Privacy policy
2-Min Recap is a Chrome extension that summarizes YouTube videos from their transcripts, plus an account site at app.2minrecap.com. This policy says what we collect, why, how long we keep it, who helps us run the service, and how to delete it. We try to collect as little as the service needs.
Who we are
2-Min Recap is operated by Tinkerforge Labs LLC ("we", "us"). We are the controller of the personal data described here. Contact us at support@2minrecap.com.
The short version
- You sign in with Google. We keep your email address and your Google account id.
- When you ask for a summary, the extension first sends the video's id, title, channel, length and a hash of its transcript, to check the shared cache. Only if there is no cached summary does it send the transcript, which we pass to OpenAI to write one. We don't store the transcript.
- We keep your summaries in a private library, and counts of how much you use the service. You can delete any entry, or all of them, at any time.
- We don't see your watch history, and we don't use analytics, ads or trackers.
- You can delete your account in the extension or the app. That cancels your subscription immediately.
What we process
| Data | Why | Where it comes from |
|---|---|---|
Email address and Google account id (the sub value) |
To create your account, sign you in and tie your plan and usage to you. | Google sign-in. We ask for the openid and email scopes only. |
| Time zone | Daily and hourly limits reset at your local midnight and hour. | Your browser, at sign-in. |
| Video id, language, title, channel and length of each video you summarize | To find or make the summary, to label your library entry and to work out time saved. | The extension, from the YouTube page you asked about. |
| A hash of that video's transcript, and the transcript itself | The hash looks up the shared cache. The transcript is sent only when no cached summary exists, to write one. | The extension, which reads the transcript from YouTube in your browser. |
| The summary text | To show it to you, and to keep it in your library. | Generated by OpenAI from the transcript. |
| Stars and tags you add to library entries (Plus) | To let you organize and find your summaries. | You, in the library page at app.2minrecap.com. |
| Usage counts, estimated cost and seconds of watching saved | To enforce your plan's limits, to stop abuse and to show you how much time you saved. | Our servers, as you use the service. |
| Plan, Stripe customer id and subscription id | To know whether you have Plus and to manage billing. | Stripe, when you subscribe. |
| Session tokens | To keep you signed in for up to 60 days. | Our servers, at sign-in. We store only a hash of each refresh token. |
| Short-lived abuse records | Which video ids you summarized and a hash of each transcript you sent, to limit abuse and to decide when extra views of a video are free. | Our servers, for up to 40 days. |
If you subscribe, the purchase is made through Link, Stripe's consumer service, which is the merchant of record: it sells you the subscription, charges you, handles tax and sends your receipts. Stripe and Link collect your name, card or other payment details, billing address and tax information under their own privacy policies. We never see your card number. Stripe tells us your plan status and gives us a customer id and subscription id.
If you email us, we receive your email address, the message and anything you attach. We use it only to answer you and to keep a record of the request.
The extension needs these Chrome permissions: access to youtube.com, to show the summary button and
read the transcript of a video when you ask; storage, for your settings and session;
identity, for Google sign-in; and sidePanel, to show summaries next to the
video; and access to api.openai.com, used only if you add your own OpenAI key. It reads nothing on
other sites.
Our servers run on Amazon Web Services. AWS and its network see your IP address when your browser connects, as any web host does. We don't write IP addresses to our database and we don't turn on CloudFront access logs. Our application logs record events such as sign-ins, account deletions and errors (with an internal user id), and are kept for 30 days. They never contain transcripts or request bodies.
We rely on these legal bases under the GDPR: performing our contract with you (accounts, summaries, billing), our legitimate interest in running a secure service and preventing abuse, and, for the Google sign-in itself, your consent when you approve it. We keep billing records where tax and accounting law requires it.
What we don't collect
- Your YouTube watch history, searches, subscriptions, comments or playlists.
- Anything about videos you don't ask us to summarize. Thumbnails and page details are read in your browser and stay there.
- Your name, profile picture, contacts or any other Google data. We receive only your email address and account id.
- Your OpenAI API key, if you use one. See below.
- Analytics, advertising identifiers, fingerprints or third-party trackers. This website sets no cookies and loads no third-party scripts, fonts or images.
We don't sell your data and we don't use it for advertising.
The shared cache and your library
Two stores hold summaries, and they work differently.
- The shared cache is keyed by the video, the transcript hash, the language and the model. It holds no user id and no email. When someone asks for a video that already has a summary for the same transcript, we serve it instead of paying OpenAI again. Entries expire after 30 days.
- Your library is private to you. Every summary we serve you is saved there, one entry per video, with the video id, title, channel and time. An entry holds the latest short and the latest long summary of that video, and any stars and tags you add. You can open it at app.2minrecap.com/library. You can delete a single entry or clear the whole library there, and the data is removed straight away. Summarizing a video again creates its entry again.
On the Free plan the library page shows the last 7 days. Older entries aren't deleted: we keep them, hide them, and don't send them to your browser. They show again if you upgrade to Plus, and you can delete them at any time. Plus shows everything.
The library page shows each video's thumbnail, which your browser loads from YouTube's image
server, i.ytimg.com. That server sees your IP address and which thumbnails you load,
and YouTube handles that under Google's privacy policy. We ask your browser not to send a referrer
with these requests. Searching and exporting your library happen in your browser.
Using your own OpenAI key
You can use your own OpenAI API key under Settings, then Advanced in the extension. The key is
stored in chrome.storage.local in your browser and is sent only to api.openai.com. It
never reaches our servers. In this mode your requests don't go through us at all: we get no
transcript, no summary and no usage data, and no account is needed.
