Mayd It LLC / Privacy

Privacy Policy

Last updated 10 October 2026. What mayd-it.com and Report Watch collect, what our YouTube publishing tool does with data, what the employee portal stores, and how to request access or deletion.

1. Who we are, and what this policy covers

mayd-it.com is operated by Mayd It LLC, a limited liability company registered in the State of Washington, United States (UBI 606 247 926). Mayd-It Games is the brand we release games under, and "May'd it" is the consumer brand on this site; both are brands of Mayd It LLC, not separate companies.

Mayd It LLC is responsible for the personal data described here. For any privacy question, complaint, or deletion request, email bmay@mayd-it.com. A real person reads that inbox and we aim to answer privacy requests within 7 calendar days.

This policy covers mayd-it.com itself (including the data-tools pages, the guides, and the employee portal), the YouTube publishing tool we operate, and the browser apps we publish on our other subdomains - Health Coach, Study Buddy, the InfoSec tool, Exfil Matrix, Veilbreak, Red Cape, Home Builder and Report Watch. Those apps each link here, so this is their policy too; what each one does with your data is set out in section 5.

One product has its own separate policy: the game site, at deflekt.games.mayd-it.com/privacy. The section on YouTube API Services below is identical on both, and applies to the same single tool. Apart from that one exception, this page is the privacy policy for everything we run.

2. YouTube API Services

We run an in-house tool called DEFLEKT Marketing Machine. It cuts short clips of our own gameplay footage and uploads them to the one YouTube channel we own. This tool uses YouTube API Services.

Because it uses YouTube API Services, two other documents apply on top of this one:

• The YouTube Terms of Service, at https://www.youtube.com/t/terms. By using this API Client you agree to be bound by the YouTube Terms of Service.
• The Google Privacy Policy, at https://policies.google.com/privacy, which governs what Google itself does with data. Nothing in our policy changes or overrides Google's.

Revoking our access to your Google account

Access granted to our tool can be revoked at any time from the Google security settings page: https://myaccount.google.com/permissions (the same page is also reachable at https://security.google.com/settings/security/permissions). Removing our app there immediately invalidates the tokens we hold, and the tool can no longer upload anything. In practice the only Google account our tool has ever been granted access to is our own studio account.

What the tool accesses

• One YouTube channel, which we own. Nothing else.
• One permission scope: https://www.googleapis.com/auth/youtube.upload. That is upload-only. We deliberately did not request any broader scope.
• One API endpoint: videos.insert. That is the call that uploads a video.
• It reads nothing. The tool does not list, search, download, or analyse videos, channels, comments, playlists, subscribers, or viewer data. There is no analytics or reporting call anywhere in it.

What it stores, and where

The only thing the tool stores is the channel owner's own OAuth tokens (an access token and a refresh token). They are written into a local configuration file on the studio owner's own Windows PC, in his own office.

The tool itself has no backend server, no database, no cloud storage and no analytics pipeline. It runs entirely on that one PC: nothing it touches is uploaded to any system Mayd It LLC operates, and it never sends YouTube API Data anywhere except back to YouTube. It stores no YouTube API Data of any kind and no data about any viewer, subscriber, or other person.

How we protect it

• On the machine. The configuration file holding the tokens sits inside the Windows user profile of a single account and is readable only by that account. The drive is encrypted at rest with BitLocker, the machine requires a password to unlock, and it is physically in a private home office.
• In transit. Every call the tool makes to Google is made over HTTPS/TLS. The tokens are never sent anywhere except to Google.
• Nowhere else. The tokens are never copied to a shared drive, a cloud backup, a source repository, or any machine other than that one PC. They are excluded from version control.
• Blast radius. The only permission the tokens carry is upload-only access to our own channel, so even a compromise could not read, alter, or delete anything.

This is a statement about the marketing tool, not about every system we run. This website is hosted by Netlify and runs a private staff-login function, described in the "Employee portal" section below. That function is entirely separate from the tool described here and never receives YouTube API Data.

