Data, storage and retention

This page says what ChannelForge keeps, where, how it is protected, for how long, and what happens when you delete something. The Privacy Policy is the binding text; this page explains how the system implements it.

Where things are kept#

Encryption#

• In transit. TLS from your browser to the edge and from the edge to the servers. The services verify the database's certificate, not only encrypt the connection. GPU machines reach the control plane only through encrypted sessions. Webhooks are delivered over HTTPS only.
• At rest. The database and object storage are encrypted. On top of that, secrets in the database are sealed with AES-256-GCM under a key that exists only on ChannelForge's servers: platform tokens, two-factor secrets, webhook signing secrets and brand-voice keys.
• Hashed, never stored. Passwords (argon2id), session tokens, API keys, recovery codes and the OAuth codes and tokens of connected apps are stored only as hashes. A copy of the database could not be used to sign in or to call the API.

Where it is processed#

The service is hosted in the European Union, in AWS in Frankfurt: the app, the database, object storage and email. GPU machines in other regions receive a job's files only for as long as the job runs. Model calls go to Claude models through AWS Bedrock, narration and speech recognition to Google Cloud, each carrying only what that call needs. Every provider, what it does and where, is on the sub-processors page; transfers outside the EU rely on the safeguards the Privacy Policy describes.

Who can see it#

• Members of the workspace, by role — owners, admins, editors and viewers — and projects can be limited to teams.
• Nobody in another workspace. Every query names the workspace; another workspace's id answers "not found".
• ChannelForge's staff, through the admin console only: support staff can read and change nothing; administrators' changes are written to the audit log.
• Media only through signed links that expire within minutes (15 minutes through the API), given to members.
• Shared links — a review link, a media kit's link, a channel's link page — show what they were made to show, to whoever has the link, until you stop them.

How long things are kept#

These periods are enforced by the system itself: the sentinel prunes what has passed its time, every hour, and YouTube's data follows YouTube's own storage rules.

Deleting things#

Deleting a workspace#

An owner deletes a workspace with Delete workspace in its settings, once it has no running subscription. At once:

• members can no longer open it;
• nothing acts for it any more: its schedules stop, its live channels pause, its API keys and pending invitations are revoked, its webhooks are switched off, and its queued and running jobs are cancelled with their credits released.

Within 7 days — after 6 days by default, the window in which support can still undo a deletion made by mistake — ChannelForge deletes, for that workspace: every platform token and connection, everything read from the platforms (Insights, Studio, the outlier radar, comment themes, the coach, monetization and profit readings, media kit audiences), its webhooks and their history, its connected apps' grants, its media kit links, its link pages' click counts and its brand voice. Platform numbers are also removed from the records that stay. This deletes ChannelForge's copy: to end ChannelForge's access at a platform itself, revoke it in the platform's settings — the Privacy Policy says where.

Kept, as the law and our accounts require: billing records, the credit history, the audit log and the job records.

A disconnected or refused YouTube channel#

YouTube's API rules ask that what was read from YouTube with a channel owner's permission is deleted within 7 days of that permission ending. It ends when a member disconnects the channel in Settings → Connections, or when Google refuses ChannelForge's saved sign-in for it (the owner revoked the access in their Google account, or it expired: the channel shows expired there, to reconnect). ChannelForge then deletes, for that channel only: its subscriber counts, its videos' counts and measurements, Studio's copy of its videos with their comments and the thumbnails kept to undo a change, its YouTube Analytics readings (monetization, revenue, audience, reach), and what was computed from them (Insights' analyses, breakouts, the YouTube figures of the hook lab, the retention loop and comment themes) — within minutes of a disconnect; 6 days after a refusal, so that reconnecting the channel before then keeps its history. The posts ChannelForge made stay, without YouTube's numbers, and each deletion is recorded, counts only, in the workspace's audit log.

Deleting your account#

In your account settings, Delete account (the Delete my account button) asks for your email address and your password. It is refused while you are the only owner of a workspace that has other members (make one of them an owner first) or while one of your workspaces still has a subscription. Then:

• every workspace you are the only member of is deleted as above;
• you leave every other workspace;
• your account is anonymised: your email address and name are removed, and your password hash, two-factor secret and recovery codes are cleared;
• every session you had is signed out.

Backups#

The database can be restored to any moment of the last 7 days. Encrypted copies of the database and of the media are also kept with a second provider, for disaster recovery. See Reliability and recovery.

Related#

• Privacy at a glance — what is collected and why, and your rights.
• Security — how access to all this is protected.
• Workspaces, projects, teams and roles — who can see what.
• Platform policies we follow — the platforms' rules on storing their data.