Privacy Policy
Effective date: August 6, 2026 · Русская версия · Terms of Service
This Privacy Policy describes what data is processed when you use the EchoWash service (the “Service”, “we”), on what legal bases, how the data is protected, and what rights you have. By using the Service, you agree to the processing of your data as described in this Policy.
1. General provisions
The EchoWash Service is available at https://echowash.ru and is designed to help you manage your digital footprint on YouTube: search, filter and delete comments, and import comment data through Google Takeout and the Google Data Portability API.
Personal data is processed in accordance with the EU General Data Protection Regulation (GDPR) for users located in the EU/EEA, applicable local data protection laws, and, where relevant, the Russian Federal Law No. 152-FZ “On Personal Data”.
2. Data controller
The controller that determines the purposes and means of processing is the entity operating the Service:
- Name / legal entity: [operator name or legal entity]
- Tax / registration ID: [tax/registration number]
- Address: [registered/postal address]
- Contact e-mail: support@echowash.ru
3. What data we process
3.1. Google / YouTube connection data
When you connect your Google account via OAuth, we process:
- the ID and name of the YouTube channel connected to the Service;
- Google access and refresh tokens required to work with the YouTube Data API and the Data Portability API;
- the information you authorised the Service to access on the Google authorisation screen.
Google tokens are stored on the Operator’s server encrypted using the Fernet scheme (AES-128-CBC + HMAC-SHA256) and are automatically deleted from the server upon logout or after 60 minutes of inactivity.
3.2. Comment content and metadata
As part of the Service, we process YouTube comments you request, in particular:
- comment text, comment, thread and video IDs, video title;
- comment author name, publication date, top-level comment flag;
- comment data imported via Google Takeout / Data Portability API (scope
dataportability.youtube.comments); - records of scan/delete jobs and their statuses.
The above data is stored on the Operator’s server only while the Service is in use and is automatically deleted from the server upon logout or after 60 minutes of inactivity.
3.3. Technical data
- a session cookie required for signing in;
- IP address and user-agent recorded in server logs;
- information about Service usage (for example, the number of processed comments).
The above data is stored on the Operator’s server only while the Service is in use and is automatically deleted from the server upon logout or after 60 minutes of inactivity (server logs — within no more than 30 days). The data is not disclosed to third parties, except as described in Section 7, and is not sold.
We do not process special categories of personal data (Art. 9 GDPR) and do not use data for advertising purposes.
4. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Providing the Service: searching, filtering and deleting comments, importing data | Performance of a contract (Art. 6(1)(b) GDPR); consent (Art. 6(1)(a) GDPR) |
| Connecting your Google / YouTube account and processing data through the YouTube Data API and Data Portability API | Consent expressed during Google authorisation (Art. 6(1)(a) GDPR) |
| Security, prevention of abuse and failure diagnostics | Legitimate interest (Art. 6(1)(f) GDPR) |
| Compliance with legal requirements and lawful requests | Legal obligation (Art. 6(1)(c) GDPR) |
5. Processing methods and security measures
- data is transmitted over HTTPS (TLS);
- Google tokens are stored encrypted using the Fernet scheme (AES-128-CBC + HMAC-SHA256) with a secret key;
- data is stored on a secured server (VPS) leased by the controller;
- access to data is restricted to authorised persons;
- when processing data obtained through the YouTube API Services, we comply with Sections 7 and 8 of the YouTube API Services Terms of Service and the YouTube Developer Policies.
6. Retention periods
- all user data is automatically deleted from the server upon logout or after 60 minutes of inactivity;
- tokens and channel information are retained no longer than the period of Service use (see above);
- server logs are kept for no more than 30 days, unless a longer retention is required by law.
7. Disclosure to third parties
- Google LLC / YouTube LLC — during authorisation and when working with the YouTube Data API and Data Portability API. Such data is processed in accordance with the Google Privacy Policy and the YouTube Terms of Service;
- hosting provider (VPS) — technical hosting of the server that runs the Service;
- jsDelivr (CDN) — when loading pages, your browser may request fonts from
cdn.jsdelivr.net, so the CDN sees your IP address. jsDelivr privacy policy: link.
We do not sell your data and do not share it with third parties for advertising purposes.
8. International data transfers
Processing in connection with Google may involve transfers of data to Google servers located in the United States and other countries. Google participates in the EU-US Data Privacy Framework. Other international transfers are made with appropriate safeguards or on the basis of your consent.
9. Processing through the YouTube API Services and the Data Portability API
The Service uses the YouTube API Services (YouTube Data API) and the Google Data Portability API to obtain and process comments solely with your permission. By using the Service, you also agree to:
You can revoke the Service’s access to your Google account at any time at https://myaccount.google.com/permissions, or disconnect the channel within the Service.
10. Cookies and local storage
The Service uses only a session cookie required for signing in and protecting your session. Advertising and analytics cookies are not used. For users in the EU/EEA, processing is carried out in compliance with the Google EU User Consent Policy: link.
11. Your rights
Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), withdraw consent at any time (without affecting the lawfulness of processing before the withdrawal), and lodge a complaint with a supervisory authority (Art. 77).
Under 152-FZ you have the right to receive information about the processing of your data (Art. 14), to request rectification, blocking and deletion of data, to withdraw consent, and to lodge a complaint with Roskomnadzor.
To exercise your rights, contact us at support@echowash.ru. We will respond within no more than 30 days from the receipt of the request.
12. Automated decision-making
The Service does not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing, including profiling (Art. 22 GDPR).
13. Children
The Service is not directed to individuals under 16 years of age. We do not knowingly collect data from children.
14. Changes to this Policy
This Policy may be updated from time to time. The new version will be published on this page with the date of the revision. Continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.
15. Contact
For questions regarding personal data processing: support@echowash.ru.