Privacy policy for Chrome

Your setup choices

Before recording begins, Ledger asks you to choose a passphrase, save a recovery key and choose what to track. Recording, automatic recommendation hiding, learning watch status from YouTube and background upload checks start unchecked. YouTube lookups and images have a separate opt-in. Account actions require another opt-in and a choice to subscribe, send channel feedback or remove selected Watch Later videos. You can change these choices in Settings. Explicit notes, groups, local imports and exports remain available while tracking is paused.

YouTube Ledger's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Information is used only for the user-facing features described here. The developer does not sell it, use it for advertising or credit decisions, or transfer it to data brokers.

Information Ledger handles

• YouTube activity: video and channel titles, IDs and addresses, available portrait addresses, timestamps, locally generated session IDs, and time spent in foreground playback, background audio, silent background playback, pauses or buffering, browsing and detected ads. Ledger reads playback position, speed, audio status and page focus to calculate these records.
• Watch status and entry points: played-position ranges, video duration, last position, observed finishes, manual watched/unwatched choices, and evidence from YouTube progress bars or history. Supported links and navigation can identify a video as opened from search, recommendations, subscriptions, Watch Later, a channel or a Ledger group. Group names and queue transitions can be part of this local context. Unobserved sources are marked unknown.
• Recommendation activity: show/hide actions, observations of Home recommendations visible while YouTube has focus, video and channel IDs, titles and addresses, portrait addresses, timestamps, local visit identifiers and whether you opened a card. Discover combines these observations with your saved viewing history to calculate channel statistics.
• Subscription checks and channel feedback: the subscriptions shown by your signed-in YouTube account, a hashed account identifier used to keep pending feedback tied to that account, and channels you explicitly ask YouTube to stop recommending. Feedback records contain the channel, request time and status. Ledger also saves your Discover dismissals and reminders, and your choice of all or subscribed-only recommendations.
• Your entries: daily notes, purpose labels, instructions for exported reviews, group names, channel memberships, chosen icons, local images and GIFs. Image processing occurs locally.
• Preferences and caches: themes, tracking choices, group ordering and filters, hidden-video and caught-up choices, last visits, cached public upload metadata, approximate upload dates where necessary, channel portraits and lookup times.
• Access credentials: your passphrase and recovery key are processed locally to protect or unlock the profile. Ledger stores protected key material, not the passphrase or recovery key. Optional automatic access saves a browser key as explained below.
• Request diagnostics: local counts and recent records of Ledger's public YouTube lookups, including timestamp, purpose, public video/channel address, HTTP result and elapsed time. Logs omit cookies, response bodies, playback traffic, images, other extensions and YouTube's own requests.

Ledger does not capture video, audio, screenshots, YouTube account passwords or account cookies. It does not monitor unrelated websites, and incognito use is disabled. It does not connect to an AI service or submit your viewing to a model.

Optional YouTube connections

When you enable YouTube lookups and images, Ledger requests individual public channel, upload-list and video pages or feeds to resolve channels and refresh cached uploads. It reads metadata from the responses, not executable code. Requests go directly to YouTube over HTTPS and omit account cookies. Thumbnail and portrait requests go to YouTube's Google-operated image hosts with no page referrer. These services receive the requested address and normal network information, such as your IP address. Ledger does not upload your notes, group names, watch-time totals or complete history database.

Automatic upload checks also require their own setting. They run in paced batches while a YouTube tab is open, reuse caches and respect cooldowns. Browser suspension, server responses and YouTube layout changes can delay checks or leave cached uploads incomplete. Disabling connections cancels Ledger lookups and removes remote-image sources; it does not undo requests already received by a service or stop YouTube's own page and playback traffic. Opening a link navigates to the linked website normally.

The subscribed-only recommendation filter and Discover read YouTube's subscriptions pages using your current signed-in session, including continuation pages when needed. These requests include the account session managed by your browser. Ledger does not read or store authentication cookies. It reads channel identifiers and available handle aliases to exclude subscribed channels from Discover and filter recommendations already provided by YouTube. It does not request a new recommendation feed or send its channel statistics to YouTube. The subscription list stays in the tab's memory.

