This document is an English translation provided for convenience; it is written under the laws of the Republic of Korea, and the Korean version is authoritative and prevails in case of any discrepancy.
1. Operator, privacy contact, and scope
SKIMTUBE is operated under the business name LeanLog by sole proprietor Wonjung Choi, and provides YouTube video summarization, directly registered channel monitoring, Telegram notifications, and AI chat.
Wonjung Choi, the sole proprietor trading as LeanLog ("LeanLog"), is the data controller for personal data processed through SKIMTUBE and determines the purposes and means of that processing.
This policy applies to the SKIMTUBE web service, direct URL summarization, directly registered YouTube channel monitoring, Telegram notifications, AI chat (web and Telegram Mini App), payments, and support features.
- Data controller: Wonjung Choi, trading as LeanLog
- Business name: LeanLog
- Representative and sole proprietor: Wonjung Choi
- Business registration number: 740-20-02308
- Phone: +82-10-4798-3850
- Support email: [email protected]
- Privacy officer and contact person: Wonjung Choi
2. Information we collect
- Account information: email address, name or display name, and basic profile information from the login provider
- Service usage information: YouTube URLs submitted by users, YouTube channels registered directly by users, job status, processing results, language and region settings, and error records
- Content processing information: transcripts, summaries, chapters, action items, source links, and public metadata such as video title, channel name, and duration
- Reaction and interest information: likes, dislikes, saves, wants-more signals, and other feedback on summaries or notifications
- AI chat information: AI chat messages (web and Telegram Mini App), question history, conversation context, referenced summaries, and state used to generate interest-aware responses
- AI chat key recovery material: only when you enable the user-held key and register a recovery method — a copy of the key sealed on your own device, together with its unwrapping parameters. If you register a passkey, we also store its credential identifier, the device name you chose, its transports (USB, NFC, internal, and so on), and the registration time. Biometric data such as fingerprints or face scans never leaves your device and is not collected by the service
- Notification and Telegram Mini App information: Telegram connection identifiers, Telegram-provided user id, username or name, Mini App initData, and notification delivery or failure records
- Payment information: payment identifiers, order ids, payment status, subscription status, credit purchases, refunds, and cancellation records provided by payment processors
- Device and security information: session-related identifiers, access times, IP-related information, browser and device signals, request logs, and rate-limit records used to prevent abuse
- Attribution and observability information: UTM parameters, external referrer, first landing path, and client error information
- Support information: email address, name, inquiry category, message contents, and support history
3. YouTube and Google data use
Google OAuth is used only for sign-in, user identification, and session issuance.
SKIMTUBE does not import a user's YouTube subscription list and does not request the youtube.readonly scope for the current operating scope.
The service only processes YouTube URLs submitted directly by the user or YouTube channels registered directly by the user.
Monitoring for new videos on registered channels uses publicly accessible information such as public feeds, public metadata available through public APIs, and public-page information.
4. Purposes and legal bases for processing
The table below sets out each processing purpose, the personal data involved, and its legal basis. Where the EU GDPR or UK GDPR applies, LeanLog relies on the legal bases listed in the table.
Where the Personal Information Protection Act of the Republic of Korea applies, the corresponding processing grounds under that Act (performance of a contract, compliance with legal obligations, legitimate interests, consent, and so on) apply to the same purposes; the applicable legal basis may differ where another jurisdiction's privacy law applies.