How we use, process and share that information

• Use: the tokens are used for one purpose only, which is to prove to Google that we are allowed to upload a video to our own channel.
• Processing: the tool reads the token from disk, sends it to Google as an authorization header, and writes the refreshed token back to disk. That is the whole of it.
• Sharing: the tokens are sent to Google / YouTube, and to nobody else, because Google is the party they authenticate us to. They are not shared with any other third party, any contractor, any advertiser, or any data broker.
• We do not sell, rent, trade, or transfer this information; we do not use it for advertising or ad targeting; we do not use it to build profiles of anyone; and we do not use it to train machine-learning models.

Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion of data

• YouTube API Data: none is retained, because none is ever obtained. There is nothing to expire. Were we ever to store authorized data, it would be deleted or refreshed within 30 days, as YouTube's developer policies require.
• OAuth tokens are kept only for as long as the tool is in use. They are deleted by revoking access at the Google security settings page linked above, and by clearing them from the local configuration file. Both are done by the channel owner on his own machine, and either one stops the tool working.
• Deletion requests. Anyone may ask us to delete data we hold about them by emailing bmay@mayd-it.com. We will action it within 7 calendar days and confirm by reply. You do not need an account, and you do not need to explain why.

There are no third-party users, and no third-party content

This tool is a first-party publishing tool for Mayd It LLC. It is not a product, not a service, not licensed, sold, or made available to anyone outside the company, and it has no user base beyond the one person who owns the channel. It therefore handles no third-party user information at all.

The tool does not allow any third party to serve content or advertisements through it, and it displays no advertising itself.

How the clips are made, and what we disclose on them

For transparency, since the videos say so themselves: the gameplay in our clips is played by an automated AI test pilot, captured on our own machine, and cut automatically. Nothing publishes without a human reviewing it and clicking approve. Every caption and video description carries this line: "Gameplay by our AI test pilot. DEFLEKT is made by one human + a lot of AI." The link in each description points at our own site and carries UTM tags so we can tell which clip sent someone there; those tags identify the clip, not the viewer.

3. This website

mayd-it.com is a set of static pages hosted by Netlify (Netlify, Inc., United States), plus one serverless function that powers the staff portal described in section 4. Here is everything the public part of the site does.

No analytics, no advertising, no tracking

We run no analytics of any kind on this site: no Google Analytics, no tag manager, no Plausible, Fathom, Matomo, Hotjar, Clarity, or anything similar. There are no advertising pixels, no session recording, no social media trackers, and no third-party embeds. We do not build visitor profiles and we do not sell or share anything about you.

Cookies and device storage

Browsing the public pages of this site sets no cookies at all and stores nothing in your browser's local or session storage. The company website's staff sign-in cookie is mi_sess, the strictly necessary sign-in cookie for our own employee portal, described in section 4. If you are not a member of our staff signing in, you will never receive it. There is no cookie banner because there is nothing optional to consent to.

Google Fonts

Our pages, including this one, load their typefaces from Google Fonts. That means your browser fetches files from fonts.googleapis.com and fonts.gstatic.com, and as part of any such request Google receives your IP address and your browser's user-agent string. That is a transfer of data to Google and we would rather tell you than not. What Google does with it is governed by the Google Privacy Policy. We receive nothing back from it, and if you block those domains the site still works in a fallback typeface.

Server logs

Like every website, this one has to receive your request in order to answer it. Netlify, as our host, processes your IP address and request details to deliver the page and keeps standard server logs for security and reliability. Netlify keeps these only for a short window - its documented log retention runs from about 24 hours to 7 days depending on plan - and then discards them. We do not export them, query them, build reports from them, or connect them to anything else, and we have no log drain or third-party monitoring service attached. Our host also applies standard security headers to every page.

Links out

The module cards and the footer link to our other products and to third-party sites such as the Apify Store and Steam. Those have their own terms and privacy policies, and we are not responsible for them.

4. The employee portal

The link marked "Employee Login" leads to a private portal for people who work at Mayd It LLC. It is not open to the public and there is no self-service sign-up. It is described here for completeness, because it is the one part of this domain that processes personal data in a meaningful way.