Watch Later cleanup requires separate account-action consent and its own setting. On the supported English desktop Watch Later page, Ledger reads loaded rows and progress bars. You choose videos and confirm the removal count before Ledger operates YouTube's native removal controls in your signed-in account. It does not remove videos automatically after playback, read account cookies or call a private account API. This changes your YouTube Watch Later list, not your Ledger history.

“Update watch status” can open your signed-in YouTube history page for a check you request. You can also preview a Google Takeout YouTube history file locally and choose to import seen videos. The file is not uploaded. Ledger retains video IDs and available viewing dates, not other fields from that history file. Files over 50 MB are rejected and retained evidence is limited to 20,000 videos. This evidence does not invent playback duration or resume positions. Explicit imports and checks remain available while tracking is paused.

Discover and YouTube account actions

Discover shows unsubscribed channels you watch repeatedly and, in a separate list, channels that appear repeatedly in your observed Home recommendations. The second list excludes channels in the first. Its statistics describe what Ledger observed in this browser, not everything YouTube recommended or how YouTube's algorithm works. Channel pictures and the thumbnail of your last watched video use the same optional image connections described above.

While tracking is on, a Home card counts once per visit after at least half of it is visible for one second, or when you open it. Hidden tabs, covered cards and the subscribed-only view do not count. Observations are kept for up to 30 calendar days, limited to 1,200 cards and 300 visits per day and about 1.5 MB overall. Pruning runs during use. Pausing tracking stops new observations; deleting a day or date range also deletes its observations. Dismissing a channel or setting a reminder affects Discover locally.

Choosing Don’t recommend channel asks Ledger to operate YouTube's own control for that channel. If a matching recommendation is unavailable, the request remains Pending. You can view and cancel saved requests in Discover even when subscription lookups fail or YouTube connections are off. Unsent requests expire 30 days after you make the choice; Ledger will not send them after that deadline. Discover shows when each request was made and when it expires. Ledger may send it later when the same account has a matching recommendation in a focused, idle tab. It checks the account and subscriptions again, cancels requests for newly subscribed channels, and marks a request complete only after YouTube confirms it. An interrupted or uncertain send is not retried automatically.

Pending feedback is stored in the encrypted browser profile with a hash of YouTube's account identifier, not the raw identifier. The hash is an account-matching marker, not an anonymity guarantee. The list keeps up to 100 requests and their statuses; it is excluded from backups and sync. Turning off YouTube lookups or account actions stops sends but preserves the request list. Expiration is checked when Ledger next uses the list and again before sending. Expired entries remain available to review or remove; requests already sent or with an uncertain result keep their status. Cancelling a pending request cannot undo feedback already received by YouTube.

Choosing Subscribe in Discover reads that channel's subscription-control metadata using your signed-in session, then operates YouTube's native Subscribe button in the current tab. Ledger verifies the account and channel, cancels pending “Don’t recommend” requests for that channel, and rereads the subscription list to confirm success. It does not queue subscriptions for later or automatically retry an unconfirmed send. YouTube receives the subscription or feedback action in your account; the developer does not receive it.

Encryption and automatic access

Ledger stores records and preferences, including Discover observations and pending channel feedback, in an encrypted IndexedDB database belonging to the extension. AES-256-GCM encrypts each record, and RSA-OAEP protects each record's random key. Separate passphrase and recovery-key protection lets either credential unlock the saved profile. New opted-in viewing can be encrypted with the public key while locked. Discover observation collection, pending feedback, saved groups, prior watch status and metadata checks resume after unlocking.

With passphrase-only access, the unlocked key stays in extension memory and trusted, memory-only Chrome session storage. Restarting Chrome or reloading the extension requires unlocking again. A service-worker restart during the same browser session does not normally require it.

Open automatically in this browser is unchecked by default. Enabling it saves a non-extractable Web Crypto private key in the extension's IndexedDB beside the encrypted records. Non-extractable restricts the Web Crypto export API; it does not guarantee encryption of that key on disk. Anyone who can use or copy this browser profile may be able to open Ledger. This option does not provide the same protection as passphrase-only access or a key stored outside the browser profile. Turning it off requires a working passphrase or recovery key and logically removes the saved browser key. The key and automatic-access choice are excluded from exports. Full profile backups still need their original passphrase or recovery key.

The first encrypted setup verifies encrypted copies before removing older readable Ledger records from extension storage. This is logical deletion, not secure erasure of browser files, disk remnants or device backups. Encryption cannot protect an unlocked browser against someone using it, compromised extension code, malware or operating-system memory capture. There is no developer password-reset service.

