Privacy Policy

Last updated October 20, 2026

Stillstats is a read-only analytics product for YouTube creators. MIDLO WEB DESIGN, LLC, a Virginia limited liability company, operates Stillstats. In this policy, "we" and "us" mean MIDLO WEB DESIGN, LLC. This policy explains what information Stillstats accesses, how it uses, stores and shares that information, and how you delete it. You agree to this policy when you sign in to Stillstats.

YouTube API Services and Google

Stillstats uses YouTube API Services to read your channel's data, with your permission. Google's own use of your information is described in the Google Privacy Policy.

Stillstats's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stillstats's use of information received from the Stillstats extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

What Stillstats accesses

Stillstats asks Google for your permission in up to three separate steps.

• Sign in with Google. Stillstats receives your Google account ID, your name, your email address and your profile picture. It uses them to create your account and to show you who is signed in.
• Connect a channel. Stillstats asks to view your YouTube account and to view your YouTube Analytics reports. It reads your channel's ID each time you connect the channel or give revenue consent, to know which channel the permission is for. It reads your channel's name, handle and creation date, your uploads list with each video's title, thumbnail, publish date, privacy status and length, and the analytics of your channel and your videos: views, engaged views, watch time, average percentage viewed, audience retention, traffic sources, the countries, US states and cities your viewers watch from, the age group and gender of signed-in viewers, the device types and operating systems they watch on, the split between subscribers and non-subscribers, and subscribers gained, for each day and in total over the window you pick, and on each video's page, for each day since it was published. It reads each video's format (video, Short or live stream) from the video's views since it was published, whatever window you pick. It also reads your channel's numbers for each day of the last 90 days, to know which days Google has finished counting. It also asks for your email address and basic account identity, so that Google can send it security alerts about your account.
• Revenue consent, only if you choose to give it. Stillstats asks to view the monetary reports of YouTube Analytics. It reads the estimated revenue of your channel and of each video, with its sources, its revenue by day and your channel's revenue by format, over the window you pick and, on each video's page, since the video was published, and shows it in your channel summary, your video list and each video's page. If you never give revenue consent, Stillstats never reads revenue data.

Stillstats is read-only. It never changes anything on your YouTube channel, and it never asks for your YouTube password.

The Studio extension

The Stillstats extension for Chrome and Firefox works only on studio.youtube.com and stillstats.com.

On studio.youtube.com it reads the channel id and video ids on the page you have open, and the analytics period you select. It does not read the numbers, text or anything else on the page, and it does not read any other site.

It sends stillstats.com the video ids, the period and Stillstats' own id for the channel you connected, with your Stillstats sign-in. It matches that channel to the page on your device, so the YouTube channel id stays in your browser. For the comparison on the latest video card, it also sends the video's format and how many recent uploads to compare. stillstats.com answers with your numbers from YouTube's official API. The rest of this policy covers how Stillstats handles them.

It sends a few usage events to stillstats.com: that it was installed, which Studio page showed a number or could not, and when you click one of its links to stillstats.com. They carry no ids, names or email, and they go to Stillstats' own analytics, run on its own server. In Firefox, it sends them only if you allow it, when you install the extension or later in about:addons.

It never uses your YouTube sign-in, never reads YouTube's private endpoints, and never sells or shares anything it reads.

What Stillstats stores

• Your account: your Google account ID, name, email address and the address of your profile picture.
• Your sign-in: the tokens Google issued when you signed in and the permissions you granted. These are an access token, an ID token and, when Google issues one, a refresh token. The access token and the refresh token are encrypted with XChaCha20-Poly1305 before they are stored. Stillstats keeps them until you delete your account.
• Your sessions: the browser user agent of each signed-in session. Stillstats does not store your IP address with a session.
• Your display preferences: page size, which columns and charts show, whether the charts show daily numbers or a running total, your currency, and whether the video list shows unlisted and private videos. They stay until you reset them on your profile or delete yourself from the product.
• Each connected channel: the channel's ID, the permissions you granted and when you granted them, and the access and refresh tokens Google issued for the channel. These tokens are encrypted with AES-256-GCM before they are stored.
• Keyed one-way hashes of your Google account ID and of two identifiers of your refresh token. When Google sends a security alert, Stillstats finds your connection by these hashes.
• The analytics results Stillstats shows you, and your channel's name and handle, for a short time only. See "How long Stillstats keeps your data" below.

