Private-first delivery with operator control.

What the integration does

DELIGENDA can send an already-produced canonical MP4 to the operator's authorized YouTube channel. Uploads begin as private. The service reads YouTube processing and visibility state before any later visibility change is considered.

Operator controls

The private control surface lets the authenticated operator select an eligible video, review or edit its title and description, choose Private, Unlisted, or Public as the desired visibility, explicitly declare Made for Kids status, and submit the upload. Before a new Google authorization transaction starts, the operator must review and accept the public Privacy Policy and Terms. Scheduled public publishing is a separate operator authorization and is disabled by default.

Fail-closed behavior

A desired visibility is not treated as proof of external visibility. If processing has not succeeded, the connected channel differs, OAuth/compliance identity cannot be proven, authorization has changed, or the external state changed concurrently, the video remains private and the service refuses a blind visibility retry.

Authorization and data controls

The operator can explicitly withdraw consent and disconnect the connected YouTube account from the private control surface. The service immediately blocks normal use of the stored credential, requests Google OAuth revocation, and deletes locally stored YouTube Authorized Data and local publishing authorization as soon as possible and no later than seven calendar days after withdrawal. Local deletion is attempted during the same disconnect operation even when Google's revocation result is ambiguous or unsuccessful.

If Google revocation cannot yet be confirmed, an encrypted credential may remain isolated only for an explicit revocation retry. It cannot be used for normal YouTube API operations or a fresh authorization while resolution is pending. Local deletion does not delete videos or other content already hosted by YouTube.

If Google instead reports during periodic refresh validation that the stored authorization is no longer valid, the local credential is invalidated and related local YouTube API data cleanup is triggered. A minimal local MP4 SHA-256 fingerprint may remain solely to prevent blind duplicate upload after YouTube API data deletion. Per-job YouTube API state is also pruned on a bounded 28-day retention schedule. See the Privacy Policy for the exact data-handling contract.