Privacy policy

Your setup choices

On first setup, the recording, recommendation hiding, watch-state learning, and automatic-check options start unchecked. Before tracking starts, Ledger asks you to save your choices for recording activity, automatically hiding recommendations, learning watch status from loaded YouTube pages, and checking saved channel groups automatically. Profiles upgrading to this setup flow pause tracking until those choices are saved; existing records remain. The header eye still lets you manually show or hide recommendations before setup, without recording those actions. You can review these choices in Settings. Explicit group actions, local notes, and imports remain available independently of activity tracking.

YouTube Ledger's use of information received from Chrome APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Information is used only to provide or improve the user-facing features described here. The developer does not sell it, use it for advertising or credit decisions, or transfer it to data brokers.

Optional external connections

Version 0.17.1 adds separate connection controls in Settings. YouTube lookups and images start disabled, including after an upgrade to this version, until you explicitly allow them. In Firefox, Ledger also requests the optional “Browsing activity” and “Website content” data permissions. These cover the video/channel IDs, URLs, and image addresses used to retrieve public metadata or display images, including thumbnails for videos in local history. The recipients are YouTube and its Google-operated image hosts. Those services receive the requested address and ordinary network information such as your IP address. Public metadata requests omit account cookies; images suppress the page referrer. No Ledger history database, notes, group names, or watch-time totals are uploaded.

You can decline these permissions and still record or review local history, use cached groups, enter notes, and import or export files. Disabling connections in Settings, or revoking either required optional data permission in Firefox, stops new Ledger lookups, cancels active lookups, and removes remote-image sources. It cannot undo requests already received by a service. These controls do not block YouTube's own page or playback requests, or a website you explicitly open using a link.

YouTube account actions (Subscribe, channel recommendation feedback and Watch Later removal) have their own opt-in and Firefox “Website activity” permission, as described below. Connection consent is specific to the current browser installation and is not included in backups or imported from another profile. Earlier builds, including 0.17.0, have the public metadata and image requests described here but do not have these separate connection controls.

Information the extension handles

When tracking is enabled, the extension reads information from supported YouTube pages and stores the following in your browser profile:

• Viewing activity: video titles, channel names, video IDs and video URLs; available channel addresses and portrait-image URLs; first and last activity timestamps; locally generated session identifiers; and elapsed time for foreground playback, background audio, silent background playback, paused or buffering activity, browsing, and detected ads.
• Recommendation activity: actions such as showing or hiding recommendations, detections of recommendations visible while YouTube has focus, timestamps, locally generated event identifiers, and the relevant YouTube page path or video ID.
• Video entry points: a Ledger group link or supported observed recommendation, search, subscription, Watch Later or channel link, or a supported native autoplay transition or explicit Watch Later playlist playback; the group ID and name at launch when applicable, explicit queue transitions, and predecessor visit/video identifiers for observed viewing journeys. Unobserved entry points are marked unknown. These are included in viewing history and review exports.
• Information you enter: purpose labels, daily notes, and optional instructions for exported review prompts.
• Channel groups: group names, locally generated group identifiers, channel membership, channel names and IDs, canonical channel URLs, available portrait-image URLs and portrait lookup times, and group creation/update times, ordering, collapse/filter/sort preferences, last group visit times, hidden-video IDs, the video IDs and timestamps cleared with “Caught up” in New videos, and any symbols, emoji or local images you choose. Large GIFs are resized locally; uploaded icon files are not sent to a server. These are saved when you use the group controls, including while activity tracking is paused.
• Request diagnostics: seven days of local counts of Ledger’s public YouTube lookups and up to 1,000 recent records with timestamps, lookup purpose, request type (RSS or page lookup), priority, public channel/video/upload-list addresses, HTTP results and elapsed time. The most recent recorded attempt and successful lookup time for each request type are kept until the log is cleared. Cache checks and cooldown stops are counted separately. This log does not include cookies, response bodies, playback/image traffic, other extensions or YouTube’s own requests. It can be exported or cleared in Settings and is excluded from profile backups.
• Preferences: settings such as the dashboard theme, animation preference, recommendation visibility, and whether tracking is paused.

The extension also reads playback position, playback speed, audio status, and page focus to calculate activity durations. It also stores unique played position ranges, video duration, a natural-finish timestamp when observed, the last recorded playhead for Resume, and manual watch-state overrides to show Started/Watched status. It does not record video, audio, screenshots, passwords, cookies, or activity on unrelated websites. Private or incognito use is disabled.

How the information is used

The New videos view combines cached uploads from your saved groups without additional upload checks. Its Caught up receipts clear new indicators without changing watch status. Ledger can store the previous known upload date and detection time for a returning-creator notice after an observed quiet period. These records stay local, are included in profile backups, and are not sent to YouTube.