• Credentials. Each account has a username and a password. Passwords are never stored: what is stored is a scrypt hash with a per-user random salt. Optional two-factor authentication stores a TOTP secret so authenticator-app codes can be verified.
• Session cookie. Signing in sets a cookie called mi_sess. It is HttpOnly, Secure, SameSite=Strict, and expires after 12 hours. It carries a signed username and expiry and nothing else. It is strictly necessary to keep a signed-in user signed in, it is not used for analytics or advertising, and signing out clears it.
• Where it is stored. Accounts and the published company ledger live in Netlify Blobs, a storage service run by Netlify in the United States.
• Ledger refresh requests. When someone asks for a fresh ledger from the portal, a Netlify Form submission named ledger-refresh records the request time and the username the portal reports. That username is supplied by the page rather than proven by the session, so treat it as a label rather than as verified identity. Those are the only two fields we send; as with any web form, Netlify also records its own delivery metadata such as the submitting IP address.
• Retention. Account records are kept while the person works with us and are deleted when they no longer do. Sessions expire on their own after 12 hours.

5. Data tools, guides, and our other apps

The data-tools pages and their guides are reading material. They collect nothing beyond what section 3 describes, they set no cookies, and they have no forms. The tools themselves are published on the Apify Store and run on Apify's platform under Apify's terms and privacy policy, not on this site.

The browser-only apps listed below

The apps in this list run in your browser. Report Watch is described separately after the list. Unless a line below says otherwise, everything you type into them stays on your own device in your browser's local storage, is never transmitted to us, and can be erased at any time by clearing your browser data for that site. We have no accounts, no database, and no way to see any of it.

• Health Coach (health.mayd-it.com) - the vitals, goals and answers you enter, including anything health-related, are held only in your browser. The app makes no network requests at all: it never sends that information to us or to anyone else, and we never receive it. We hold no health data about anybody.
• Study Buddy (study.mayd-it.com) - your study progress and answers stay in your browser on the same terms.
• Veilbreak and Red Cape (vailbreakby.mayd-it.com, redcape.game.mayd-it.com) - game progress is kept in your browser. These pages load their 3D code libraries and some artwork from public content-delivery networks (jsDelivr, Cloudflare and an image CDN), which means those networks receive your IP address in order to serve the files, the same way Google Fonts does.
• Exfil Matrix (exfil-matrix.mayd-it.com) - a reference tool. It stores nothing and sends nothing.
• InfoSec tool (infosec.mayd-it.com) - this one is different, so read it. It is a bring-your-own-key tool. If you choose to use its AI features, you paste in your own API key for Anthropic or Google, and that key plus the assessment text you enter are stored in your browser and sent directly from your browser to whichever AI provider you chose. That traffic does not pass through us and we never see the key or the content, but it does leave your device and is then governed by that provider's terms and privacy policy. If you do not enter a key, nothing is sent anywhere.
• Home Builder (homebuilder.mayd-it.com) - this page has a contact form. If you choose to submit it, the name, email, phone number and message you enter are delivered to us through Netlify Forms so we can reply. We use it to answer you and for nothing else.

Most of these pages also load their typefaces from Google Fonts, with the same consequence described in section 3.

Report Watch

Report Watch is a hosted service with accounts and a server-side database. It is not a browser-only tool. The hosting platform's ChatGPT sign-in supplies a verified account identifier, email address and, when available, display name. We store these to identify the workspace, show its records, deliver notifications and associate billing. The app does not receive your ChatGPT conversations through this sign-in. Authentication and session handling are provided by the hosting platform.

CSV processing. Submitted CSV rows are processed in memory and are not saved as raw files in the application database. We retain report names and client labels, schedules and rules, normalized column names, row counts, check results and diagnostics, timestamps, intended deadlines, incident history, submission identifiers and fingerprints derived from the decoded CSV and its deadline. A fingerprint is not a copy of the file, but remains associated with the saved check. Treat report names, column names and other metadata as stored information. Use synthetic or sanitized reports without personal, confidential or regulated data while evaluating the service.

Support and AI. Questions, automatic answers, owner replies and conversation history are stored and available to the customer and the service operator. When AI support is used, the server sends the submitted question and product documentation/instructions to OpenAI. It does not automatically attach report rows, saved check records or account details. Anything you include in the question itself is part of that submission, so leave out API keys and report contents. The AI request disables stored response history, but that setting is not a promise of zero retention by the provider. AI allowance records retain an opaque support-ticket identifier, month, reserved allowance and timestamp independently of support-content cleanup; those identifiers are pseudonymous, not anonymous.

