Privacy policy

Who keeps your data

Panoptic is an app for running a network of YouTube channels: production, the team and their pay, costs and revenue, sponsorships and YouTube's figures. Companies use it, and each company's owner invites the people who work with them.

What Panoptic keeps about you

Your account, which is yours across every company you work for:

• your email address, which you sign in with, and your name, which you can change on your account page. Someone who invites you gives Panoptic your address; until you join, the company sees you by your address, never by a name;
• when you last signed in;
• if you add them on your account page, your user IDs on Discord, Slack or Telegram, used only to mention you on your own work in your companies' chats, and to message you there directly. You can remove them at any time.

In each company you work for:

• your place in it: your role, who invited you and when, and whether you're invited, active or deactivated;
• your work: the steps you're given and their dates, what you hand in and when, your reviews and the changes you ask for, your comments, the files you add and the ideas you suggest. How late a step was counts only your own lateness, never delay handed down to you from earlier steps;
• your pay, in a company that pays you: your rates, each line of pay with its adjustments and their reasons, and your payouts. Panoptic tracks pay; the company pays you itself, and Panoptic has no bank connection;
• a record of each important change, who made it and when (the audit log), which is only ever added to until the company itself is deleted.

If you subscribe to Panoptic, or start to: your subscription's status, the end of its current period, and which customer in Stripe is yours. If you're a contact at a sponsoring brand: the sponsor you're a contact for. You see only that sponsor's own campaigns, through your portal.

Signing in and cookies

• There are no passwords. To sign in, you ask for a code, which Panoptic emails to you. It keeps only a keyed hash of the code (an HMAC), never the code itself; a code works once, for 10 minutes, and stops working after five wrong tries.
• Signing in starts a session. Your browser keeps its token in one cookie, __Host-panoptic_session, which the page's scripts can't read (HttpOnly), which goes only over HTTPS (Secure), and which your browser sends from another site only when that site sends you to Panoptic itself, never with what it posts to Panoptic or loads from it in the background (SameSite=Lax). Panoptic keeps only a hash of the token (SHA-256). A session lasts 30 days without use, and signing out deletes it.
• That's the only cookie Panoptic sets: it has no advertising or analytics cookies. Your choice of a light or dark theme stays in your browser's own storage, and isn't sent to Panoptic.
• So that codes can't be guessed, nor sent too often, Panoptic counts the codes asked for and checked, per email address and per network address, in Upstash, which holds each only as a keyed hash.
• Sign-in codes are deleted a day after they're made, and sessions a day after they expire.

YouTube channels

A channel's owner connects it on Google's own consent page, where they choose what Panoptic may read:

• the channel and its videos (YouTube's read-only access);
• their analytics (YouTube Analytics' read-only access);
• and, only if they allow it, the channel's revenue (YouTube Analytics' read-only access to its monetary figures). Without it, the channel's revenue shows as unavailable.

Panoptic only ever reads: it never uploads, changes or deletes anything on YouTube. From YouTube it reads:

• the channel's name, picture and subscriber count;
• its uploads: their titles, lengths, privacy and thumbnails, when they went or are due to go public, and whether they're live streams;
• each day's views, watch time and subscribers for the channel and each video, and each video's impressions and click-through rate, from YouTube's reach reports;
• with revenue access, YouTube's estimated revenue for the channel and each video, in the company's currency, kept as YouTube's estimate.

Panoptic uses them only for the company that connected the channel: to link each video in production to its upload and mark it published when YouTube does, and for the company's dashboards, each video's profit and loss, analysis and alerts, shown to the people the company's roles allow. A sponsor's contacts see the daily views of the videos made for their own deals. Figures are kept by day, as YouTube reports them.

For each channel, Google gives Panoptic a refresh token. Panoptic keeps it encrypted (AES-256-GCM) with a key only its server holds, bound to the connection it belongs to, and never keeps the short-lived access tokens it gets with it.

Disconnecting a channel ends Panoptic's access: the token is revoked at Google and deleted. The owner then chooses to keep the channel's data, so that connecting it again fills in the days missed, or to delete it, which can't be undone and keeps the paid pay history, sponsor deals and the audit log. Access removed on Google's side, in the Google account's own settings, stops Panoptic's refreshes, and the channel asks to be connected again.

Files

The files people add (scripts, voice-overs, research, drafts, thumbnails, final videos, invoices, contracts and the like) go straight from their browser to Cloudflare R2, through links that work for 15 minutes and for that one file; Panoptic's server never sees them on the way. Each file is opened through a link that works for 5 minutes. Panoptic checks each file's size and kind once it's stored and, for an invoice, works out its fingerprint (SHA-256), so the same invoice isn't added twice. An upload never finished is removed after a day. People can add links to files kept elsewhere instead.