Information is used to provide the local viewing history, daily and period summaries, recommendation controls and activity counts, labels, notes, and exports you request. The extension does not use your information for advertising, profiling for third parties, or selling data.

Discover uses saved watch time and new local observations of Home recommendation cards. While tracking is enabled, it counts a video once per Home visit after it is at least half visible for a second, or when opened. Hidden tabs, covered cards and the Subscribed-only view are excluded. Records contain video/channel addresses, displayed names/titles, channel-picture URLs, timestamps, random visit identifiers and whether a card was opened. They expire after at most 30 days and have daily and total storage limits. History date-range deletion includes these records. Full local backups include observations and Discover dismissal preferences; companion sync does not share them. Opening or refreshing Discover reads your signed-in YouTube subscription list through the optional YouTube lookup connection; this list stays in tab memory.

In Discover, “Don’t recommend channel” requires account-action consent and your explicit selection. Ledger saves your choice locally if a matching recommendation is unavailable, then uses the native English YouTube menu when that channel next appears in an active, idle tab. Pending requests expire after 30 days and can be viewed and cancelled even when subscription lookups fail or YouTube connections are off. Discover shows their request date and expiration. Expiration is checked when the list is used and before sending; already-sent or uncertain requests keep their status. A local hash of the YouTube account identity prevents sending for a different account; subscriptions are rechecked before sending. Up to 100 requests and their results are retained in this browser, outside backups and companion sync. A request is marked complete only after YouTube confirms; an uncertain result is not retried automatically. Ledger does not construct a private account request or read authentication cookies. Channel pictures and last-watched video thumbnails use the existing image connection consent; a missing portrait may trigger a public channel lookup. “Subscribe” requires lookup and account-action consent and your explicit click. Ledger reads that channel’s subscription control data and lets YouTube’s own button handle the action in the current tab. It checks the signed-in account and channel, cancels pending Don’t recommend requests for that channel, and rereads subscriptions to confirm success. Unconfirmed requests are not retried automatically. No subscription is queued for later. Dismiss and reminder choices affect Discover locally and do not send feedback to YouTube.

Watch Later cleanup starts disabled. You can enable it in Settings for the supported English desktop YouTube interface. On the Watch Later page, Ledger can read the loaded video rows and YouTube’s visible progress bars to help you select watched videos. After allowing account actions and enabling cleanup in Settings, selecting “Remove selected” asks you to confirm the number of videos and that the change affects your YouTube account. Confirming operates YouTube’s native removal controls for those videos in your signed-in YouTube account. Ledger does not read account cookies or call a private account API for this feature. Selection stays in the page, is cleared on navigation, and is not uploaded to Ledger or an AI provider. Cleanup does not delete your Ledger viewing records and does not remove videos automatically after playback.

Channel groups organize creators locally. With YouTube connections enabled, when you add a channel from an address or supported YouTube page, Ledger requests the public YouTube channel or video page to resolve the creator's ID and name. These requests go directly to YouTube without account cookies. The requested video/channel address identifies the item being resolved. Group names, the complete membership list, and the history database are not uploaded. Group actions do not change your YouTube subscriptions. Opening a group feed or member list can also request public channel pages to find or update channel portraits, through the same paced request queue as upload feeds and video details, with one request at a time. Successful portraits are checked at most weekly and failed lookups at most daily.

With connections enabled, opening a group feed and permitted periodic checks of saved groups can request public upload feeds directly from YouTube without account cookies, and display thumbnails served by YouTube's image hosts. Ledger caches video IDs, titles, creator IDs and names, publication timestamps, available total durations, live/upcoming status, YouTube Shorts classification, and lookup/refresh times locally. The feed and membership controls remain available while activity tracking is paused.

When a public RSS feed is unavailable, Ledger can request the channel’s public uploads-list page without account cookies through the same paced queue. It reads only page metadata, follows no continuation pages, and stores up to 30 dated uploads from the first page. Rounded upload ages and view counts are marked approximate. The latest known upload date and up to 32 recent upload IDs and dates are stored with channel upload metadata, including whether dates are approximate. These help space checks for infrequent channels, recognize reliable daily or weekly schedules, and adapt when activity changes, even when older cached video entries are trimmed. Learning patterns uses saved metadata and makes no additional requests. These requests do not create or edit a YouTube playlist, open a player, or upload group names or the history database. They appear in the local request diagnostics.

Visible group cards can request public watch-page metadata directly from YouTube without account cookies to learn a video’s total length, live/upcoming status, or YouTube Shorts classification. These lookups use the shared queue with one outgoing request at a time, stop after reading the player metadata when possible, and are cached with upload records. They do not open a player or add Ledger watch records. Available durations are normally refreshed at most weekly; live and upcoming status is checked more often while visible, and failed lookups are retried at most hourly.

