Privacy Policy

Effective date: 23 October 2026

This Privacy Policy explains how YouTube MCP (“the app”), an open-source MCP server published at github.com/dev-dreyer/youtube-mcp, accesses, uses, stores and shares Google user data. The app uses YouTube API Services (the YouTube Data API v3).

1. Google data the app accesses

With your permission, the app requests one Google OAuth scope:

• https://www.googleapis.com/auth/youtube (Manage your YouTube account)

It uses this access only to carry out actions you ask for on your own YouTube account:

• list, add (subscribe) and remove (unsubscribe) your subscriptions;
• list, create, update (title, description, privacy setting) and delete your playlists;
• list, add and remove playlist items (videos in your playlists);
• read your own channel details, liked videos list and uploads list;
• search public YouTube videos, channels and playlists, and look up public channel details.

The app does not upload, edit or delete videos, and does not read or post comments.

2. How data is used

Data returned by the YouTube Data API is passed straight back to the AI assistant (MCP client) that you run and connect the app to, so the assistant can show it to you or complete the task you asked for. It is used for nothing else: no advertising, no profiling, no analytics and no training of AI models by the developer.

Note: the AI assistant you choose to connect is separate software. What that assistant (and any AI model provider behind it) does with the results is governed by that assistant's own terms and privacy policy.

3. Where data is stored

• OAuth tokens are stored only locally on your own computer, in a file readable only by your user account: by default ~/.config/youtube-mcp/tokens.json (or $XDG_CONFIG_HOME/youtube-mcp/tokens.json, or a path you set with YOUTUBE_MCP_TOKEN_PATH).
• Your own Google OAuth client ID and secret stay in a local .env file or environment variables that you control.
• YouTube data (subscriptions, playlists and so on) is not saved to disk by the app. It is held in memory only while a request is being handled. A simple count of API quota units used is kept in memory and discarded when the server stops.

4. Sharing and transfer

The app has no backend. It connects only to Google (the Google OAuth endpoints and the YouTube Data API at googleapis.com) and, during the one-time sign-in, to a temporary local address on your own machine (127.0.0.1) to receive the sign-in result.

• No data is collected by the developer or sent to any developer server.
• No data is sold, rented or shared with third parties, advertisers or data brokers.
• The app uses no cookies, analytics or tracking.

5. Google API Services User Data Policy

YouTube MCP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google's handling of your data is described in the Google Privacy Policy.

6. Revoking access and deleting data

• Revoke the app's access to your Google account at any time at myaccount.google.com/permissions (Google security settings, also reachable at security.google.com/settings/security/permissions).
• Delete the locally stored token by removing the tokens.json file described above, or simply uninstall the app. Because nothing is stored anywhere else, this removes all data the app holds.
• Deleting the local token does not change anything on YouTube itself. To change your subscriptions or playlists, use YouTube or this app.

7. Children

The app is a developer tool and is not directed at children.

8. Changes

If the way the app uses Google user data changes, this page will be updated and the effective date above will change. Material changes will also be noted in the project's changelog on GitHub.

9. Contact

Questions or complaints about this policy or the app's privacy practices: spacegeneralx@gmail.com.