Privacy Policy

Fulcrum Labs operates a portfolio of story-driven publications and the Foundry, our internal content production system. This Privacy Policy explains what information we collect, how we use it, how we store and protect it, and the choices you have about that information.

You can reach us at privacy@fulcrum-labs.com for any privacy question, data request, or complaint covered by this policy.

1. Information we collect

We collect two categories of information.

General website information. When you visit fulcrum-labs.com or any site we operate, our hosting infrastructure (Cloudflare) processes standard request data — IP address, user agent, referrer, request path — for security, abuse prevention, and aggregate performance measurement. We may receive a name and email address if you contact us directly or subscribe to a mailing list; we use that information only to respond to you or to send the messages you signed up for.

Google API services data. Fulcrum Labs's Foundry can connect to a YouTube channel that you own, with your explicit consent through Google OAuth. When you connect a channel, Foundry uses Google's Data Portability API with two scopes classified by Google as "sensitive":

• https://www.googleapis.com/auth/dataportability.youtube.public_videos
• https://www.googleapis.com/auth/dataportability.youtube.unlisted_videos

These scopes let Foundry request an archive of original-format YouTube video files (MP4 or other source uploads) and per-video metadata — titles, descriptions, recording dates, and similar fields — for channels you own. We do not request, and Google does not return, viewer data, comments, watch history, monetisation data, or any information about your audience.

2. Why we collect Google API services data

Foundry exists to preserve and re-use the original-format videos that channel owners (operators) have uploaded to YouTube, alongside their associated metadata, inside our internal production workflows. The Data Portability API is the supported way to retrieve operator-owned video files at their original quality. Without it, we would have to fall back to lower-quality transcoded streams, which would degrade the editorial work we do on operator content.

3. How we store and protect the data

When you connect a channel:

• Foundry stores your OAuth refresh token in our Cloudflare D1 database. The token is encrypted at rest with AES-GCM. The encryption key never leaves Cloudflare Workers secrets and is not embedded in client-side code.
• Foundry downloads the signed Cloud Storage archive that Google generates in response to a Data Portability request. Original-format video bytes are stored in Cloudflare R2; video metadata is stored in Cloudflare D1.
• Access to that storage is restricted to a small number of namedFulcrum Labs operators authenticated through Cloudflare Access (Zero Trust). We do not expose the data to public endpoints or to other users.

Cloudflare encrypts data in transit and at rest across R2 and D1 by default; our access controls layer on top of that.

4. How long we keep the data

We keep video files, metadata, and the encrypted refresh token for as long as a channel is connected to Foundry. If you disconnect a channel — either through Foundry's in-app disconnect, which calls Google's resetAuthorization endpoint, or by revoking access directly at myaccount.google.com/permissions — we will delete the encrypted refresh token immediately, and we will delete the associated video files and metadata within thirty (30) days of disconnect, unless you ask us to keep them.

You can also email privacy@fulcrum-labs.com at any time to request earlier deletion or to ask us to retain a copy after a disconnect.

5. Sharing and subprocessors

We do not sell your data, and we do not share it for advertising. The only third parties that handle the data described in this policy are:

• Google LLC — the source of the YouTube video data, and the identity provider for OAuth consent.
• Cloudflare, Inc.— our hosting, compute, and storage provider (Workers, R2, D1, Access).

If we ever add a new subprocessor that handles operator-owned video data, we will update this policy before that subprocessor begins handling the data.

6. Your rights

You have the right to:

• Revoke consentat any time through Google's account permissions page (myaccount.google.com/permissions) or through Foundry's in-app disconnect.
• Request a copyof the data we hold about you, including the metadata associated with your videos.
• Request deletionof your data, on the schedule described in section 4 or sooner.
• Object or restrict how we use your data, by contacting us at privacy@fulcrum-labs.com.

For data subjects in the European Economic Area, the United Kingdom, or Switzerland, these rights are governed by the General Data Protection Regulation (GDPR) and equivalent UK law. Our legal basis for processing your Google API services data is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. You also have the right to lodge a complaint with your local supervisory authority.

For California residents, the California Consumer Privacy Act (CCPA / CPRA) gives you the right to know what personal information we have collected, to request deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA.

7. Google API Services User Data Policy

Fulcrum Labs's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: we only use Google user data to provide the user-facing Foundry features described in this policy, we do not transfer that data to third parties except as listed in section 5, we do not use it for advertising, and we do not allow humans to read it except where you have given us specific consent, where it is necessary for security or to comply with applicable law, or where the data has been aggregated and anonymized and is used for internal operations.

8. Cookies and analytics

Fulcrum Labs uses Cloudflare Web Analytics, a privacy-first analytics product that does not set tracking cookies and does not build cross-site profiles. We may set a small number of strictly necessary cookies for security and session handling. We do not run advertising trackers and we do not use Google Analytics directly.

9. Children

The Foundry is not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided personal information to us, contact privacy@fulcrum-labs.com and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of the page. If we make a material change that affects how operator data is handled, we will also notify connected operators in-app or by email before the change takes effect.

11. Contact

For any privacy question, data request, or complaint covered by this policy, contact us at:

Fulcrum Labs
privacy@fulcrum-labs.com