When both YouTube connections and automatic group checks are enabled, background refreshes can run while a YouTube tab is open, including a background tab, and unfinished refreshes can continue after leaving a group. They reuse cached uploads, pace requests, and respect server cooldowns. Check intervals adapt to observed upload schedules and failures; a due check can resume when you return to YouTube. Browser suspension or a temporary extension being unloaded can delay checks. Turn off “Refresh subscription groups in background” to stop automatic checks while retaining manual refresh, or disable YouTube connections to stop both. Closing all YouTube tabs also stops new background requests.

YouTube watch evidence and optional imports

When “Learn watch status from YouTube” is enabled and tracking is not paused, Ledger can read supported thumbnail progress bars and video entries on YouTube history pages you visit. It saves video IDs, observed progress percentages when available, observation timestamps, and the evidence source locally. These observations use content already loaded by the page and make no extra page requests. Progress of 90% or more can mark a video watched; a history entry without progress shows “Seen before,” with completion unknown. Evidence does not add playback time or invent a resume position.

“Update watch status” can open YouTube's signed-in history page for an explicit check. Scroll to load older entries through YouTube itself. This explicit action remains available while passive learning or tracking is off. You can also preview a Google Takeout YouTube watch-history JSON or HTML file locally and choose “Import seen videos.” Ledger retains only video IDs and available viewing dates, not the file's titles or other personal fields. HTML entries without parsed dates are treated as older evidence. The input file is not uploaded. Files over 50 MB are rejected; imports and retained evidence are limited to 20,000 videos. JSON imports prioritize recent entries, and the oldest retained evidence can be replaced at that limit. Manual Unwatched choices suppress previous YouTube evidence until you restore automatic status.

Storage and retention

Records and preferences are stored using the browser's local extension storage (storage.local). The extension does not send them to a developer-operated server or use browser sync storage. Chrome and Firefox profiles keep separate histories unless you enable local sync. Ledger does not currently encrypt its local records or exported JSON files; anyone with access to the relevant profile or export may be able to read them. Device or operating-system protections are separate from the extension.

With YouTube connections enabled, History, Review and group controls display available video thumbnails and channel portraits from YouTube image hosts. These image requests go directly to those hosts without a page referrer; they do not go through a Ledger server. Images load as needed, and missing images have a text or placeholder fallback. Portrait URLs and available channel addresses are included in profile backups.

History and notes have no automatic expiration by default. In Settings, you can keep the latest 30, 90 or 365 calendar days including today, or keep records until you delete them. Applying retention deletes older activity, notes, purpose labels and recommendation events immediately; pruning also runs on startup and during extension use. Watch status, groups, preferences, and upload caches are separate from this date-based retention. Changing retention back does not recover deleted records. The upload cache keeps up to 250 videos per channel and 5,000 overall, favoring newer releases. A channel's cache is removed when it no longer belongs to any group. Storage is managed by your browser and device; this policy does not describe any separate device backup or browser service you use.

Temporary group-link and observed-source contexts are valid for up to two hours. They are pruned when another feed context is created and cleared from extension session storage when the browser session ends. They associate random link tokens with a group and its displayed videos or an observed link source and destination video. Group queues store a snapshot of up to 500 videos and explicit navigation steps for up to 24 hours, with at most eight queues. Undo stores up to 20 recent changes and any removed channel cache needed to restore them for five minutes; larger snapshots are compressed locally and older records may be evicted sooner to limit storage. These records expire and are cleared when the browser session ends. No account playlist is created. Per-tab session storage preserves feed searches, scroll positions and an observed video entry point across navigation or reload; entry-point state is cleared when tracking is paused. Tokens are URL fragments and are not included in HTTP requests to YouTube, but a page script can read its URL fragment.

Recording saves use local retry receipts and observed wall-clock playback intervals to avoid duplicate seconds and distinguish playback from pauses. A failed save is retried while its YouTube tab remains open, with at most 300 unsaved samples held in that tab’s memory. If recording cannot be saved, Ledger displays a warning and toolbar badge. Local upload metadata may be evicted to make room for recording; quota recovery does not delete history, notes, groups or icons. A separately selected history retention period still applies. Operational warnings may use browser session storage when local storage is full. None of these records are sent to a server.

Optional sync on the same computer

Local sync pairs Chrome and Firefox through a separately installed companion on your Mac. It shares groups, watch status, history, notes, purpose labels, recommendation events, group browsing preferences and successful upload caches. It does not use a cloud service or send data to the developer. Tracking settings, YouTube permissions, themes and retention preferences remain local to each browser.

