Privacy Policy — SubFlow
Last updated: April 22, 2026
Extension name: SubFlow — YouTube Subscription Manager
Developer: ExtPilot (extpilot.com)
Contact: support@extpilot.com
Overview
SubFlow is a browser extension that helps you organize YouTube subscriptions into groups. This privacy policy explains what data SubFlow accesses, how it is used, and your rights.
In short: SubFlow works entirely locally on your device. We do not collect, transmit, or sell your personal data.
Data We Access
YouTube Page Content (Required)
SubFlow accesses the YouTube website (youtube.com) to:
- Read your subscription list and channel names displayed on the page
- Inject UI elements (sidebar groups, filter tabs, hover menus)
- Detect page navigation within YouTube's single-page application
This data never leaves your browser. SubFlow reads YouTube page content only to provide its core functionality and does not transmit any YouTube data to external servers.
Local Storage (Required)
SubFlow stores the following data locally on your device using chrome.storage.local:
- Your subscription groups (names, channel assignments)
- Settings and preferences
- Backup snapshots (up to 20 versions)
- License key (if you purchased Pro)
This data stays on your device and is only synced to Google Drive if you explicitly enable cloud sync (Pro feature, requires separate OAuth consent).
Data We Do NOT Collect
- Browsing history
- Video watching habits
- Network request interception (no webRequest permission)
- Access to websites besides youtube.com
- Analytics or telemetry data
- Data stored on our servers (except license validation)
- Cookies or tracking pixels
- Data sold or shared with third parties
Network Requests
SubFlow makes exactly one type of network request:
License Validation (Pro users only)
When you enter a license key to activate Pro features, SubFlow contacts our license server to verify the key is valid. This request contains:
- Your license key
- Extension version number
It does NOT contain your YouTube data, browsing history, or any personal information.
License server: Hosted on Cloudflare Workers (extpilot.com)
Frequency: Once on activation, then periodic re-validation (every 7 days)
Permissions Explained
| Permission | Why We Need It |
|---|---|
storage | Save your groups, settings, and backup snapshots locally |
alarms | Schedule periodic tasks (license re-validation, Pro notifications) |
host_permissions: youtube.com | Access YouTube pages to inject SubFlow UI and read channel info |
Optional Permissions (only requested if you use these features)
| Permission | Why We Need It |
|---|---|
identity | Google OAuth for Google Drive cloud sync (Pro only) |
notifications | Desktop notifications for new videos in groups (Pro only) |
You can deny optional permissions and SubFlow will work fine without them.
Google Drive Sync (Pro Feature)
If you enable Google Drive sync:
- SubFlow uses Google OAuth2 to access ONLY its own application folder in your Google Drive
- Only your group data (JSON) is synced — no YouTube data, no personal files
- You can revoke access at any time in Google Account settings
- SubFlow uses the
drive.appdatascope (limited to app-specific data only)
Data Export & Deletion
You have full control over your data:
- Export: Use "Export Data" in SubFlow to download all your groups as JSON
- CSV Export: Export your subscription list as CSV
- Delete: Uninstall SubFlow and all local data is automatically removed
- Snapshots: View and manage backup snapshots in Settings
Children's Privacy
SubFlow does not knowingly collect data from children under 13. The extension does not collect any personal data from any user.
Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted at this page with an updated "Last updated" date.
Contact
If you have questions about this privacy policy:
- Email: support@extpilot.com
- Website: extpilot.com
Compliance
This extension complies with:
- Chrome Web Store Developer Program Policies
- Microsoft Edge Add-ons Store policies
- GDPR (we don't collect EU personal data)
- CCPA (we don't sell California residents' data)