1. Who operates this service
The public website at https://watchthecow.com and the Factory at https://factory.watchthecow.com are operated by a private individual in Thailand, under the name The Curious Cow.
Privacy questions: mailversand.thailand@gmail.com.
Still needs confirmation: the operator’s full legal name and a postal or business contact address. Those have not been provided, so they are not stated here.
2. What this policy covers
This policy covers the public website and the private Factory used to produce videos and, when authorized, upload them to YouTube.
The Factory uses YouTube API Services. Google’s practices for those services are described in the Google Privacy Policy.
The Factory is owner-operated only. It is not a public SaaS product and does not offer public sign-up. Access is limited to the owner (HTTP basic authentication on the Factory hostname). English and German YouTube channels are supported today. Additional language channels are planned and are not treated as already available.
3. Public website: what is collected
The public site is static HTML. It has no user accounts, contact form, or comments.
When you load the site, the web server can record ordinary HTTP request data (for example IP address, date and time, requested path, and browser user-agent) in server access logs.
Still needs confirmation: how long production nginx or system logs are kept, who can read them, and whether any CDN, WAF, or uptime monitor sits in front of the site.
4. Analytics, cookies, and external services
The operator has stated that Google Analytics is used. Inspection of the live public website, the Factory UI, and this site’s source on 27 September 2026 found no Google Analytics, Google Tag Manager, or measurement-ID snippet, and no analytics cookie-consent banner. Until such a snippet is installed, this website does not itself set Google Analytics cookies, and this policy does not claim that Google Analytics tracking is already occurring here.
Inspected first-party scripts do not set cookies. The pages load web fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser therefore makes requests to Google when loading those fonts. Google may process IP address and request metadata under the Google Privacy Policy.
The homepage links to The Curious Cow YouTube channel. Following that link is a visit to YouTube.
Still needs confirmation before Google Analytics is added to this site: the Google Analytics measurement ID, what hits are collected, cookie lifetime, whether ads features are on, and whether a consent banner is required for visitors (including under Thai PDPA). Do not treat analytics as active on watchthecow.com until that snippet exists.
5. How the Factory connects to Google and YouTube
The Factory connects a language channel to YouTube with Google OAuth 2.0 (authorization code, offline access, consent prompt). The owner starts Connect YouTube in the Factory. Google then shows Google’s consent screen. The Factory does not ask for, store, or proxy YouTube usernames or passwords.
After consent, Google returns an authorization code to https://factory.watchthecow.com/api/youtube/callback. The Factory exchanges that code for an access token and a refresh token.
6. OAuth permissions requested, and why
The Factory currently requests these YouTube Data API scopes:
https://www.googleapis.com/auth/youtube.upload— upload videos, captions, and thumbnails to the connected channel, and set upload metadata (title, description, tags, category, language, privacy).https://www.googleapis.com/auth/youtube.readonly— read the connected channel identity (channel id, title, uploads playlist) so uploads go to the intended channel.https://www.googleapis.com/auth/youtube.force-ssl— required for HTTPS YouTube Data API calls after connect, including reading and updating video language metadata and listing caption tracks.
Public publishing is disabled in software. Uploads are refused unless privacy is private or unlisted. The automated daily publishing scheduler is not running.
You can review and revoke apps connected to your Google Account at Google’s account permissions page.
7. YouTube account and channel information accessed
After connect, the Factory calls YouTube channels.list with mine=true and stores the YouTube channel id, channel title, connection timestamps, token expiry time, and a credentials reference pointing at the locally stored token file (not the raw token in the database).
When uploading or auditing language metadata, the Factory may also read video ids, snippets (title, description, tags, category, default language), caption track lists, and channel branding default language — only for the authorized channel.
The Factory does not request Google profile email as a separate OAuth scope.
8. How OAuth tokens and YouTube API data are stored and protected
- OAuth access and refresh tokens are stored as encrypted JSON files (AES-256-GCM) under the Factory data directory, not on the public website.