| Purpose | Personal data involved | Legal basis |
|---|---|---|
| Create and manage accounts, authenticate users, and maintain sessions | Account information, login-provider information, session identifiers, and language or region settings | Performance of a contract or steps requested before entering into a contract (Article 6(1)(b) GDPR) |
| Provide video summaries, channel monitoring, Telegram notifications, and user-requested AI chat | Submitted URLs, registered channels, content-processing information, Telegram identifiers, chat messages, and conversation context | Performance of a contract (Article 6(1)(b) GDPR) |
| Provide interest-based AI chat personalization | Summary reactions, saves, interest signals, registered categories, keywords, and limited prior conversation context | Performance of a contract and LeanLog's legitimate interest in providing relevant user-requested responses (Articles 6(1)(b) and 6(1)(f) GDPR). Users may disable personalization in Settings |
| Process payments, subscriptions, cancellations, refunds, receipts, tax, and accounting records | Account information, the payment provider's customer and transaction identifiers, payment status, subscription information, and refund records | Performance of a contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c) GDPR) |
| Provide customer support, service notices, and respond to privacy or deletion requests | Account, contact, support inquiry, and request-verification information | Performance of a contract, compliance with legal obligations, and legitimate interests in resolving user requests and disputes (Articles 6(1)(b), 6(1)(c), and 6(1)(f) GDPR) |
| Protect accounts and the service, prevent fraud and abuse, enforce rate limits, and establish or defend legal claims | IP-related information, device and browser signals, session information, request logs, security events, and transaction records | Compliance with legal obligations and LeanLog's legitimate interests in service security, fraud prevention, and legal claim management (Articles 6(1)(c) and 6(1)(f) GDPR) |
| Diagnose errors, maintain reliability, and improve service quality | Service usage information, error records, client error information, and limited technical logs | LeanLog's legitimate interests in maintaining and improving the service (Article 6(1)(f) GDPR) |
| Measure first-touch traffic attribution | UTM parameters, external referrer, and first landing path | Consent (Article 6(1)(a) GDPR). Optional attribution processing does not occur if consent is refused |
5. Retention periods
Personal information is destroyed without undue delay when the purpose of use is achieved or the account is deleted. However, SKIMTUBE may retain the minimum necessary records when required by law or needed for dispute handling, abuse prevention, payment settlement, or accounting.
- Account information: until account deletion is completed. Abuse or dispute records may be retained separately for a legally permitted period where necessary
- Direct URL requests, registered channels, detected videos, and notification records: until account deletion or until the service purpose is achieved. Deleted or de-identified where technically possible upon request
- Processing artifacts such as summaries: may be retained in a de-identified form separated from an individual user and reused for the same video. The original transcript (full captions) is deleted promptly once summarization completes; if another processing job for the same video is still running, it is cleaned up after that job finishes and may remain for some time longer. Only internally processed text needed to provide summaries and AI chat is kept, in a form never exposed to users. User-linked request records are cleaned up on account deletion
- Summary reactions, interest signals, and AI chat conversations: until the user requests deletion or deletes the account. Prompts do not include unlimited full history; only internally limited recent turns, keywords, and summary context are used
- Referral program records: to prevent the same person from re-registering to collect referral benefits repeatedly, the fact that a referral code was used, an irreversible transformation of the email address at that time, and the coarse network range (IP subnet) are retained after account deletion. The original email address and IP address themselves are not stored, and these records are not used for any purpose other than determining duplicate receipt of referral benefits
- Records of contracts, withdrawal, payments, and supply of digital goods: 5 years under Korean e-commerce consumer protection standards
- Consumer complaints and dispute records: 3 years under Korean e-commerce consumer protection standards
- Advertising and display records: 6 months under Korean e-commerce consumer protection standards
- Access logs that may qualify as communications confirmation data: 3 months under Korean communications privacy standards
- Email verification and password reset tokens: deleted or invalidated after a short security TTL
- Support inquiries: retained for the period needed to handle the inquiry and disputes; generally no longer than 3 years unless a longer legal retention duty applies
6. Destruction procedure and method
When retention is no longer necessary, SKIMTUBE identifies records eligible for destruction under restricted access and destroys them without undue delay.
Electronic files and database records are deleted in a way that makes recovery difficult or are de-identified by removing user identifiers. Paper documents are not part of the default workflow; if created, they are shredded or incinerated.
Backups, logs, and payment ledgers that cannot be immediately deleted or must be retained by law are access-restricted and destroyed on their retention schedule.
7. Security safeguards
SKIMTUBE applies technical and administrative safeguards based on the nature and risk level of the personal information it processes. Some account information and service usage information may be processed as decryptable data or plaintext identifiers where needed to provide the service, and are protected through access control and operating-environment security.
- Passwords are not stored in plaintext and are protected using secure one-way safeguards.
- Sensitive tokens related to login sessions, email verification, and password reset are protected so they are not stored in plaintext.
