Who operates Star source
Star source is a locally run desktop utility operated by the owner of the connected YouTube channel. It is not currently offered as a public multi-user service. For privacy questions, contact: cdzm981028@gmail.com.
YouTube data accessed and why
With the channel owner's authorization, Star source uses Google's OAuth 2.0 and the YouTube Data API to provide these functions:
- Channel connection checks: channel ID, channel name, and subscriber count.
- Video uploads: a video file chosen by the operator and its title, description, category, visibility, and upload-status metadata.
- Optional YouTube comment workflow: the watcher reads comment IDs, text, author display names, and author channel IDs. It stores the comment ID, text, author display name, related channel ID, reply ID, and processing time locally. The author channel ID is used to skip the channel owner's own comments; it is not stored or sent to the AI service. Non-spam comment text may be sent to DeepSeek to generate a reply, which the tool can post. A comment may also be rejected for moderation (hidden, not deleted).
- Video removal: the source code contains an internal helper to delete a specified video; no normal command or user-interface entry point was found in the reviewed code.
The OAuth scopes currently requested are youtube.upload and youtube.force-ssl. The second scope is used by the current code for comment access/moderation and the video-deletion operation; it grants broader ability than uploading alone.
AI-assisted comment replies and sharing
If the YouTube comment watcher is enabled, it sends the non-spam comment text to the configured AI API to generate a reply. The software does not add the commenter’s display name or channel ID to the AI prompt, although a commenter could include personal information in the comment text itself. The generated reply may then be posted to YouTube.
The operator has selected DeepSeek Open Platform as the AI provider. The configured endpoint points at the official DeepSeek API host (api.deepseek.com), so no intermediary service sits between this tool and DeepSeek; the account-level retention and training settings for that API account have not been inspected. DeepSeek’s Open Platform terms address the developer’s own inputs and outputs, and its published Privacy Policy states that it governs DeepSeek’s own users and does not cover personal data processed for end users of downstream applications built on the open platform. It therefore does not establish how comment text submitted through the API is retained or used, and that question remains unverified. DeepSeek is operated from China and may process or store data outside the commenter’s country. The operator’s local 30-day cleanup cannot delete any copy held by DeepSeek. See DeepSeek Open Platform Terms and DeepSeek Privacy Policy.
YouTube and AI API requests also pass through a locally configured network proxy. Its upstream operator and logging practices have not been audited. The shared local comment watcher can also support separately authorized Instagram, Facebook, and Threads accounts; those integrations do not use the Google OAuth scopes described here, but their local comment records follow the same cleanup schedule.
YouTube data is used for the channel functions described above. The current code does not send YouTube data to advertising platforms or sell it.
Where information is stored and how long
- OAuth credentials, including the refresh token and OAuth client secret, are stored in a local JSON configuration file on the operator's computer. The current application does not encrypt this file itself.
- The optional comment watcher stores comment IDs, related post IDs, author names, comment text, reply IDs, and processing timestamps in a local SQLite database and log file.
- The watcher automatically deletes processed comment records and log entries older than 30 days when it starts and before polling. If the watcher is stopped, cleanup runs the next time it starts. Comments older than 30 days, or comments without a valid publication timestamp, are not automatically processed.
- IDs for posts the operator has chosen to monitor remain in the local watch list until the operator removes them; they are not comment records and are not deleted by the 30-day cleanup.
- Short-lived access tokens are cached in process memory. Some current API calls place access tokens in URL query parameters; this is a known security issue because URLs may be recorded by request/proxy logs.
Google and YouTube process data under their own terms and policies. DeepSeek may retain submitted comment text under its own terms. The local 30-day cleanup does not remove data from YouTube, Google, or DeepSeek. OAuth credentials remain on the operator’s computer until manually removed; they are not covered by the comment-retention period.
Choices and deletion
The channel owner can revoke Star source's Google access from their Google Account's third-party connections. Revoking access prevents future API calls but does not delete local credentials. The operator must separately remove the local credential JSON if it is no longer needed.
Comment authors can manage or remove their comments through YouTube. The local watcher deletes processed comment records and log entries after 30 days; this does not delete the original platform comment or copies retained by an AI provider.
Google Account connections: Manage third-party connections.
Children and changes
Star source is not designed for children. This policy will be updated before any material change to the data accessed, processing providers, storage, or retention practices.
Google API Services
This policy is written against the Google API Services User Data Policy, including its Limited Use requirements. Star source uses Google user data only to provide the features described on this page and does not sell that data or use it for advertising.