Privacy Policy

1. Who We Are

Highlyt is a mobile application and related web service operated by Aylin Albay as an individual developer located in the United Kingdom.

"Studio Eight" is used purely as branding for the project and does not represent a registered corporate legal entity. Aylin Albay is the sole data controller responsible for your personal data.

2. Scope

This Privacy Policy describes how we collect, use, store, share, and protect your personal data when you use the Highlyt mobile application and our official public website (https://highlyt-app.web.app).

3. Information We Collect

We process only the personal data strictly required to provide and secure Highlyt. Based on our current technical architecture, we collect:

A. Account & Identity Information

Depending on the sign-in provider (such as Google Sign-In or Sign in with Apple) and the information made available by that provider, Highlyt may receive an account identifier, email address, and basic profile information used for authentication and account management.

B. User Activity & Workspace Data

To provide your personal workspace, Highlyt stores your saved video history (saved YouTube video links), AI conversation history, and user questions or prompts submitted during video Q&A sessions.

C. Video & Transcript Information

When you request analysis of a YouTube video, we retrieve public YouTube video metadata (such as video ID, title, description, channel name, publication time, thumbnail image URL, duration, view count, tags, and category) and video transcripts through specialized transcript providers (such as TubeAlfred or youtube-transcript.ai).

D. Subscription & Entitlement Data

We manage subscription entitlements (such as Highlyt Pro) using RevenueCat. RevenueCat processes information needed to manage subscription status, including the app/user identifier used by Highlyt, subscription and entitlement status, purchase or transaction status supplied through the store, and subscription expiration or renewal timestamps where applicable. Highlyt does not receive or store full payment-card details. All financial transactions are processed directly by Apple (App Store) or Google (Google Play Store).

E. Technical & Security Records

We record rate-limiting events and operational server logs (request identifiers, HTTP status codes, and processing duration) to enforce service limits and prevent abuse. We do not collect precise geographic location, device advertising identifiers, or run tracking pixels or analytics frameworks.

4. Legal Bases for Processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases to process your personal data:

• Performance of a Contract: Processing necessary to create and manage your account, deliver video summaries and AI features, save your video history and conversations, and maintain your active subscription entitlements.
• Legitimate Interests: Processing necessary to secure our application, enforce rate limits, prevent fraudulent or abusive API usage, ensure service performance, and respond to support requests.
• Legal Obligation: Processing necessary to comply with applicable UK legal requirements or lawful requests.

5. AI Features & Data Processing

Highlyt provides AI-powered summaries, answers, chapters, and highlights using Google Gemini models via secure serverless functions.

• Data Transferred: Only the relevant video transcript segments and your explicit prompt or question are transmitted to the Gemini API to generate requested responses.
• No Automated Decision-Making: Highlyt does not use automated decision-making or profiling that produces legal or similarly significant effects concerning users.
• Accuracy Notice: Generative AI models may occasionally produce inaccurate, incomplete, or misleading outputs. Users should independently verify critical information.

6. Third-Party Services and Recipients

We rely on third-party services to deliver Highlyt. The primary service providers and their roles include:

• Supabase: Authentication, database, and backend infrastructure.
• Google / YouTube API Services: Public YouTube video metadata used by Highlyt features.
• Google Gemini: AI processing for relevant transcript content and user prompts.
• RevenueCat: Subscription and entitlement management.
• Apple and Google: Authentication and/or app-store purchase infrastructure.
• TubeAlfred and youtube-transcript.ai: Transcript retrieval providers.
• Firebase Hosting: Hosting for the public Highlyt legal and support website.

7. YouTube API Services & Google Disclosures

Highlyt uses YouTube API Services to display public YouTube video details and generate AI analysis.

• By using Highlyt features powered by YouTube API Services, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.
• Google Security Settings: You can review and manage applications connected to your Google Account through Google security settings.
• YouTube Data & Authorization Model: Highlyt currently accesses non-authorized, publicly available YouTube video metadata (title, description, thumbnail, channel details, duration, view count, and publication date). Google Sign-In is used for account authentication only and Highlyt does not request authorization to access your private YouTube account, channel, or other Authorized YouTube Data.
• 30-Day Refresh & Caching Policy: In compliance with YouTube Developer Policies, stored YouTube video metadata is refreshed or treated as stale no later than 30 calendar days after retrieval.
• Data Deletion: You may request deletion of your stored user data at any time as described in Section 9 below.

8. Data Retention & Shared Caches

• Account-Bound Data: Saved video history, AI conversations, and account records are retained while your account remains active or until you request account deletion.
• 30-Day YouTube Refresh: Cached YouTube video metadata is refreshed from YouTube API Services at least every 30 calendar days.
• Shared Service Caches: Highlyt maintains shared service caches for video-related material such as video metadata, transcript text obtained from transcript providers, timed transcript cues, generated analyses, chapters, highlights, semantic segmentation maps (video_semantic_maps), and RAG index data. These shared cache records are not stored as data belonging to an individual Highlyt account and therefore are not automatically removed merely because one user deletes their account. They remain subject to applicable provider, API, legal, and retention requirements.
• Anonymized Records: Upon account deletion, RevenueCat webhook event records are anonymized by removing user identifiers to preserve system event deduplication without identifying deleted users.

9. Account and Data Deletion

You can request permanent account deletion at any time by visiting our dedicated Delete Account page or by emailing studioeightdev@gmail.com with the subject "Highlyt Account Deletion Request".

10. Your UK GDPR Data Protection Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Right of Access: You may request copies of your personal data held by Highlyt.
• Right to Rectification: You may request correction of incomplete or inaccurate data.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and personal data.
• Right to Restrict Processing: You may request that we limit processing of your personal data under specific circumstances.
• Right to Data Portability: You may request transfer of your data to another service where technically feasible.
• Right to Object: You may object to processing based on legitimate interests.

To exercise any of these rights, contact us at studioeightdev@gmail.com. We respond to verified data subject requests in accordance with UK data protection timeframes.

You also have the right to lodge a complaint with the UK data protection authority:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk

11. International Data Transfers

Some of our service providers operate internationally, so personal data may be processed outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we rely on applicable safeguards provided for under UK data protection law and by the relevant service provider.

You can contact studioeightdev@gmail.com if you would like further information about international data transfers relevant to Highlyt.

12. Security

We implement technical and organizational security controls, including encrypted HTTPS transmissions, Row Level Security (RLS) on user databases, token-based authentication, and strict server-side service-role isolation. However, no internet transmission or electronic storage is completely infallible, and absolute security cannot be guaranteed.

13. Children's Privacy

Highlyt is not specifically directed at or marketed to children. Users must have the legal capacity to agree to this Privacy Policy or have obtained required parental consent under applicable law. If we discover that personal data of a minor has been collected without appropriate consent, we will take prompt steps to delete it.

14. Cookies & Tracking Disclosures

Our public website and mobile application do not use advertising cookies, analytics cookies, tracking pixels, or third-party marketing frameworks.

15. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our service or legal obligations. Revisions will be posted on this page with an updated effective date.

16. Contact Us

For any privacy questions, data protection inquiries, or deletion requests, please contact:

Aylin Albay
Email: studioeightdev@gmail.com
Location: United Kingdom