- The Factory is served only to the owner behind HTTP basic authentication, except the OAuth callback and health-check paths that Google or monitors must reach.
- Tokens are sent to Google over HTTPS.
Still needs confirmation: backup copies of Factory data (if any), who has SSH or disk access, and how long backups of token files or the SQLite database are kept.
9. How the data is used for uploading and managing videos
Stored tokens are used only to call YouTube API Services for the connected Factory language channel, currently to:
- upload a rendered Factory video as a private (or unlisted) YouTube video;
- send title, description, tags, category, default language, and captions prepared in the Factory;
- optionally set a thumbnail;
- confirm the connected channel id matches the intended Factory channel;
- read and, if the owner runs a language audit, update default language metadata on videos the Factory uploaded;
- periodically reconfirm that authorization is still valid and refresh or delete stored YouTube API data at least every 30 days.
YouTube video ids and watch URLs returned by the API are stored so the owner can open the uploaded video. Disconnecting the Factory from Google does not delete videos already hosted on YouTube. Those remain on the YouTube channel until removed in YouTube Studio or another YouTube application.
10. Sharing with service providers
The current implementation sends data to these processors as part of running the Factory or the public site:
- Google / YouTube — OAuth and YouTube Data API (tokens, channel identity, upload bytes and metadata).
- Google Fonts — font files for the public site and Factory UI.
- OpenAI — script and related text generation from owner topics and prompts. Not used to store Google passwords.
- fal.ai — image generation for Factory visuals.
- ElevenLabs — voice audio for Factory narrations.
Inspected code does not sell personal data, run advertising networks, or share YouTube OAuth tokens with those content-generation providers.
Still needs confirmation: written processor terms for OpenAI, fal.ai, and ElevenLabs, and whether any additional backup, email, error-reporting, or CDN vendor is used outside this application.
11. How to disconnect a Google / YouTube account
In the Factory Channels screen, use Disconnect. That action programmatically revokes the OAuth token with Google, deletes the locally stored token file, and deletes stored YouTube API data for that connection (channel id and title, video ids and YouTube URLs, and related API statistic fields).
Factory project files (scripts, images, audio, rendered videos) are kept unless the owner separately deletes that project. Videos already on YouTube are not deleted by Disconnect.
You can also revoke Factory access at Google account permissions. After Google-side revocation, the Factory deletes stored YouTube API data when it next finds that the refresh token is no longer valid, and through a periodic stored-data check that runs at least every 30 days.
12. How to request deletion of stored data
Email mailversand.thailand@gmail.com. The owner can also use Disconnect in the Factory, delete a Factory project to remove local production files, or delete or unlist videos in YouTube Studio. The Factory disconnect path does not delete YouTube-hosted videos.
YouTube API Services Developer Policies require stored API data related to a revoked authorization to be deleted as soon as possible (within 7 days for in-app revocation; within 30 days when revocation is detected after a Google-side revoke). The Factory disconnect path performs that deletion immediately.
13. How long data is retained
- OAuth tokens: kept while the channel stays connected, then deleted on Disconnect or when Google reports the token is invalid.
- YouTube API data (channel ids, video ids, YouTube URLs, API statistic fields): refreshed or deleted at least every 30 days while connected; deleted on Disconnect or when authorization is no longer valid.
- Factory production files and SQLite records (scripts, renders, local titles): kept until the owner deletes the project or database. No automatic purge job for those owner-created files is in place.
Still needs confirmation: retention period for Factory production files, server logs, and backups.
14. How to contact the operator
mailversand.thailand@gmail.com
Google / YouTube privacy: https://www.google.com/policies/privacy
Google account permissions: https://security.google.com/settings/security/permissions
Still needs confirmation: full legal name and postal address for formal notices.
15. Changes
If YouTube data use, analytics, or Factory access changes, this policy should be updated before those changes are enabled. This page is not a substitute for legal advice.