After you choose to connect, Ledger requests the optional native-messaging permission. Firefox also requests Browsing activity, Website content, Website activity, and Technical and interaction data permissions for the shared profile. The last category covers group browsing preferences and recommendation activity; no developer analytics are collected. Declining keeps sync off. Revoking any required sync permission stops the exchange, and you can disconnect in Settings. Existing sync users must confirm this consent after upgrading to 0.17.5. Once connected, browsers exchange an AES-GCM encrypted profile with the companion. The random pairing code is the encryption key; keep it private. Each paired browser stores the key and a readable merge record in its local extension storage. The companion receives only encrypted content and stores it in your macOS user account. Encryption of the companion copy does not encrypt your existing browser storage, JSON backups or downloaded conflict files.

Sync runs after local changes and periodically while the browser runs. A recovery backup downloads before the first connection. Records merge by identity, so copied history sessions are not added twice. Concurrent edits can conflict: one version is used and the other is retained for download. Deletions win over concurrent edits. Deletion markers and unresolved alternate versions remain in the sync profile; deleting a displayed record is not a purge of every recovery copy. Retention settings remain separate, but expired records are deleted from the shared profile when that browser syncs. Choose compatible retention periods in paired browsers.

Disconnect stops further sync and retains your local data, pairing and encrypted companion copy. Removing Ledger does not remove the companion database or files you downloaded. The local companion guide explains how to remove its registrations and storage. Safari and sync between computers are not included.

Your controls and deletion

• YouTube connections controls external lookups and images separately from local recording. The separate account-actions permission controls Subscribe, Watch Later removal and explicitly selected channel recommendation feedback. Both can be revoked in Settings; Firefox also exposes the optional data permissions in its add-on controls.
• Pause tracking stops saving new activity, recommendation events and passive watch evidence. Explicit history checks and local imports remain available. It does not delete existing records.
• Delete this day, Delete date range, and Delete all history and notes remove the selected activity, daily notes, recommendation events and purpose labels. Separate watch-progress and YouTube evidence records remain.
• Reset watch status removes resume positions, played-position coverage, manual watched/unwatched choices, and YouTube/imported watch evidence. It also turns passive learning off. Retained daily history stays saved; future playback or an explicit import can create new watch status.
• You can edit or clear notes and custom review instructions in the dashboard. Restoring default settings does not delete viewing history or daily notes.
• The Groups tab lets you rename or delete a group and remove individual channel memberships. Removing a channel from one group keeps memberships in other groups. Deleting groups does not delete viewing history.
• Delete all Ledger data in Settings removes local history, notes, groups, icons, preferences, caches, watch status and temporary extension session records. Ledger reloads with setup incomplete and tracking off. These controls do not remove YouTube account data or downloaded exports. You can also remove extension data through your browser's controls or uninstall Ledger. Files you previously exported remain wherever you saved them until you delete those files yourself.

The developer cannot access or delete records that remain only in your browser profile.

Exports and third-party services

JSON exports and LLM review-prompt exports are created locally as downloadable files. Depending on the export, they can include viewing activity, recommendation events, labels, notes, preferences, dates, and the time zone reported by your browser.

Full backup files also include the history retention preference, groups, chosen icons, upload cache, hidden-video preferences, last visit times, resume positions, watch state and YouTube/imported watch evidence. Temporary link, queue and undo contexts and setup/connection-consent records are excluded. Restoring a backup applies its saved retention period, when present, and removes expired history under that period. Restore validates a selected backup and replaces standard Ledger data only after you choose Restore. A recovery backup downloads first. The encrypted Chrome store edition can import supported readable Firefox backups. Firefox cannot open encrypted Chrome backups. Companion exchange is available only with a compatible build that supports local sync; the Chrome store edition does not include it.

No automatic LLM or AI service connection is included. If you choose to upload, paste, or send an export to an AI provider or anyone else, that recipient receives the information you share and handles it under its own policies. Exporting a file by itself does not send it to the developer.

Permissions

The storage permission saves your records and preferences locally. Access to www.youtube.com and m.youtube.com allows the extension to observe supported playback and page activity and show or hide recommendation elements. The optional Firefox data permissions describe transmission for the explicitly enabled features above; “Browsing activity” does not grant the browser history API. Ledger does not request access to unrelated websites, your general browser history, your microphone, or your camera.

This policy page and external websites

This policy page is hosted on GitHub Pages. GitHub processes requests to serve the page under its privacy statement. This page contains no analytics scripts, remote fonts, or embedded trackers. Visiting it does not give GitHub or the developer access to the extension's locally stored history.

YouTube, your browser provider, and other websites or services you choose to use operate separately under their own policies.

Changes to this policy

This page will be updated when the extension's information-handling practices change. The date at the top identifies the latest policy update. Its source and revision history are available in the project repository.

Contact

For privacy questions, contact the maintainer through the YouTube Ledger issue tracker. Issues are public, so do not include private viewing history, notes, exports, or other sensitive information.