- When sign-in integration tokens need to be stored, SKIMTUBE stores them encrypted. In the current operating scope, SKIMTUBE does not provide a feature that imports a user's YouTube subscription list.
- AI chat message content and conversation titles are treated as sensitive personalization data and are not stored in the database in plaintext. They are encrypted at rest and used only as needed to provide personalized answers, so conversation contents are not exposed as-is from storage or backups alone.
- AI chat users can optionally switch to a "user-held key" mode, from the web or from the Telegram Mini App. In this mode, conversation content and titles are encrypted with a key kept in the user's own browser or connected Telegram, and the server does not retain the key itself. SKIMTUBE cannot decrypt those conversations or restore them on the user's behalf under any circumstances. If the user registers a recovery passphrase or a passkey, a copy of the key — sealed on the user's own device so that only that method can open it — is stored on the server; because neither the passphrase nor the passkey value is ever sent to the server, SKIMTUBE cannot open that copy either. Recovery is therefore possible only through the method the user registered, and if no such method exists or it is forgotten, the stored conversation history cannot be recovered.
- Major authenticated state-changing requests use verification procedures designed to reduce forged requests and unauthorized changes. External integration requests are handled under separate verification standards appropriate to their nature.
- In the operating environment, SKIMTUBE checks required security settings and secure communication standards, and controls the service so it is not run with unsafe settings.
- Payments are processed through payment processors. SKIMTUBE does not directly store full card numbers, CVCs, or complete payment instrument details, and processes only information needed for service operation such as payment identifiers, order ids, and subscription or transaction status.
- Depending on the deployment environment, SKIMTUBE may use domain, encrypted communication, and security relay layers, and IP addresses, request metadata, and network security logs may be processed according to the applied configuration.
- The web interface applies browser security policies, security headers, and other basic web safeguards to protect users.
8. Subprocessors and cross-border transfers
SKIMTUBE may send necessary information to the external services below. Core storage is controlled in an operator-managed server environment, and overseas providers may process some information for AI processing, notifications, email, payments, and spam prevention.
Cross-border transfer or overseas processing occurs when a user uses the relevant feature through secure communications, payment or authentication flows, and external-service integrations for notifications, email, AI processing, and similar functions. The main providers are described below.
Payments made in the Republic of Korea are processed by Toss Payments Co., Ltd. as a payment gateway (PG), and its processing is governed by its own privacy policy (https://pages.tosspayments.com/terms/homepage/privacy/policy). Where an overseas payment provider processes buyer and payment information as the Merchant of Record, that provider and LeanLog (Wonjung Choi) each act as independent data controllers for their respective processing activities. The overseas payment provider is still to be determined; once it is selected, its name and privacy notice link will be reflected in this policy.
- Google OAuth: Google account identifier, email, email verification status, name, and basic profile information are received during sign-in. YouTube subscription-list access is not used in the current operating scope
- YouTube/Google public APIs and public feeds: channel id, video id, and public channel or video URLs may be sent to verify directly registered channels and fetch public video metadata
- Domain or security layer, where used: network operation metadata such as IP address, request metadata, and network operation logs may be processed depending on deployment configuration
| Processor/provider | Country or possible overseas processing region | Timing and transfer method | Transferred items | Purpose | Retention/use period | Choice and consequences of refusal | Provider contact/policy |
|---|---|---|---|---|---|---|---|
| OpenRouter | United States and other countries where OpenRouter or connected model providers operate infrastructure | Sent through secure communications when requesting transcript cleanup and summarization or AI chat generation | Portions of the transcript text to summarize, user questions and chat messages, limited summary and interest context, and processing usage information | Transcript cleanup, summary generation, AI chat response generation, and usage/cost accounting | Until the service purpose is achieved, the internal retention period expires, or the user requests deletion. Provider-side retention follows the provider's policy and contract terms | Users may refuse. However, refusal may limit core AI features such as transcription, summaries, and AI chat | OpenRouter privacy policy: https://openrouter.ai/privacy |
| Google (Gemini API) | United States and other countries where Google operates its AI processing infrastructure | Sent over secure connections when requesting video transcription or analysis | The public YouTube video URL / video identifier being processed, public metadata (title, description, etc.), and the processing request for that video/audio content. No user account identifiers are sent | Video transcription, analysis, and summary generation | Until the service-provision purpose is fulfilled. Google-side retention follows Google's policies and contract terms | You may refuse; however, core features such as video summaries may be limited | Google privacy policy: https://policies.google.com/privacy |
