Privacy Policy

We care about your privacy and data

This policy explains how toobmap handles data. toobmap is a web app at https://www.toobmap.com that takes a public YouTube video and plots the places mentioned in it on a map, in the order they come up. Today this policy covers the toobmap Web App (this website); a Chrome browser extension is planned but not yet released, and this policy will be updated to reflect it before launch.

We only process the data needed to make toobmap work, and we keep the personal data we collect to a minimum — see "What We Collect" below for the full list.

toobmap is an independent project operated by an individual developer, not a registered company. For any privacy question or request, use the contact link in the "Contact Us" section below.

US Privacy (CCPA/CPRA)

This section supplements our Privacy Policy for California and other US state laws. We maintain user accounts for authentication and store minimal personal data necessary for our services.

Do Not Sell or Share My Personal Information

toobmap does not sell or share personal information as defined by the CCPA/CPRA. We collect minimal user data for authentication and service improvement.

Right to Know, Delete, Correct

You can delete your own account at any time from your Profile page — this immediately and permanently deletes your video history, quota records, and location corrections, and removes your account from our authentication system. To request a copy of your data, or to correct it, use our contact form.

One exception: when you delete your account, we keep a one-way cryptographic hash (SHA-256) of your email address. It cannot be reversed to recover your email — it exists solely to stop the same person from re-registering to get a fresh free-tier quota.

Children's Data

The service is intended for users 18+ and is not directed to children.

What Information We Process & Why

To find locations in a video, we need to analyze its content. Today this happens through the Web App; the section below on the planned Chrome Extension describes how it will work once released.

1. Video & Channel Metadata

• What we process: information like a video's title, description, tags, and the channel's name.
• Why we process it: To understand the video's context and identify potential locations mentioned.
• How it works:
  • Web App: Fetches this information from YouTube's Data API using the video ID.
  • Chrome Extension (planned): Will read this information directly from the YouTube page you are viewing, once released.

2. AI-Powered Location Analysis

The video metadata is sent to be analyzed by Google's Gemini AI model. This helps us accurately extract place names from the text.

Important: We do not send any personal information about you (like your user account or IP address) along with this metadata. The process is anonymous.

Signing In With Google (Google User Data)

toobmap offers "Sign in with Google" as the way to create and access an account. This section sets out exactly what Google user data we receive, why, where it is stored, and who else sees it.

What we request

We request only the three basic sign-in scopes, and no others:

• openid — confirms to us that Google authenticated you, and gives us the stable account identifier that tells your account apart from anyone else's.
• .../auth/userinfo.email — your Google account email address and whether Google has verified it.
• .../auth/userinfo.profile — your basic public profile: display name and profile picture URL.

We do not request any sensitive or restricted scope. toobmap has no access to your Gmail, Drive, Contacts, Calendar, Photos, YouTube account, subscriptions, watch history, or anything else in your Google Account. Public YouTube video details are fetched with our own API key from the public YouTube Data API — never through your account.

How we use it

• Email address and account identifier: to authenticate you, to keep one account per person, and to attach your video history, free-tier quota and location corrections to the right account.
• Display name and profile picture: shown back to you in the account menu on the site so you can see which account you are signed in as. They are read from the Google sign-in response when your session loads and are not used for anything else.

How we store it

Your email address and Google account identifier are stored by Supabase Auth, our authentication and database processor, for as long as your account exists. That email address is the only personal detail we keep. We do not store your Google profile picture or display name in our database, and we never receive, see or store your Google password.

How we share it

We do not sell, rent or trade Google user data, and we do not share it with third parties for advertising or their own marketing. It is disclosed only to Supabase, acting as our processor to run authentication and the database on our behalf, and only where we are legally required to disclose it. Google user data is never included in the video metadata we send to the Gemini API for location analysis — that request is anonymous and carries no information about you.

How to withdraw access and delete it

You can revoke toobmap's access to your Google Account at any time from Google's Third-party apps & services page. To also remove what we hold, delete your account from your Profile page — that permanently deletes your video history, quota records and location corrections and removes your account from our authentication system, apart from the one-way email hash described above.

Limited Use

toobmap's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertising, and we do not allow humans to read it except with your explicit permission, to resolve a specific support request you raise, for security purposes, or where required by law.

Third-Party Services

toobmap relies on a few external services to provide its full functionality. These services may receive your IP address as part of a standard web request, but we do not send them any personal information about you.

• Vercel: The toobmap Web App is hosted on Vercel. As our hosting provider, Vercel handles the network requests needed to serve you this website.
• Supabase: If you create an account, Supabase stores your login credentials (via Supabase Auth) and any location corrections or votes you submit. Supabase acts as our database and authentication processor.
• Google (YouTube Data API & Google Maps): The Web App uses the YouTube Data API to fetch video metadata. Both the Web App and the Extension may use Google Maps to display map imagery.
• Google AI (Gemini): To perform our AI-powered location analysis, we send anonymized video metadata to Google's Gemini API. To monitor for and prevent misuse, Google may store this data for up to 55 days, as detailed in their usage policies.
• OpenStreetMap (Nominatim & Map Tiles): To turn a place name (like "Paris") into map coordinates and to display map imagery, we use services from OpenStreetMap.
• MapTiler: The Web App may also use MapTiler for providing map imagery and geocoding services.
• Tally.so: If you use the "Report an Issue" feature, you will be directed to a feedback form hosted by Tally.so.
• Vercel Analytics: We use Vercel Web Analytics to collect anonymized usage data, such as page views and visitor demographics, to improve our service. This data does not include personally identifiable information and does not use cookies.

Data Stored on Your Device

To save your preferences and improve performance, toobmap stores some non-personal data directly in your browser.

• Web App (using Local Storage): Your preferred map settings and cached AI results for videos you've already viewed.
• Chrome Extension (planned, using Chrome Storage): Once released, this will store a list of videos where you have hidden the widget, and cached AI results.
• Essential Cookies: Authentication tokens from Supabase (set as secure, HTTP-only cookies) so you can access protected features without re-authenticating, plus short-lived session cookies for limited preview access. These cookies are limited to toobmap and are not used for advertising or cross-site tracking.

You can clear this data at any time through your browser's settings.

What We Collect (and What We Don't)

We are committed to your privacy and want to be crystal clear about what we do and what we never do:

• Some features require signing in. If you create an account, we collect your email address for authentication — that is the only personal detail we store about you.
• We do not store any additional personal details beyond that email address.
• We do not log or store the IP addresses of our users on our servers.
• We do not use tracking cookies or fingerprinting technology.
• We do not sell or share your personal information with third parties for their own marketing purposes.

Your Rights (GDPR)

You have the right under GDPR to access, correct, or delete your personal data. You can delete your account and its data yourself at any time from your Profile page. For any other request, use our contact form.

Legal basis: we process your account email under contractual necessity, to provide the service you sign up for. We process video and channel metadata under legitimate interest, to deliver toobmap's core mapping functionality. We do not rely on consent for either of these, and we do not set any non-essential cookies that would require it.

Retention: account data is kept for as long as your account is active. If you delete your account, your video history, quota records, and location corrections are deleted immediately (see "Right to Know, Delete, Correct" above).

Google Chrome Web Store Policies

This policy is intended to comply with the Google Chrome Web Store's User Data Policy. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Contact Us

If you have any issues, questions, or feedback about this policy or our products, please reach out through our contact form.

Changes to This Policy

We may update this policy from time-to-time. Any changes will be posted on this page.