Privacy Policy

Last updated: October 14, 2026

PersisTask ("PersisTask," "we," "us") is operated by SaintClair LLC. This policy explains what information we collect through persistask.com and the PersisTask app, how we use it, and how you can access, control, or delete it.

1. Information we collect

a) Account information (persistask.com)

When you register, we collect your email address and a password. Your password is never stored in plain text — we store only a one-way bcrypt hash of it, which cannot be reversed back into your original password. We also store internal account state: whether your subscription is active, an internal key used to authenticate with our server, and (only while a password-reset is in progress) a temporary, expiring reset token.

b) Billing information (Stripe)

Payment is handled entirely by Stripe. We never receive, process, or store your card number or other payment details — checkout happens on Stripe's own secure page. We store your email (shared with Stripe to create your customer record) and Stripe's own identifiers for your customer and subscription records, along with your subscription status and renewal date, so we know whether you have active access.

c) YouTube data (via Google OAuth)

If you connect your YouTube channel, we request exactly one Google permission: full access to manage your YouTube account (https://www.googleapis.com/auth/youtube). We do not request your Google email, name, or profile — only YouTube access.

We store your OAuth access token and refresh token, encrypted at rest, so the app can act on your channel between visits without asking you to sign in to Google every time.

Through the YouTube API, and only when you ask us to take an action, we access and record: your channel ID, video IDs, video titles, video privacy status (private/public/scheduled), and the publish time you set. We log each action we take — upload, schedule, visibility change — together with whether it succeeded, so you have a record of what PersisTask did to your channel and so we can avoid uploading a duplicate copy of a file you've already uploaded.

PersisTask uses YouTube API Services. By connecting your YouTube account, you also agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (http://www.google.com/policies/privacy).

2. Service providers we use

We rely on a small number of other companies to run PersisTask. Each only receives the specific information it needs to do its job:

• Amazon Web Services (AWS) — hosts our servers and databases. All data described in this policy is stored and processed on AWS infrastructure located in the United States.
• Stripe — processes payments. Stripe receives your email address and your payment details directly (we never see or store your card number).
• Google Workspace — sends transactional email on our behalf, including password-reset emails. It receives your email address and the content of the message we send you.

We do not use any service provider to serve ads or to sell or share your data for marketing purposes.

3. What we don't do

We do not sell your data. We do not share it with advertisers, data brokers, or information resellers. We do not use YouTube data to serve ads or for any purpose unrelated to the features described above. We do not place tracking cookies tied to your YouTube data. persistask.com uses a session cookie only to keep you signed in. It is not used for tracking or advertising. No PersisTask employee accesses your data except when needed to fix a bug you've reported, investigate a security issue, or comply with the law.

4. How we use your information

Solely to operate the features you use: authenticating you, billing your subscription, and carrying out the YouTube actions you explicitly request (upload, schedule, change visibility). We never take an action on your channel that you didn't ask for.

PersisTask's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Where your data is stored

Account and billing records are stored in our database on our server. YouTube OAuth tokens are stored encrypted at rest (AWS Systems Manager Parameter Store, KMS-encrypted). All of the above is hosted on servers in the United States.

6. How we protect your data

We use the following safeguards to protect your information, including the Google user data you allow PersisTask to access.

Encryption in transit

All traffic to persistask.com and app.persistask.com is encrypted with HTTPS, using TLS 1.2 and TLS 1.3 only; older, weaker versions are refused. Plain HTTP requests are redirected to HTTPS, and both sites use HSTS so your browser always connects over HTTPS. Video uploads travel over HTTPS directly from your browser to YouTube.

Google tokens encrypted at rest

Your Google OAuth access and refresh tokens are stored encrypted in AWS Systems Manager Parameter Store, using AWS Key Management Service (KMS) encryption. They are used only on our servers, to carry out the actions you request, and are never sent to your browser.

Data minimization

Your videos upload directly from your browser to YouTube and never pass through our servers. For YouTube, we keep only the encrypted token and a short action log of what you asked PersisTask to do: the video ID, channel ID, video title, the file name and size of uploads, what changed (for example, privacy status or publish time), and when.

Access controls

• Our servers can be reached from the internet only through HTTPS and key-based SSH (password logins are disabled), behind a firewall that blocks everything else.
• Internal application services are not exposed to the internet.
• Access to the PersisTask app (app.persistask.com) is password-protected.
• On our servers, files that contain secrets or user data can be read only by the service that needs them, and server backups only by the system administrator.
• Our cloud administrator account is protected with multi-factor authentication.
• Access to the systems that store user data is limited to the company's owner and founder.

Retention and deletion

• YouTube data in our action log is refreshed or deleted within 30 days by an automated job that runs every day.
• Server logs that record visits to our sites and use of the app are kept no longer than 30 days.
• We do not log Google OAuth authorization codes.
• "Disconnect" revokes PersisTask's access with Google and deletes the stored token.
• Email support@persistask.com and we will delete your YouTube data within 7 days of a verified request.
• You can revoke PersisTask's access at any time at https://myaccount.google.com/permissions.

If we add staff or contractors

If we add staff or contractors, their access will be limited to what their role requires, they will be bound by confidentiality obligations, and we will update this policy and notify users before that change takes effect.

What we never do with your YouTube data

We never sell it, never use it for advertising, never use it to train AI, and never send it to analytics services. PersisTask's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. How long we keep your data

• YouTube API data (your OAuth token, and the video/channel information described in 1(c)): kept only as long as needed for the features above, and never longer than 30 days without either deleting it or re- verifying it's still accurate — after which point we delete or refresh it.
• Account and billing information: kept for as long as your account is active, or until you ask us to delete it.

8. Revoking access and deleting your data

• Disconnecting YouTube: the "Disconnect" button in the app immediately deletes our stored copy of your token AND revokes PersisTask's access on Google's side, so PersisTask no longer appears as a connected app in your Google Account. You can also revoke access directly, at any time, from Google's own permissions page: https://myaccount.google.com/permissions
• Deleting your data: email support@persistask.com to request deletion. We will delete YouTube-API-derived data (your token and the records described in 1(c)) within 7 days of a verified request, and your persistask.com account data (email, password, billing records) within 30 days. Deleting data we hold does not affect anything stored by YouTube itself — to remove content from YouTube, use YouTube directly.
• Self-serve deletion from within the app isn't available yet — email is the only path today. We plan to add self-serve deletion alongside a broader account system.

9. Children's privacy and eligibility

PersisTask is not directed to children under 13, and we do not knowingly collect information from them. You must be 18 years or older, or the age of majority in your jurisdiction, to create a PersisTask account.

10. Changes to this policy

If we start using your data in a way not described here, we'll update this policy and ask for your renewed consent before doing so.

11. Contact

Questions or requests: support@persistask.com