Chat messages

A company may connect its own Discord, Slack or Telegram, for the whole company or for one of its channels. From then on, Panoptic posts there about the company's work, and its bots message people directly:

• new projects and assignments, deadlines coming up, tomorrow and missed, changes asked for, finished steps, work ready for review or to publish, and published videos are posted in the channel's chat, or else the company's, naming the person whose work it is and mentioning them where they added their user ID;
• if you added your user ID, you're told directly of your own assignments and deadlines, of the changes asked of you (with the reviewer's notes), of your pay being approved (never its amount) and, if you read them in Panoptic, of the owners' alerts;
• on a company's Discord that can make threads, each new project gets one, saved as the project's Discord link unless it has one already.

Messages hold names, titles, steps, dates and links into Panoptic, the views behind an owners' alert that involves no money, and a reviewer's notes for the person fixing the work; never an amount of money, an email address or a secret. Nobody is sent a direct message about their own action, though a post about their own work still mentions them, and someone only invited, deactivated or a sponsor's contact is never mentioned or messaged. Panoptic logs each message: where and to whom it went, what it said (so a retry sends the same), when, and whether it was sent. The webhook address or bot token a company gives is kept encrypted, readable only by Panoptic's server, and never shown again.

Who sees your data

• Each company is kept apart: nobody in one company sees another's data. The database itself decides what each person reads and changes, by their company, their role, the channels they manage and the work they're given.
• Owners and business partners see the company's work and money; a channel manager sees the channels they manage; a contributor sees the videos they work on and their own pay; a sponsor's contact sees only their sponsor's campaigns. A company can make roles of its own.
• Money (pay, costs, revenue, sponsor deals' values) shows only to the roles that may see it, and internal comments only to owners and the channel's managers.
• A subscription is its owner's alone: business partners never see it.

The services Panoptic uses

Panoptic runs on these services, each given only what its job needs:

• Render runs Panoptic's server, and Supabase its database, in the same region.
• Cloudflare runs Panoptic's domain, and keeps its files in R2.
• Upstash counts requests against their limits, holding email and network addresses only as keyed hashes; it keeps short-lived locks, the state of a channel being connected through Google for 10 minutes, and which Discord thread is each project's (by their IDs alone).
• Mailjet sends the sign-in codes and invitations, without tracking whether they're opened or their links clicked. Panoptic sends no other email.
• Sentry receives reports of errors, from the server and from your browser, with nothing about you but your browser's name: cookies, headers, what was typed and anything that looks like a token or a code are taken out first.
• Stripe takes subscriptions on its own pages, so card details never reach Panoptic. It gets the email address of whoever starts subscribing and, at its checkout, their billing address, name and, for a business, its tax ID, from which Stripe Tax works out sales tax or VAT. Stripe keeps the payments, taxes and invoices.
• Google shows the consent page where a channel is connected, and answers YouTube's Data, Analytics and Reporting APIs.
• Discord, Slack or Telegram receive a company's messages, only once it connects one.

How it's protected

• Panoptic is served only over HTTPS, and every page with a strict content security policy.
• Secrets Panoptic reads back (YouTube's tokens, chat credentials) are encrypted with a key only its server holds; secrets it only checks (sessions, sign-in codes) are kept only as hashes.
• The database itself refuses each person what their role doesn't allow, whichever page asks.
• No secret is sent to your browser, or written to the logs.

How long it's kept

• Panoptic keeps a company's data while the company uses it. Its history is archived, cancelled or deactivated rather than deleted, so past work, pay and figures still add up, and the audit log is only ever added to, until the company itself is deleted.
• Someone a company deactivates can't use it any more, and their history there stays.
• A channel's data is deleted once its owner chooses to, after disconnecting it.
• Sign-in codes go a day after they're made, sessions a day after they expire, and an upload never finished after a day.
• A company's owner can download all of its data from the company's settings page, a few times a day: a zip archive with a file for each kind of record, every row as it stood when the download began, and its stored files listed with links that download them while the company is in Panoptic. Sessions, sign-in codes, the keys Panoptic keeps for YouTube and the chat services, the messages kept so a failed one can be sent again, uploads never finished and the owner's subscription aren't in it.
• When a company leaves Panoptic, its owner deletes it from the same page, typing its name. Panoptic first ends its access to the company's YouTube channels at Google, then deletes every record of the company at once, its pay records and audit log included, and its stored files within a day. It can't be undone. The people stay, with their sign-in and their other companies, and so does the owner's subscription, which they cancel on Stripe's pages.

Your choices and your rights

• Change your name on your account page, and add or remove your chat accounts there.
• Sign out, which ends your session.
• A channel's owner can disconnect it at any time, ending Panoptic's access to it.
• A company decides who works in it (its owner, and the people its roles allow), and its owner can download its data, or delete the company.

Children

Changes to this policy

Contact