentials, or use Google Account settings afterward.

When an actual OAuth request returns invalid_grant, the tool blocks subsequent use of that grant to avoid repeated invalid requests. The error does not prove that a channel was deleted or that access was revoked. The tool does not automatically delete channels, reauthorize or poll in the background to keep checking.

See revocation and deletion steps on the support page. If you cannot access a device, need help locating remaining copies or want operator-held correspondence deleted, email xiaotao5490@gmail.com. The operator will confirm the scope and result, and will not claim complete deletion without access to the relevant device or backup.

Security and limitations

The local implementation restricts file permissions for credentials and state, and binds tasks to a dedicated project, account and local state. Sensitive values should not appear on public pages, in chats or in general diagnostic material. Filesystem and permission behavior on Windows / WSL2 still needs verification on the target device.

File-permission restrictions are not encryption at rest. This version does not promise system-keychain storage, encrypted credentials, remote erasure, automatic backup cleanup or cross-device duplicate prevention. Protect the operating-system account, disk and backups, and keep credentials and state out of public repositories and shared sync folders.

Updates and requests

This notice and local disclosures will be updated when features, data recipients or permission scopes change, with renewed explicit consent where needed. The update date identifies this version; it is not evidence of Google review, production deployment or legal certification.

For access, correction, deletion, revocation or privacy questions, contact xiaotao5490@gmail.com. Include the application, account or channel identifier and the scope of your request, without passwords or keys.