Privacy policy

This section covers the YouTube caption feature. Everything else Downlink does with YouTube — channel details, video metadata, playlists — runs on a public API key and involves no account access at all.

The permission Downlink asks for

One scope:

https://www.googleapis.com/auth/youtube.force-ssl

Google's consent screen describes this as "See, edit, and permanently delete your YouTube videos, ratings, comments and captions." That wording is Google's, and it covers every use the scope permits rather than the use Downlink makes of it. Downlink only ever reads. With your authorization it makes three kinds of request and no others:

• channels.list — once, when you connect, to learn which channel you connected.
• captions.list — to see which caption tracks one of your videos has.
• captions.download — to fetch the text of one of them.

There is no code path in Downlink that creates, edits or deletes anything on YouTube. The source is public at https://github.com/AwdioMedia/Downlink and every request it makes is visible in it.

captions.download serves a video's caption text only to the account that manages that video, so this feature works for channels you run and cannot reach anyone else's.

The OAuth client is yours, not Downlink's

Downlink ships no OAuth client of its own. If you use caption ingestion you create a client in your own Google Cloud project, which means the client ID, the client secret and the daily API quota are yours. The application name shown on the Google consent screen is the one whoever configured that client chose.

Where the credentials are kept

• The refresh token goes into your operating system's keychain — Keychain Access on macOS, Credential Manager on Windows, the system secret service on Linux — through Obsidian's secret storage. It is written there once, on a connection you initiate. It is never written into your vault, never included in a log line, notice or error message, and never sent anywhere except Google's token endpoint at oauth2.googleapis.com.
• Access tokens live in memory for the hour they last and are never written to disk.
• Your OAuth client secret and your YouTube API key are kept in the same keychain. Downlink's settings store only the name of the keychain entry, never the value.
• The connection record — channel ID, channel title, handle, the keychain entry's name, and the date you connected — is stored in data.json inside your vault. That file is not encrypted and travels with your vault if you sync it. No token or secret is in it.

Where the caption text goes

Into markdown notes in your vault, under a # Transcript heading, on your own disk. It is not transmitted anywhere. There is no Downlink server that receives it and no copy of it outside your vault.

Who it is shared with

Nobody. Data obtained through Google APIs is not sold, not transferred to third parties, not used for advertising, not used to build a profile of you, and not used to train any machine-learning model. Nobody reads it but you.

Downlink's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services

Downlink uses YouTube API Services. By using the features that call them you also agree to the YouTube Terms of Service, and Google's Privacy Policy governs data Google itself holds.

You can review and revoke Downlink's access to your Google account at any time at https://security.google.com/settings/security/permissions.

Keeping and deleting it

There is nothing on a server to delete. Disconnecting the account in Downlink's settings removes the keychain entry holding the refresh token. Revoking at the link above invalidates it from Google's side. Deleting the notes deletes the caption text. Deleting data.json, or the vault, removes the connection record.

Every request below goes from your computer to its destination directly. Nothing is proxied through us and nothing is reported back to us, with the single exception noted in the next section.

Each request carries a User-Agent identifying the plugin and its version — Downlink/1.0.0 (Obsidian plugin; +https://downlink.io). That exists so a publisher reading their own server logs can see what has been polling them, which is the same courtesy any podcast app extends. It travels one way. Nothing is sent back to us.

Downlink has no telemetry, no crash reporting, no usage statistics and no update pings of its own. There is no mechanism by which we learn that you installed it, what you follow, or whether you use it at all.

The one server we operate

Podcast Index search is off until you turn it on. When it is on, the term you type is sent to search.downlink.io, a Cloudflare Worker that passes it to the Podcast Index and returns the results. It exists because the Podcast Index's terms forbid embedding developer credentials in open-source projects, so the alternative was asking every user to register for a key of their own.

The term travels in the request body rather than the URL, specifically because Cloudflare's platform logs record URLs and not bodies. The Worker contains no logging code, reads no IP address, attaches no identifier and stores nothing. Its full source is published alongside the plugin's, so this is checkable rather than a claim you have to take on trust.

What we will not claim is that the term is invisible to us. Any proxy that works can see what passes through it. The claim is that nothing is retained. If that distinction matters to you, leave the setting off — Apple Podcasts search and pasted feed URLs both work without it.

• Your notes — markdown files in your vault.
• data.json in the plugin's folder in your vault: your settings, the feeds you follow, and Downlink's record of the notes it created. It is not encrypted.
• Your operating system's keychain — API keys, the OAuth client secret, the refresh token. These are device-local; Obsidian's secret storage does not sync them.

If you sync your vault — Obsidian Sync, iCloud, Dropbox, git, anything else — your notes and data.json go wherever that provider takes them, under that provider's terms. Downlink plays no part in that and has no visibility into it.

What the form collects

What you type, and nothing else. Your name and email address are required; company and role are optional; the solution you pick from the list is stored with them, along with the time you signed up and the time you last changed your details. No IP address, user agent, referrer or browser fingerprint is stored.

Where it goes

Two places. A database at Cloudflare, which hosts this site, holds one entry per email address. Signing up again with the same address updates that entry rather than adding a second, and the form answers the same way either way, so it cannot be used to find out whether an address is on the list. Then one email containing the same fields goes to inbox@downlink.io, a Proton Mail mailbox, with your address as the reply-to so that answering it reaches you. When the time comes to write to everyone, we export the list to our own computer.

Cloudflare and Proton therefore handle the data as the host and the mailbox provider, under their own privacy policies. Neither receives it for any other purpose, and nobody else receives it at all.

The IP address and the logs

To keep a script from flooding the form, Cloudflare's rate limiter counts submissions from each connection for a minute at a time. Your IP address is the key for that count and nothing more: it is not stored with your entry and not written to any log by Downlink. The code behind the form writes a log line only when something fails, and then only what failed; nothing you typed is ever in it. Cloudflare, which serves every request to this site, sees the address behind each one and keeps short-lived platform logs of its own, as any host does. Those logs are not linked to your entry.

What it is used for

Telling you when Downlink is available to download, and following up with you personally, which is what the form promises. It is not shared, not sold, not added to any other list and not used for advertising.

Keeping and deleting it

Your entry stays on the list until you ask for it to go, or until Downlink has launched and the list has done its job, when the whole list, exported copies included, is deleted. To be removed sooner, email inbox@downlink.io from the address you signed up with, and your entry is deleted from the database together with the notification email it produced.

If this policy changes, this page is updated and the date at the top changes with it. Anything material is also noted in the plugin's release notes.