Privacy Policy

Last updated October 31, 2026

Widda (“Widda”, “we”, “us”) makes a Chrome extension for viewers and a web dashboard for YouTube creators. This policy explains what information we access, collect, store and use, and the choices you have. By installing the extension or signing in to the dashboard you agree to this policy.

YouTube API Services

Widda uses YouTube API Services to read which YouTube channels you subscribe to (viewers) and which channel you own (creators). By using Widda you also agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

Widda’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

When you sign in with Google we request three permissions: openid, email, and youtube.readonly (read-only access to your YouTube account). We never post, comment, subscribe, upload or change anything on your YouTube account.

Viewers (extension users)

• Google account ID. A stable identifier from Google so we can recognize your account. We do not store your name or email address for viewer accounts.
• Your YouTube subscriptions. The extension reads the list of channels you subscribe to and sends the channel IDs to our server. The server compares them against creators who have joined Widda and keeps only the matches (for example, “this account follows creator X”). Channel IDs that don’t match a Widda creator are discarded immediately and never stored.
• Your creator ordering. The order you rank your creators in is stored in your browser’s Chrome storage.
• Checkout events. On supported merchant sites, when you click Apply on a Widda card, we record which creator was credited, which site, the time, and technical details of the request (IP address and browser user agent) that we use to prevent fraud and billing abuse. We do not see what you buy, your cart, your payment details or your order total.

Creators (dashboard users)

• Google account ID, email address, and YouTube channel ID and name, read from YouTube so that your channel is verified rather than self-reported.
• Promo codes and affiliate links you enter.
• Billing information. Payments are processed by Stripe; we store a Stripe customer ID and invoice records, never your full card number.

Where the extension runs

The extension’s content script only runs on the merchant sites Widda supports (listed on the Chrome Web Store page and in the extension’s permissions). It does not read or record your browsing on other websites. On supported sites it may check for, and when you click Apply may set, an affiliate/referral cookie for the creator you chose. It never overwrites a referral that is already present.

Cookies and similar technology

The landing page does not use tracking cookies or third-party analytics. The dashboard stores a session token in your browser’s local storage to keep you signed in. The extension uses Chrome storage for your settings and session. No third party serves advertising in Widda.

How we use information

Only to run Widda: matching viewers to creators they already follow, showing those creators’ codes at checkout, crediting and billing creators for activations, preventing fraud, and responding to support requests. We do not sell personal information, use it for advertising, or use Google user data to train AI models.

Sharing

We share information only with service providers that host or operate Widda on our behalf — Amazon Web Services (servers and database), Cloudflare (network and hosting), Google (sign-in and YouTube API), and Stripe (creator billing) — or when required by law. Creators see aggregate counts of activations and the sites involved; they do not see which viewer activated their code.

Retention and refresh

• YouTube data. Subscription matches are refreshed from YouTube at least every 30 days while you use the extension; channels you unsubscribe from are removed at the next refresh. Data from YouTube that has not been refreshed within 30 days is deleted.
• Events and billing records are kept as long as needed for creator billing, fraud prevention and legal obligations.
• Account deletion. “Delete my data” removes your YouTube-derived data and account identifiers immediately. Requests by email are completed within 7 days. Billing records we are legally required to keep are retained without your personal details.

Your choices

• Revoke access at any time from your Google account at https://security.google.com/settings/security/permissions. When access is revoked, we delete the YouTube data related to you within 30 days.
• Uninstall the extension to stop all data collection from your browser.
• Delete your data yourself: in the extension, click Delete my data at the bottom of the popup; creators use Profile → Delete account in the dashboard. Deletion is immediate.
• Request access or deletion by emailing [email protected] from the address on your Google account.

Children

Widda is not directed to children under 13 and we do not knowingly collect their information.

How we protect your data

We treat Google user data, including data from YouTube API Services, as sensitive and protect it as follows:

• Encryption in transit. All traffic between your browser, the Widda extension, our website, our API and Google or Stripe uses HTTPS (TLS). Our servers sit behind Cloudflare, and the connection from Cloudflare to our servers is also encrypted.
• No Google tokens stored on our servers. The extension uses your Google access token only inside your browser to read your subscriptions, and sends us channel IDs, not the token. For creators, the access token is used once at sign-in to confirm which channel you own and is then discarded. We never store Google passwords or refresh tokens.
• Minimal data. We keep only what the service needs: subscription matches with Widda creators (non-matching channel IDs are discarded immediately), not your full subscription list, viewing history or YouTube content.
• Protected sessions. Widda sign-in sessions use random tokens; our database stores only a one-way hash (SHA-256) of each token, and sessions expire after 30 days.
• Restricted infrastructure. Our database runs on a private server and accepts connections only from our application on that same server; it is not reachable from the internet. The server’s firewall only accepts web traffic from Cloudflare, administrative access requires SSH keys, and secrets (such as API keys) are stored in files readable only by the system administrator.
• Limited access. Only Widda’s operator can access production systems and data, and only to run, secure, and support the service, or when required by law. We don’t sell Google user data, use it for advertising, or use it to train AI or machine-learning models.
• Payments. Card and bank details are entered on pages hosted by Stripe and are never sent to or stored on our servers.
• Retention and deletion. YouTube-derived data is refreshed at least every 30 days and deleted if it isn’t. You can delete your data at any time with Delete my data; revoking access from your Google Account also leads to deletion as described above. Backups are kept for at most 7 days.
• Monitoring and incidents. Our servers are monitored for failures, and we apply security updates regularly. If we become aware of a security incident affecting your personal data, we will notify affected users and the relevant authorities as required by law.

Changes

If we make material changes we’ll update the date above and, where appropriate, notify you in the extension or dashboard.

Contact

Questions or complaints about privacy: [email protected].