Privacy Policy — Govrl.io
Last updated: September 2026
1. Who we are
Govrl.io (“we”, “the Service”) provides a YouTube research browser extension and a companion web app that help creators discover viral videos, outlier performance, similar channels and AI channel analysis.
2. What data we collect
- Public video/channel data shown on the page you are viewing (views, titles, thumbnails) — read to compute Outlier/VPH on-screen.
- A random device ID stored on your device to apply free-trial usage limits. It is not linked to your identity.
- A device mark for the invite campaign — a one-way hash, computed and stored on our server, used only to check that one device claims the 14-day trial once. See section 7b for exactly what goes into it.
- Items you explicitly save (bookmarked videos) — only if you opt in by entering a Sync Code, so they appear in your web account.
- Account email — only on the web app, if you create an account (via Supabase Auth).
3. What we do NOT collect
- We do not collect or sell your browsing history.
- We do not track the pages you visit beyond the feature you actively use on that page.
- Your AI key (if you connect one) is stored on your device and is never read or stored by us.
4. How we use data
Data is used solely to provide the user-facing features you request (outlier scoring, similar channels, channel analysis, saved bookmarks). We do not use it for advertising or profiling.
5. Sharing & processors
We use trusted processors only to run the Service: Vercel (hosting), Supabase (database/auth), and the AI provider you connect (e.g. Google Gemini) for analysis you trigger. We do not sell data to third parties.
6. YouTube API Services
Govrl.io uses
YouTube API Services to read
public YouTube data on your behalf. By using Govrl.io you also agree to be bound by the
YouTube Terms of Service. Data obtained through the YouTube API Services is handled in accordance with the
Google Privacy Policy. We only access publicly available data (we do
not request access to your private YouTube account or any authenticated user data), we do
not sell YouTube API Data, and we refresh, update or delete any stored YouTube API Data at least every
30 days. You can review or revoke third-party access to your Google account at any time via your
Google security settings.
7. Security & retention
Data is transmitted over HTTPS and stored with industry-standard encryption at rest. Saved bookmarks and analysis caches are retained while your account is active; you can delete them at any time. Cached YouTube data (including channel-analysis caches) is refreshed or deleted at least every 30 days.
7b. Free-trial device check (invite campaign)
The 14-day invite campaign gives one free trial per device, so that a new e-mail address alone does not reset it. Here is exactly how that check works.
- What we store. Two one-way hashes per device. The first is a hash of a random value we put in an
httpOnly cookie named gv_dev. The second is a hash of your browser family and operating system family (no version numbers), platform, accepted languages, screen size and colour depth, device pixel ratio, time zone, CPU core count, device memory and touch-point count. We also store a hash of your IP address. Every one of these is hashed with a secret key held only on our server — we do not keep the underlying values, and the hashes cannot be turned back into them. We do not read your canvas, WebGL, fonts or audio stack. - Where it is stored. In our Supabase database, reachable only by our server. The browser never reads or writes these records, and the page is never told what its own device mark is. Alongside each mark we keep a tally row per account that has asked for a trial with it — the account id, a count and two timestamps. That tally is what lets us tell one person retrying from several different people sharing a device model, and it is the only place these two are linked.
- What it is used for. Only to answer one question: has this device already taken a free trial? It is not used for advertising, profiling, analytics or tracking you across other sites.
- The two marks do not carry the same weight. The cookie mark is a random value we generated, so two different machines cannot produce the same one — a match there means this browser really has had its trial, and the request is refused. The configuration mark can genuinely collide: two strangers on the same phone model, with the same language and time zone, hash to the same value. So a match there alone never refuses you outright. The first collisions go to the same human-review queue as an IP burst, and only a mark shared by three or more separate accounts is treated as account farming and refused.
- We never block by IP address. Offices, schools, cafés and mobile networks put hundreds of real people behind one address. The IP hash is a weak signal only: an unusual burst of brand-new accounts from one address is put in a short human-review queue instead of being refused.
- How long we keep it. Up to 400 days from the date of the trial, then it is deleted automatically by a daily job. Delete your account and we remove your trial records with it.
- If you think we got it wrong, write to the address in section 9 — a person reads it and can grant the trial by hand.
8. Your choices
You can use the extension without an account. You control what you save. You can disconnect the extension or remove your data by contacting us. Uninstalling the extension stops all collection.