Privacy policy
Version 2, November 2026.
Who is responsible
Espen Flaglien, Norway, is the data controller for this website and for the two apps described below. In this policy, "we" and "the owner" both mean the controller. Contact: contact@earthactually.com.
Visiting this website
The pages themselves collect nothing. They use no cookies, analytics, forms, accounts or scripts of our own, and nothing is loaded from other websites.
The site is hosted by Cloudflare, Inc. When your browser asks for a page, Cloudflare's systems receive your IP address and technical details of the request, such as the page asked for, the time and your browser type. Cloudflare uses this data to deliver the pages and to protect the site from abuse. Its privacy policy says that it acts as a data processor for its customers' logs, and that it also collects network data of its own to detect and block malicious activity. Our legal basis is our legitimate interest in running a working, safe website (GDPR Article 6(1)(f)).
We have set no fixed period for this data. We do not download or keep these records. Cloudflare's privacy policy gives no fixed period either, and says it keeps personal information for as long as its business purposes and legal obligations require. Cloudflare's dashboard may show us traffic totals, and details of requests it has blocked, including IP addresses.
Cloudflare says that it primarily stores information in the United States and the EEA. For transfers from the EEA to the United States it says it relies on its EU-U.S. Data Privacy Framework certification, or on standard contractual clauses if that lapses. You can read more in Cloudflare's privacy policy.
We do not use Cloudflare's visitor analytics, its email-address script or its bot-detection cookies. If Cloudflare's security systems ever challenge a visit, they may set a short-lived cookie to remember that the challenge was passed. We do not use it.
If you email us
Your address and your message reach a private mailbox at an email provider, and we use them only to answer you. Mail sent to an address on this domain passes through Cloudflare's email forwarding on the way. We keep a message only as long as we need it to deal with what you wrote about, or to deal with a legal claim. Our legal basis is our legitimate interest in answering you (GDPR Article 6(1)(f)).
The analytics app
What it is
Earth Actually analytics is a private command-line tool that runs on the owner's own computer. It uses YouTube API Services: the YouTube Data API and the YouTube Analytics API. It is not offered to the public. Only the owner connects it, and only to channels the owner runs.
What it can do
It asks Google for two read-only permissions: youtube.readonly ("View your YouTube account") and yt-analytics.readonly ("View YouTube Analytics reports for your YouTube content"). With these permissions it cannot upload, edit or delete anything. Google has not verified the app's use of these permissions, so Google's consent screen shows a warning.
What it reads
- The channel's public details, such as its name, handle, ID and description.
- The list of the channel's videos, including private and scheduled ones, with their titles, descriptions, tags, publishing times, lengths, settings and basic counters.
- Statistics for the channel and its videos: views, engaged views, watch time, retention, likes, shares, comment counts and subscriber changes, by day, with totals by country and by traffic source.
These statistics are totals. They do not identify any viewer. The app does not read the text of comments, only how many there are.
Why
So that the owner can see how the videos perform and decide what to make next. The owner's permission on Google's consent screen is what lets the app read this data. The app is not used for advertising, and the data is not passed to advertisers or data brokers.
Where it is kept
The permission token is kept in the macOS Keychain on the owner's computer. The data is kept in local files on that computer and is never added to a code repository.
Who can see it
Only the owner. No one else is given access. Figures from the YouTube API are never combined with figures from other platforms into one number.
How long it is kept
- Statistics are kept only while the app is in use and its permission stands. While any are kept, we confirm at least every 30 days that the permission is still in place and that the videos still exist.
- Everything else, such as titles and descriptions, is refreshed or deleted within 30 days.
- If the person who gave the app access asks us to delete their data, it is deleted within 7 days. If access is removed on Google's page, or the permission can no longer be renewed, the data is deleted within 30 days.
Your control
Anyone who has given the app access can remove it at any time on Google's security settings page: security.google.com/settings/security/permissions. This comes in addition to the deletion described above. Questions and complaints go to contact@earthactually.com.
Google and YouTube
By using the app, users agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. The app's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Cookies and devices
The app stores data only on the owner's computer. It places no cookies, and no third party serves content or advertisements through it.