How Stillstats uses your data

Stillstats uses your Google user data only to provide the features you see in Stillstats: showing which channel is connected and its name, in the channel picker and on your profile, and its handle in the channel picker; using your channel's creation date as the earliest day you can pick; showing your channel's numbers, and your videos' titles and numbers, in your channel summary; showing each video's title, thumbnail, length and numbers in your video list and on each video's page, and its publish date, privacy status and format in your video list, where you can also filter by format; using each video's publish date to count its numbers from the day it was published; and showing your channel's and each video's estimated revenue if you gave revenue consent, in your channel summary, your video list and each video's page. Stillstats does not use your data for advertising, to determine creditworthiness or for lending, or to train any AI model. We never use your channel or its data in case studies or marketing.

No person reads your data unless you ask us to, for example in a support request, or unless it is necessary for security, such as investigating a bug or abuse, or to comply with the law.

How Stillstats shares your data

We do not sell your data. We share it with no one beyond the infrastructure that delivers Stillstats, described below. Stillstats sends no data to an AI processor, an advertising platform or a data broker. Stillstats loads no third-party scripts and no ad pixels, and it does not let third parties serve content or advertisements.

We transfer your data only in these cases:

• to comply with the law;
• if Stillstats is sold or merged, and only after we ask for and receive your explicit consent first.

Stillstats sends requests to Google's APIs on your behalf, and Google receives those requests. Requests to stillstats.com, and the responses to them, pass through Cloudflare, which delivers the site and protects it from attacks.

Video thumbnails in the app load from YouTube's image servers on ytimg.com, such as i.ytimg.com. Your browser fetches them straight from YouTube, the same way YouTube Studio does. No script from YouTube or anyone else runs in the app.

Product analytics and error reports

Stillstats counts how people use the site and the product with OpenPanel, which we host on our own servers. No OpenPanel data goes to a third party. The site records page views and clicks on the sign-in button. The product records a small set of actions, such as clicking to connect a channel, to disconnect a channel or to delete your account. No event carries a channel ID, an account ID or an email address. Like any web request, each event carries your browser's IP address and user agent, which OpenPanel uses to tell visits apart and to estimate your country.

When something breaks, Stillstats sends an error report to GlitchTip, which we also host on our own servers. Before a report leaves the process, Stillstats removes tokens, channel IDs, analytics values, request headers, cookies and request bodies from it.

Cookies and device storage

Stillstats places two cookies in your browser. Both are strictly necessary.

• __Secure-better-auth.session_token keeps you signed in. It expires after 7 days without use, or when you sign out. Scripts on the page cannot read it.
• __Secure-better-auth.state protects the sign-in from forgery. It exists only while you sign in, and it expires after 5 minutes.

OpenPanel sets no cookie and keeps no identifier on your device. Stillstats uses no advertising cookies and no third-party cookies, and it does not let a third party store or read information on your device.

How long Stillstats keeps your data

• Analytics results are cached for 24 hours or less, and Stillstats never keeps them as history.
• Your account, your sessions and your sign-in tokens stay until you delete your account. When you delete it, Stillstats deletes them at once.
• A connected channel stays until you disconnect it, delete your account or revoke Stillstats's access at Google.
• When you disconnect a channel, delete your account or revoke access at Google, Stillstats deletes the channel's live data within 24 hours. The backups that hold it expire within 5 days.
• Revoking access at Google deletes the channel's data, not your account. To delete your account, delete it inside Stillstats.
• To prove that a deletion happened, Stillstats keeps a record of it for 24 months. The record holds a keyed one-way hash of the channel ID, the number of rows deleted, the reason and the times. It holds no channel ID and no analytics data.

Deleting your data and revoking access

You can delete your data inside Stillstats at any time.

• Disconnect a channel. Stillstats revokes its access at Google and deletes the channel's data.
• Delete your account. Stillstats disconnects every channel and deletes your account, your sessions and your sign-in tokens.

Deleting data stored by Stillstats does not affect data stored by YouTube. To delete data on YouTube, use YouTube or another authorized app that can delete that data.

In addition to deleting data inside Stillstats, you can revoke Stillstats's access to your data on the Google security settings page at https://security.google.com/settings/security/permissions. Stillstats checks every connection each day, and Google also alerts Stillstats to some revocations. When Stillstats finds a revocation, it deletes the channel's data on the windows above. Your account stays until you delete it.

You can also email [email protected] to ask us to delete your data. We delete it within 7 days of your request.

Security

Stillstats serves every page over HTTPS. It encrypts the access and refresh tokens Google issues before it stores them, and its database keeps each account's data apart from every other account's data.

Children

Stillstats is not for children under 13, and we do not knowingly collect their data.

Changes to this policy

When we change this policy, we publish the new version on this page and change the date at the top.

Contact

For questions or complaints about Stillstats's privacy practices, email [email protected].