| Telegram | Overseas regions and global infrastructure where Telegram operates its services | Sent or received through Telegram integration features when connecting Telegram, sending notifications, collecting button reactions, or using Mini App AI chat | Telegram user identifiers, username or name, connection information, notification message text, button reactions, information needed for Mini App authentication, and limited message information needed for AI chat | Telegram notifications, account connection verification, reaction collection, Mini App authentication, AI chat, and abuse prevention | In-app connection information is deleted or de-identified when Telegram is disconnected or the account is deleted. Telegram-side retention follows Telegram's policy | Users may refuse or disconnect Telegram. However, Telegram notifications, Telegram reactions, and Telegram Mini App AI chat may be unavailable | Telegram privacy policy: https://telegram.org/privacy |
| Resend | United States and other countries where Resend operates email processing infrastructure | Sent by the server through HTTPS APIs when sending email verification, password reset, account notice, support acknowledgement, or support forwarding email | Recipient email, sender email, reply-to address, email subject/body, verification/reset/sign-in notice links, and support inquiry contents | Transactional email delivery, account security notices, support acknowledgement and forwarding | For the period needed to deliver email and handle delivery issues. Support emails and handling records follow this policy's retention periods, and Resend-side log retention follows the provider's policy and contract terms | Users may refuse. However, email verification, password reset, important account notices, and support acknowledgement may be limited | Resend privacy policy: https://resend.com/privacy |
| Toss Payments Co., Ltd. | Republic of Korea (domestic processing — no cross-border transfer) | Sent or received through the payment integration during domestic checkout, card registration (auto-renewal), recurring charges, cancellations, and refunds | Email, order number and payment identifiers, customer identifier (customerKey), card issuer and partially masked card number, payment status and amount, cancellation/refund reason. SKIMTUBE does not store full card numbers or CVCs | Domestic payment processing, auto-renewal (recurring charges), cancellations and refunds, payment dispute response | For the retention periods required by e-commerce, tax, and accounting law. In-app payment records follow this policy's retention periods, and Toss Payments' own retention follows its policy and legal obligations | Users may refuse. However, domestic payments, subscriptions, and refunds may be unavailable | Toss Payments privacy policy: https://pages.tosspayments.com/terms/homepage/privacy/policy |
| Overseas payment provider (to be determined) | Countries or regions processed by the overseas payment provider and payment networks. Once the provider is selected, the specific countries and regions will be reflected in this policy | For international (USD) payments, sent or received through payment integrations during checkout, subscription creation/renewal/cancellation, customer portal sessions, refunds, payment notices, and payment-method management | Email, customer/address/subscription/transaction/payment-method identifiers, payment status, refund reason, and information needed for receipts and tax handling. SKIMTUBE does not directly store full card numbers or CVCs | Payments, subscription management, refunds, receipts and tax handling, payment-method management, and payment dispute response | For the period needed for e-commerce, tax, accounting, and dispute response. In-app payment records follow this policy's retention periods, and provider-side retention follows that provider's policy and legal obligations | Users may refuse. However, payments, subscriptions, customer portal, refunds, and saved payment-method management may be limited | Overseas payment provider privacy notice: to be published once the provider is selected |
| Cloudflare Turnstile | United States and other countries where Cloudflare operates security verification infrastructure and its global edge network | Sent and verified through security verification integration when abuse-prevention checks are needed, such as signup form submission or public support form submission | Abuse-prevention verification information, IP-related information, and browser/device signals needed for verification | Block spam and bots, and prevent automated abuse of signups and of public support forms | For the period needed for verification and security logs. Support emails and handling records follow this policy's retention periods, and Cloudflare-side retention follows the provider's policy and contract terms | Users may refuse. However, if verification is refused or fails, protected features such as signup and public support submission may be unavailable | Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/ |
9. Cookies, local storage, and device information
SKIMTUBE may use cookies and browser storage for login sessions, request protection, language and region settings, onboarding state, dismissed notices, carrying a referral code, and first-touch attribution.
