Derova Google User Data Disclosure

This disclosure summarizes how Music Migrator uses Google user data. Read it alongside the Music Migrator Privacy Policy.

Data accessed

For the SOURCE account, Music Migrator requests Google Data Portability access only to private, unlisted, and public playlist exports. It uses playlist metadata, visibility, video identifiers, and item order.

The exact SOURCE OAuth scopes are:

https://www.googleapis.com/auth/dataportability.youtube.private_playlists;
https://www.googleapis.com/auth/dataportability.youtube.unlisted_playlists; and
https://www.googleapis.com/auth/dataportability.youtube.public_playlists.

The matching archive resource groups are youtube.private_playlists, youtube.unlisted_playlists, and youtube.public_playlists.

For the DESTINATION account, Music Migrator uses the OIDC openid scope to obtain a verified stable account identifier and the youtube.force-ssl scope for supported YouTube Data playlist operations. The stable identifier prevents a prepared migration from running against the wrong destination account. The new flow does not request email access.

Purpose

The data is used to show a migration review and, only after user confirmation, create supported playlists and add their items in the DESTINATION account. Read-only destination inspection and reconciliation support safe recovery from interruptions.

Music Migrator does not use Google user data for advertising, analytics, user profiling, sale of data, or continuous account synchronization.

Storage and security

Migration data is processed and stored locally on the user's device. Refresh credentials are stored in Windows Credential Manager. Runtime access tokens are held temporarily in memory. Tokens are not stored in SQLite, exposed to the React frontend, or sent to a Music Migrator server.

Provider errors are redacted, and signed Data Portability archive URLs are restricted to validated Google Cloud Storage download boundaries and are not persisted in application databases or logs.

Retention and deletion

Active and recoverable state is kept while needed for safe resume. YouTube API-derived durable results and reconciliation observations are deleted or compacted at the implemented 30-day boundary. Terminal Data Portability operational metadata is retained for 90 days under Music Migrator's product policy. Application-managed raw Data Portability workspaces are cleaned after ingestion when no longer needed. Compacted history may remain until the user erases local data.

The in-app local erasure action removes credentials, local databases and side files, managed Data Portability workspace files, jobs, operations, observations, and history. It does not remove playlists already created on YouTube, revoke Google authorization, reset Data Portability authorization, or delete external Takeout files.

The current product has no Music Migrator migration-data backend, analytics, advertising, remote crash reporting, or telemetry. Required network communication is with Google services for OAuth, Data Portability, signed archive delivery through Google Cloud Storage, and YouTube Data API operations.

Limited Use

Music Migrator's use of information received from the Google Data Portability API complies with the Google Data Portability API User Data and Developer Policy, including its Limited Use requirements. This statement does not claim Google certification, verification, partnership, or approval.

Questions: privacy@derova.fr