Odinstat

Security at Odinstat

Last updated: 2026-09-05

Read-Only by Design

Odinstat connects to YouTube through Google's official sign-in using read-only analytics permissions. We can view your statistics; we cannot upload, edit, or delete videos, change settings, or act as your channel in any way. There is no write permission to misuse — it is never requested.

You can revoke access at any time from your Google security settings; we detect revocation within 24 hours, stop syncing, and purge stored API data after a 28-day grace period (or immediately if you disconnect in Settings).

Authentication & Access Control

Accounts are managed by Supabase Auth (email or Google Sign-In). Every database row is protected by PostgreSQL row-level security: queries run as you and can only ever return your own data. Channel collaborators see a channel only while the owner's explicit invitation stands, and only the metrics the owner has allowed — revenue, demographic, and geographic data are stripped server-side for collaborators without permission, including from reports and the AI assistant.

Data Protection

  • OAuth tokens are encrypted at rest (Fernet symmetric encryption) before touching the database.
  • All traffic is encrypted in transit (TLS).
  • Card details never touch our servers — payments are handled entirely by Stripe, a PCI DSS Level 1 provider.
  • Before any AI call, video and channel titles are replaced with anonymous placeholders; the model never sees identifying names.
  • API rate limits and per-plan quotas protect the service from abuse.

Infrastructure

A deliberately small footprint of established providers:

  • Supabase — authentication and PostgreSQL database
  • Vercel — web app hosting
  • Railway — backend and background jobs
  • Stripe — payments
  • Sentry — error monitoring (technical error reports only, never your analytics data)
  • Google — YouTube APIs and the Gemini API (paid tier: not used to train models)

Deletion & Retention

You can delete your account and all associated data from Settings at any time — deletion is immediate, also cancels any active subscription, and deletes your payment profile with Stripe. Disconnecting a single channel deletes its imported YouTube API data immediately. Data not refreshed within 30 days is deleted automatically, as YouTube's policies require. Exported report files expire after 7 days.

Reporting a Vulnerability

Found a security issue? Email support@odinstat.com and we will respond as quickly as we can. Please report privately rather than disclosing publicly first.