Who processes data for us
| Provider | What it does | What it receives |
|---|---|---|
| OpenAI | Writes the summaries through its API. | The transcript, a fixed instruction and a pseudonymous identifier: a one-way hash of your account id, which OpenAI asks for so it can tell abusers apart. No email address. We ask OpenAI not to store the response. Under its API terms, OpenAI doesn't train its models on API data and may keep requests and responses for up to 30 days to detect abuse, unless the law requires longer. |
| Amazon Web Services | Hosts the API, the database and this website (Lambda, DynamoDB, CloudFront, S3, in the US East region), and receives email sent to us. | Everything described in this policy that we store or process, including support emails. |
| Stripe and Link | Link is the merchant of record: it sells the subscription, takes payment, handles tax, sends receipts and lets you manage the subscription. Stripe runs the payment and billing systems behind it. | Your email address and the payment details you give them. |
| Signs you in, distributes the extension through the Chrome Web Store, and hosts the inbox where we read support email (Gmail). | That you signed in to 2-Min Recap, under Google's own privacy policy, and any email you send us. |
When else we share data
We don't sell your personal data or share it for advertising. Apart from the providers above, we only share it:
- when the law requires it, for example a valid court order or subpoena, and we will tell you unless we're not allowed to;
- when it's needed to protect the service, our users or others from fraud, abuse or harm;
- if Tinkerforge Labs LLC or 2-Min Recap is sold, merged or reorganized. The new owner would have to keep to this policy, and we would tell you before your data falls under a different one.
How long we keep it
| Data | Kept for |
|---|---|
| Transcripts | Not stored. Used to write the summary, then discarded. |
| Profile (email, id, time zone, plan) | Until you delete your account. |
| Library entries | Until you delete the entry, clear your library or delete your account. On the Free plan, entries older than 7 days are kept but hidden until you upgrade or delete them. |
| Usage counts and time saved | About 13 months, then they expire. Deleted sooner with your account. |
| Shared cache entries | 30 days. They hold no user id. |
| Abuse records (video ids and transcript hashes) | Up to 40 days. Deleted sooner with your account. |
| Refresh-token records | Up to 60 days, including after you delete your account. They are keyed by a hash or random id, so they can't be looked up by person. |
| Application logs | 30 days. |
| Support emails | The copy our mail server receives: 30 days. Our inbox: as long as we need to handle your request and keep a record of it, at most 2 years. |
| Stripe and Link customer and invoice records | As long as Stripe, Link and the law require. We don't control this. |
Security
Everything travels over HTTPS. Data at rest is encrypted by AWS. The database and storage are private to our servers, and only the people who run the service can reach them, through accounts protected by multi-factor authentication. Sign-in tokens are short-lived, and we store only hashes of refresh tokens. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
Cookies, local storage and tracking signals
- This site (2minrecap.com) sets no cookies and uses no analytics or tracking.
-
The account site (app.2minrecap.com) sets one cookie when you sign in, which holds your
refresh token and keeps you signed in. It is strictly necessary for the service, so we don't ask
for consent. It is called
trc_refreshand isHttpOnly,SecureandSameSite=Strict, set for this host only and limited to the sign-in path (/v1/auth). It lasts up to 60 days or until you sign out. The app keeps its short-lived access token in memory only. -
The extension stores your session tokens, a cache of recent transcripts and
summaries (kept for days), your time-saved totals and, if you use one, your OpenAI key in
chrome.storage.local, in your browser. Your preferences, such as summary language, usechrome.storage.sync, which Chrome syncs through your Google account under Google's terms. We never see them.
We don't track you across sites, so there is nothing for Do Not Track or Global Privacy Control signals to turn off: the service works the same whether or not your browser sends them.
Deleting your data
You can delete your account in the extension (Settings, then Delete account) or on the account page at app.2minrecap.com. Deleting:
- cancels a Plus subscription immediately, with no refund for the rest of the period you paid for;
- signs you out everywhere;
- deletes your profile, usage counts, library and abuse records.
To remove summaries without closing your account, delete single entries or clear your library on the library page. Clearing works on every plan and also removes the entries the Free plan hides.
It doesn't remove the shared cache (it holds no user id and expires on its own), refresh-token records (up to 60 days), or what Stripe keeps. If you sign in again later you get a new, empty account. Local data in the extension is removed when you uninstall it. If you can't use either route, email support@2minrecap.com from the address on your account.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, export it, object to or restrict how we use it, and complain to your data protection authority. If you are in California, you also have the right to know what we collect and to delete it, and we don't sell or share personal information. Email support@2minrecap.com to use any of these rights, from the address on your account so we can tell it's you. We answer within 30 days, free of charge, and using your rights never changes the service or price you get.
Where data is processed
Our servers are in the United States (AWS US East). If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the US, where we are based, so that we can provide the service you asked for. Our providers protect data they process for us with standard contractual clauses or the EU-US Data Privacy Framework (and its UK and Swiss extensions).
Children
2-Min Recap is not for children under 13 (or under 16 where local law sets that age for consent). We don't knowingly collect their data. If you think a child has an account, email us and we will delete it.
Google and Chrome Web Store user data
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. 2-Min Recap's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice: we use the data described here only to provide 2-Min Recap's single purpose, summarizing the YouTube videos you choose, and to keep it running and secure. We don't sell it, use it for advertising or to decide creditworthiness, or let people read it, except with your consent, for security or abuse investigations, or where the law requires. We don't use it to train AI models, and OpenAI doesn't train on it either.
Changes and contact
If we change this policy in a way that matters, we will update the date above and tell signed-in users in the extension or by email at least 14 days before it takes effect.
Questions or requests: support@2minrecap.com.