Billing and notifications. Stripe receives the email and internal workspace identifier used to create a billing customer, and handles payment information in its own checkout and billing portal. The application stores customer mappings, subscription plan state, checkout identifiers and billing-event receipts; it does not receive full payment-card details from those pages. Resend receives the recipient email address and notification subject/body, which can include a report name or deadline. We store queued notification text, delivery-attempt state and timestamps. Provider acceptance does not prove inbox delivery.

Hosting and access. OpenAI Sites provides hosting and ChatGPT authentication; Cloudflare runs the application and D1 database. A Netlify function forwards signed Stripe billing events to the service. Those providers process the requests and operational information needed to run their services. Report Watch also loads Google Fonts as described above. We use these services to operate accounts, checks, support, billing and notifications.

Retention, export and deletion requests. Settings offers a download of your saved workspace evidence and a deletion-request control. A request pauses reports, revokes submission tokens, cancels queued notifications and places new processing on hold. Saved records remain available for export and owner review. There is no automatic erasure deadline or automatic age-based deletion in this release; the latest-100 history display and saved-check limit are not retention periods. Contact bmay@mayd-it.com for review and confirmation of what can be removed.

Operator-reviewed workspace-content cleanup does not by itself erase retained account identifiers, billing mappings and receipts, deletion-request records, AI allowance records, provider-held records or hosting backups/logs. These need separate retention review. A deletion request does not cancel billing; use the billing portal to cancel a subscription. Withdrawing a request leaves the processing hold in place pending owner review. A provider request already in progress may finish, and an accepted email cannot be recalled. Do not treat a submitted request as completed erasure.

6. Who else receives data, in full

• Netlify, Inc. (United States) - hosts this website, runs the portal function, and stores the portal's data and form submissions.
• Google LLC (United States) - serves the webfonts, and is the destination for our own video uploads and the OAuth tokens that authorize them.
• jsDelivr and Cloudflare (public code and content delivery networks) - serve the 3D code libraries and some artwork used by our game pages, and therefore receive the IP address of anyone loading those pages.
• Anthropic PBC and Google (as AI model providers) - only if you personally use the InfoSec tool's optional AI features with your own API key. In that case your browser talks to them directly, as described in section 5. Nothing routes through us, and we never receive that content.
• Report Watch providers: OpenAI for Sites hosting, ChatGPT sign-in and AI support; Cloudflare for application execution and D1 storage; Stripe for payments and subscriptions; Resend for email; and Netlify for the signed billing-event relay. The information each handles is described in the Report Watch section.

These are the services used for the functions described in this policy. We use no advertising networks, data brokers, customer data platforms, analytics vendors or marketing automation. Report Watch providers also operate their own authentication, security, billing and service controls under their own terms.

7. Children

This site and our tools are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe we hold information about a child, tell us at bmay@mayd-it.com and we will delete it.

8. Where data is processed

Mayd It LLC is in the United States. The existing tools other than Report Watch use the US services described above. If you are in the European Economic Area, the United Kingdom, or elsewhere outside the US, using this site means your data is handled in the US. The only routine transfer that happens without you doing anything is the Google Fonts request described in section 3.

For Report Watch, we have not configured or verified a single-country processing guarantee. Its hosting, identity, payment, email and AI providers process data through their services. Contact us before submitting information with a data-residency requirement; do not infer a US-only guarantee from the company address.

9. Your choices

• Ask for a copy of anything we hold about you, or ask us to correct it.
• Ask us to delete it. You can contact us without an account or explanation. The existing promise to complete deletion within 7 days applies to tools other than Report Watch. Report Watch offers the processing hold and owner-reviewed procedure described in section 5; it does not promise complete erasure within 7 days.
• Revoke our Google access at https://myaccount.google.com/permissions.
• Block Google Fonts in your browser if you would rather Google not see the request.

All of these go to the same place: bmay@mayd-it.com.

10. Changes to this policy

If we change what we collect or how we handle it, we will change this page and update the date at the top. This page is linked from the footer of the site so it stays easy to find.

11. Contact

Privacy questions, complaints, and requests, including anything about our use of YouTube API Services:

Mayd It LLC
Washington State, United States · UBI 606 247 926
bmay@mayd-it.com