While locked, the encrypted recording inbox is capped at 64 MB. If it fills, Ledger warns you and retries while the YouTube tab stays open. Unlock to organize the recordings and make room. Pause/setup state, vault identity, public-key configuration, random recording generation, record counts and sizes remain visible without unlocking; viewing details remain encrypted.

Retention and deletion

History and notes have no automatic expiry by default. Settings can retain the latest 30, 90 or 365 calendar days, including today. Applying retention deletes older history, notes, purpose labels and recommendation events immediately; pruning also runs during extension use. Groups, preferences and watch status have separate controls. Reversing a retention choice does not recover deleted records.

Upload caches keep at most 250 videos per channel and 5,000 overall, favoring newer releases. Removing a channel from every group removes its cache. Request diagnostics retain seven days of counts and up to 1,000 recent requests; the last recorded attempt and success per request type remain until cleared. Diagnostics are excluded from full profile backups.

Temporary link contexts last up to two hours. Queues keep up to 500 videos each, with at most eight queues, for up to 24 hours. Undo keeps up to 20 recent changes for five minutes, subject to size limits. These temporary records use memory-only extension session storage and are cleared when that session ends. Feed navigation hints stay in content-script memory and can be lost on reload. Link tokens in URL fragments are not sent in HTTP requests, but a page script can read its own URL.

Recording uses retry receipts to avoid duplicate seconds. At most 300 unsaved samples remain in a YouTube tab's memory for retry. Save failures show a warning and toolbar badge. Upload caches can be evicted to make space; this does not delete history or notes beyond your separately chosen retention policy.

• Pause tracking stops new activity, recommendation events and passive watch evidence. It preserves saved data.
• Delete this day, Delete date range, or Delete all history and notes removes the chosen activity, notes, labels and recommendation events. Separate watch-status records remain.
• Reset watch status clears resume positions, played-position coverage, manual overrides and YouTube/imported evidence, and turns passive learning off. History remains.
• Delete all Ledger data clears local history, notes, groups, icons, preferences, caches, watch status and temporary session records, removes automatic browser access and reloads with tracking off. The empty vault retains its access credentials. These actions do not erase YouTube account data or downloaded files.

You can edit notes and groups or remove Ledger through Chrome. Exported files and separate device backups remain until you delete them. The developer cannot access or delete records held only on your device.

Backups and files you share

Full profile backups, including the recovery copy created before a restore, are encrypted. They include history, notes, labels, groups and icons, preferences, retention choices, upload caches, group browsing choices, watch status, Discover observations and Discover dismissals and reminders. They exclude pending channel feedback and its account marker, the in-memory subscription list, the all/subscribed-only recommendation choice, temporary link/queue/undo state, connection consent, diagnostics and the automatic browser key. They require the passphrase or recovery key in effect when exported. Changing your current passphrase does not change old files.

Chrome can import supported older readable Ledger backups and encrypt them locally. Existing Firefox releases cannot open encrypted Chrome backups. A restore previews and validates the selected file, downloads a recovery copy, and replaces standard Ledger records only after you confirm. Imported retention choices can delete expired history.

Individual day, period, group-sharing, diagnostics and review-prompt exports remain readable files you explicitly create. They can contain viewing details, notes, labels and your browser's time zone. Keep them private unless you intend to share them. Exporting does not send a file to the developer. If you upload or paste one into an AI service or send it to someone, that recipient handles the information under its own policies.

This Chrome release does not include automatic cross-browser sync or a native companion. Each browser profile keeps its own data.

Permissions and external websites

Storage supports local migration and trusted session state. Access to www.youtube.com and m.youtube.com allows supported activity tracking, channel groups, Discover, subscription checks and the YouTube controls you choose to use. Ledger does not request alarms, the general browser-history API, access to unrelated sites, native messaging, a microphone or a camera. Runtime code is packaged with the extension.

The public policy is served by GitHub Pages under GitHub's privacy statement. This page has no analytics, remote fonts or trackers. Visiting it does not expose your Ledger history. YouTube, Chrome and websites you open operate separately under their own policies.

Changes and contact

Policy changes are recorded in the project repository. For questions, use the issue tracker. Issues are public; do not post private history, notes, credentials or backups.