The publisher
What it is
Earth Actually publisher is a private tool made to run on the owner's own computer, under a system account of its own. It uploads videos the owner has approved to YouTube channels and Facebook Pages the owner runs, at the times the owner has chosen. It is not offered to the public. Only the owner connects it, and only to channels and Pages the owner runs. On YouTube it uses YouTube API Services: the YouTube Data API. On Facebook it uses a separate Meta app, which serves only Pages the owner runs.
What it can do
On YouTube it asks Google for two permissions: youtube.upload ("Manage your YouTube videos") and youtube.readonly ("View your YouTube account"). On Facebook it asks for three Page permissions: pages_show_list, pages_read_engagement and pages_manage_posts. Facebook also gives every app the basic public_profile permission.
These permissions would allow more than the publisher does, such as editing or deleting a Page's posts. The publisher has no function that changes or deletes a video or a post once it is uploaded, and it reads only what is listed below. Google has not verified the publisher's use of these permissions, so Google's consent screen shows a warning.
What it sends and reads
- It sends each approved video to its channel or Page, with exactly the title or caption, description, settings and publishing time the owner approved.
- It reads the ID of the channel or Page it is about to upload to, and on Facebook the Page's name, to make sure it is the right one.
- It reads the list of videos already on that channel or Page, with details such as their IDs, titles, descriptions or captions, status and times, to avoid uploading the same video twice.
- It reads the details of each video it has uploaded, such as its ID, title, description or caption, settings, status, publishing time and link, to confirm that the video arrived and went public as approved.
- It reads the details of its own permissions, such as which app, account, channel or Page they belong to, which permissions they hold, whether they are still valid and when they end, to check them before they are used.
It reads no statistics and no comments. It keeps no token for the owner's personal Facebook account.
Why
So that each approved video goes out on time and exactly as approved, without duplicates, and so that the owner learns if one did not. The owner's permission on Google's consent screen and on Facebook's login screen is what lets the publisher do this. The publisher is not used for advertising, and the data is not passed to advertisers or data brokers.
Where it is kept
The permission tokens and the publisher's records are kept in files on the owner's computer that only the publisher's own system account, or an administrator, can read. A short status file, which the owner's other tools on that computer read, holds only the publisher's own codes, references, hashes and times, the approved publishing times, and the dates of each permission. It holds no title, description, caption or statistic, and no ID or time that YouTube or Facebook returned about a video or a post. Neither the tokens nor anything YouTube or Facebook returns is ever added to a code repository.
Who can see it
Only the owner. No one else is given access. The videos and their texts become public on YouTube and Facebook at their approved times, as the owner intends.
How long it is kept
- The permission tokens are kept while the owner uses the publisher and the permission stands.
- What YouTube or Facebook returns about a video, such as its ID, title, description or caption, settings, status and times, is kept only to confirm that video and to avoid duplicates. It is refreshed or deleted within 30 days.
- The publisher's own record of each approved upload, which holds nothing that YouTube or Facebook returned, is kept for as long as the owner needs a record of what was published.
- If the person who gave the publisher access asks us to delete their data, it is deleted within 7 days. If access is removed on Google's or Facebook's own pages, or a permission can no longer be renewed, the data is deleted within 30 days.
Your control, and how to have data deleted
Anyone who has given the publisher access can remove it at any time: on Google's security settings page, security.google.com/settings/security/permissions, and on Facebook, in Settings under Business integrations. This comes in addition to the deletion described above. To have your data deleted, or with questions and complaints, write to contact@earthactually.com.
Google and YouTube
By using the publisher, users agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. The publisher's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Cookies and devices
The publisher keeps its data on the owner's computer. It places no cookies, and no third party serves content or advertisements through it.
Your rights
You can ask us for access to data about you, and ask us to correct or delete it. You can also ask us to restrict how it is used, or ask for a copy of it. Write to contact@earthactually.com.
You have the right to object to any use of your data that rests on our legitimate interest.
We make no automated decisions about you that have legal or similarly significant effects, and we do no profiling. You can complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.
Changes
If we change this policy, we will update this page and its version and date. If either app were ever to use data in a way this policy does not cover, anyone who had given it access would be asked to accept the new policy first.