Grosm

Privacy Policy

Last updated: August 9, 2026

This Privacy Policy explains how Grosm ("Grosm", "we", "us", or "our") collects, uses, and protects information in connection with the Grosm application (the "Service"), available at grosm.studio. Grosm is an internal operations tool used by agency managers to run health checks and perform authorized maintenance tasks on YouTube channels owned by our creator clients.

Who uses Grosm

The Service is used by two groups of people:

  • Agency team members (owners, admins, supervisors, and managers) who operate the Service on behalf of clients.
  • Channel owners (creator clients) who authorize Grosm to access their YouTube channel through Google OAuth so that we can perform the operational tasks they have engaged us for.

Information we collect

  • Account information. When you sign in to Grosm we store your name, email address, and organization membership.
  • Google account data. When a channel owner connects their YouTube channel, we receive data from Google APIs as described in the section below.
  • Operational data. Channel, video, playlist, and analytics data we retrieve in order to perform health checks and maintenance, along with an audit log of any changes made through the Service.

YouTube API Services

Grosm uses YouTube API Services to read and update channel data on behalf of authorizing channel owners. By using the Service you agree to be bound by the YouTube Terms of Service.

Data obtained through YouTube API Services is handled in accordance with the Google Privacy Policy, in addition to this Privacy Policy.

You may revoke Grosm's access to your data at any time via the Google security settings page.

Google user data we access

With the explicit consent of the channel owner, Grosm requests the following Google API scopes:

  • YouTube Data (youtube.force-ssl) — to read and update channel and video metadata (titles, descriptions, tags), channel branding, and playlists on the authorizing user's behalf.
  • YouTube upload (youtube.upload) — used solely to update the channel banner image. We do not upload videos.
  • YouTube Analytics (yt-analytics.readonly) — to display the channel's analytics (views, traffic sources, top videos, engagement) within the Service.
  • Email and OpenID (userinfo.email, openid) — to identify the Google account that granted access.

How we use the data

We use the data described above only to provide the Service: to run channel health checks, to display channel information and analytics to authorized agency team members, and to perform maintenance actions (such as metadata or branding updates) that the client has authorized. Every write action is recorded in an audit log.

Limited Use disclosure

Grosm's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for serving advertisements, we do not sell Google user data, and we do not transfer or use it for purposes other than providing or improving the Service. Human access to Google user data is limited to authorized team members acting on the client's behalf, for security, to comply with applicable law, or where the user has given consent.

Data sharing

We do not sell your data. We do not share Google user data with third parties except with sub-processors that host or operate our infrastructure, strictly to the extent needed to run the Service, or where required by law.

Data storage and security

Data is stored in access-controlled infrastructure. OAuth refresh tokens are encrypted at rest. Access to Google user data is restricted to authorized personnel and used only through server-side API calls made on the authorizing user's behalf.

Data retention and deletion

We retain data for as long as an account or channel connection remains active. A channel owner may revoke Grosm's access at any time from the Google security settings page or their Google Account permissions page, which immediately stops further access.

If you revoke access, we will delete all data obtained through YouTube API Services relating to your account within 30 calendar days of that revocation. Data retrieved through YouTube API Services and held while a connection is active is either refreshed or deleted at least every 30 calendar days. To request deletion of stored data at any other time, contact us at the address below.

Your rights

You may request access to, correction of, or deletion of your personal data, and you may withdraw consent for Google API access at any time. Contact us to exercise these rights.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at admin@grosm.com.