Privacy Policy

DragQueue is a tool for managing YouTube playlists you own. To work, it asks Google for permission to read and edit playlists on your behalf and then calls the YouTube Data API. This policy explains what information DragQueue collects, why, and how to remove it.

DragQueue is operated independently. The service does not sell user data, does not run advertising, and does not use your data to train machine-learning models.

When you sign in with Google, DragQueue receives and stores the following information from your Google account:

• Your name, email address, profile image URL, and Google account ID.
• OAuth access and refresh tokens scoped to https://www.googleapis.com/auth/youtube, along with the token expiration timestamp. These tokens let DragQueue call YouTube on your behalf for the actions you take in the app.

DragQueue also stores operational records tied to your account:

• A daily count of YouTube API quota units your activity has consumed, tagged by source (shared quota vs. your own API key).
• A short rolling window of per-minute write counts, used for rate limiting.
• A session cookie used to keep you signed in.

If you choose to bring your own YouTube API key, DragQueue additionally stores the Google OAuth Client ID and Client Secret you supply, plus the OAuth tokens issued by your own Google Cloud project. The Client Secret and tokens are encrypted at rest.

DragQueue does not store the contents of your playlists, video metadata, comments, watch history, or any other YouTube data beyond what is needed to render a request in flight. Playlist data is fetched live from YouTube each time you open it, with short-lived in-memory caching of up to 60 seconds.

DragQueue uses the information above only to:

• Authenticate you and keep you signed in.
• Call the YouTube Data API to display, reorder, add, move, and delete items in playlists you own.
• Show your current daily quota usage on the Settings page.
• Apply per-user rate limits to prevent abuse of the shared YouTube API quota.
• Diagnose errors in server logs (which may temporarily include your user ID and request metadata).

DragQueue does not use your information for advertising, profiling, analytics that identify you to third parties, or training any AI/ML system.

DragQueue uses YouTube API Services. By using DragQueue, you also agree to the YouTube Terms of Service. Information collected and used by Google is described in the Google Privacy Policy.

DragQueue's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can review and revoke DragQueue's access to your Google account at any time at myaccount.google.com/permissions.

OAuth access and refresh tokens are stored in DragQueue's database and are only used from server-side code. They are never sent to your browser and never exposed to client JavaScript. Tokens are used solely to call the YouTube Data API on your behalf in response to actions you take inside DragQueue.

When you sign out or disconnect, DragQueue stops using your tokens. When you delete your account, your tokens are removed from the database (see “Retention and deletion” below).

Your data is accessible to:

• DragQueue's infrastructure— the application servers and managed Postgres database hosted on Railway (railway.com), used solely to operate the service.
• Google / YouTube— when DragQueue calls the YouTube Data API on your behalf, requests are sent to Google's servers using your OAuth tokens.

DragQueue does not sell your data and does not share it with third-party advertisers, data brokers, or analytics providers that identify you individually.

You can sign out at any time from the Settings page. To revoke DragQueue's access to your Google account, visit myaccount.google.com/permissions and remove DragQueue.

To delete your DragQueue account and the data associated with it — including your stored OAuth tokens, BYOK credentials, quota logs, and rate-limit records — email parker@qiv.ai from the email address tied to your account. Deletion is processed manually and is typically completed within seven days.

Quota logs and rate-limit windows older than 30 days may be purged automatically as part of routine maintenance.

Payments are processed by Lemon Squeezy, who acts as our Merchant of Record. When you purchase Pro, Lemon Squeezy receives your name, email, and payment details to process the transaction and handle global sales tax obligations. DragQueue stores only the order ID, the email at time of purchase, and the amount paid — never your card number or billing address.

DragQueue uses TLS in transit and encrypts sensitive secrets (BYOK Client Secrets) at rest. No system is perfectly secure; please report suspected vulnerabilities to parker@qiv.ai.

DragQueue is not directed to children under 13, and DragQueue does not knowingly collect information from anyone under 13. If you believe a child has provided information to DragQueue, contact parker@qiv.ai and the account will be removed.

DragQueue may update this policy from time to time. Material changes will be reflected on this page along with an updated “Updated” date. Continuing to use DragQueue after a change constitutes acceptance of the revised policy.

Questions, deletion requests, and other privacy matters: email parker@qiv.ai.