Skip to content

Security & data

We never touch your YouTube account.

Most promotion services start by asking you to sign in. This one starts with a link you could have sent to a friend. Here is what that means in practice, written plainly and without the security-page adjectives.

ViewGon cannot

  • Ask you to sign in to YouTube or Google
  • Request a permission or an OAuth scope
  • Read your private analytics
  • Upload, edit, delete or comment on your channel
  • Change a title, thumbnail, description or setting
  • See your card number
Start an order
  1. 01

    There is no account connection

    The only thing ViewGon asks for is a public YouTube link. There is no login flow, no consent screen and no token, so there is no grant to review and nothing to revoke later. This is not a policy we follow — it is the shape of the product. The code has no capability to reach a YouTube account.

  2. 02

    What we read about your link

    The title, channel name, thumbnail and any counts YouTube itself publishes for that page. Exactly what anyone visiting the link would see. Where a figure is not public — a hidden like count, for instance — we say so on screen rather than estimating it.

  3. 03

    What we store

    Your account, your orders, and a snapshot of the public link as it was when you ordered. The snapshot exists so an old order still describes what was actually bought after a title or thumbnail changes. We do not store anything about your viewers.

  4. 04

    How prices are decided

    On our servers, from the current price list, at the moment you order. The browser shows you a live quote for convenience, but nothing it calculates is trusted: the total is recomputed server-side before a payment session is created. A price cannot be altered from a browser.

  5. 05

    How payment is handled

    Payment is completed on the payment provider's own page. We never see your card details. An order is marked paid only when the provider's webhook confirms it — never because a browser said so — and each webhook carries a unique event id so a redelivery cannot be applied twice.

  6. 06

    Your account

    Passwords are stored as scrypt hashes with a per-account salt and are never recoverable. Sessions are signed tokens in httpOnly, sameSite cookies, so they cannot be read by scripts on the page. Every request is validated against a schema at the route boundary.

  7. 07

    Deleting everything

    Settings → Delete account removes your account and its order history, other than records tax rules require us to keep. Orders still delivering are cancelled first. You can export everything as JSON before you go.

  8. 08

    Reporting something

    If you believe you have found a vulnerability, email security@viewgon.app with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and will not pursue action against good-faith research.