To detect signup abuse, free-credit abuse, and excessive automated requests, SKIMTUBE may use an opaque identifier derived from browser and device signals. This is a minimum defense needed for security and fair use.
If a user refuses necessary cookies or security signals, login, payments, free credits, support forms, summaries, or other service functions may be unavailable.
If you arrive through a referral link (`?ref=`), that referral code is stored in a browser cookie. During signup an email-verification link may open in a different tab or app, which discards the value in the address bar, so this is a functional cookie needed to carry the referral the user actually clicked through to account creation. It is deleted once the code is used and expires after 30 days if it is not. It is not used for attribution analytics.
Optional cookies (first-touch attribution) are used only after consent through the cookie banner shown at the bottom of the screen. If rejected, no attribution cookie is stored or reported and any previously stored cookie is deleted. The choice can be changed at any time by clearing this site's cookies in the browser, which shows the consent banner again.
10. AI chat, personalization, deletion, and opt-out
To provide AI chat on the web and in the Telegram Mini App, SKIMTUBE may collect and store user questions, conversation contents, question and response history, and conversation context.
Summaries, transcripts, summary reactions, saves, wants-more signals, registered channel categories, summary keywords, and limited recent conversations may be used as personalization context for AI chat and interest-based responses.
When AI chat is used through the Telegram Mini App, Telegram initData, Telegram user identifiers, username or name, app-account connection information, and notification or button reaction information may be processed for authentication, connection verification, conversation delivery, and abuse prevention.
To generate AI chat responses, SKIMTUBE may send user questions, chat messages, limited summary context, transcript excerpts, and interest or keyword information to external AI processing providers.
For technical and cost reasons, SKIMTUBE does not inject unlimited historical data into prompts. Internally limited keywords, summaries, and conversation turns are used.
Users may request deletion of AI chat conversations, question history, summary reactions, saves, wants-more signals, and interest data, or request personalization opt-out, through the online support channel or [email protected]. Users can also turn off personalization directly with the toggle in Settings > Account, which stops the use of the interest profile and prior conversation context.
When an account is deleted, AI chat conversations, question history, reactions, and interest information linked to the user identifier are deleted or separated from account identifiers and de-identified.
AI chat responses are reference information generated from the source video, transcripts, summaries, and conversation context, and may differ from or be inaccurate about the actual source video. Users should check the original video and official sources before making important decisions.
11. Children and adult content
SKIMTUBE is not primarily directed to children under 14. Where legal guardian consent is required for a child under 14, SKIMTUBE may restrict service use or disable the account until consent is verified.
Age-restricted (adult, 18+/19+) YouTube videos are automatically blocked from summarization and notifications. Allowing access through adult verification is planned for a later release.
12. Privacy rights requests
Users may request access, correction, deletion, suspension of processing, or withdrawal of consent through the in-service support channel or [email protected]. The phone number is provided as business information only; privacy rights requests are not accepted by phone.
SKIMTUBE processes requests within the maximum period permitted by applicable law. For Korean privacy requests with a statutory deadline, SKIMTUBE generally processes or notifies the result within 10 days of receipt, unless an extension is legally permitted due to unavoidable circumstances.
Requests may be limited in whole or in part where retention is legally required, third-party rights may be harmed, identity cannot be verified, processing is necessary to perform the service contract, or records are needed for abuse investigation. Where law requires a reason to be notified, SKIMTUBE will provide it to that extent.
13. Changes to this policy
This Privacy Policy may be updated when the service structure, applicable law, external processors, or security safeguards change.
Material changes will be notified through notices, email, in-service messages, or other reasonable methods. The updated policy shows its last updated date and effective date.
14. Contact
Privacy questions, account deletion, result deletion, and rights requests can be submitted through the in-service support channel or by emailing [email protected]. The phone number is provided as business information only and is not an intake channel.
The privacy officer and contact person is Wonjung Choi. SKIMTUBE may ask for reasonable verification before processing account or privacy requests.