Your Privacy & Security
We believe in radical transparency. Here's exactly what we do and don't do with your data.
What We Collect
Email Address
We store your email address to create and manage your account.
This is used for login authentication through Google OAuth or magic link email sign-in, and for occasional important account notifications such as billing confirmations or service updates.
We do not use your email for marketing campaigns or share it with third parties.
Your Generated Content
Titles and tags you generate are saved to your account so you can access your favorites, generation history, and previously created content across browsing sessions.
You can delete any saved content at any time from your dashboard, and all content is permanently removed when you delete your account.
Basic Usage Analytics
We track anonymous usage patterns such as which features are most popular, how many title generations occur per day, and which pages users visit most frequently.
This helps us improve the product experience. This data is aggregated and never tied to your personal identity, email address, or account.
What We Do NOT Collect
No YouTube API Access
We never connect to your YouTube account. We do not access your channel data, analytics, subscriber information, video library, revenue reports, or watch time statistics.
TitleHook operates entirely independently from YouTube and requires no account linking or API permissions.
No Personal Data Mining
We do not collect your name (it is an optional profile field), your geographic location, or your IP address for tracking purposes.
We also do not collect your browsing history on other websites, device identifiers, or any personal information beyond your email address and generated content.
No Third-Party Data Sharing
Your data is never sold, shared, licensed, rented, or given to any third party for advertising, marketing, data brokering, audience profiling, or any other purpose.
The only third-party service that receives any information is Stripe for payment processing.
No Tracking Cookies
We use a single authentication cookie to keep you logged in to your account.
We do not use tracking pixels, advertising cookies, retargeting scripts, browser fingerprinting, or any form of cross-site tracking. No Facebook Pixel, no Google Ads tracking, no advertising networks.
How We Protect Your Data
Encrypted Storage
All data transmitted between your browser and our servers is encrypted via HTTPS using modern TLS protocols.
We never store passwords because authentication is handled entirely through Google OAuth 2.0 and magic link email sign-in, eliminating password-related security risks.
Passwordless Authentication
Sign in securely with Google OAuth 2.0 or a one-time-use magic link sent to your email address.
No passwords to remember, no credentials that could be stolen or compromised. Both methods are significantly more secure than traditional password-based authentication.
Minimal Data Principle
We only collect what we absolutely need to provide the title generation service: your email and your generated content.
Less data collected means less data at risk. This is a deliberate design choice, not an afterthought.
Full Account Control
You can delete your account and all associated data at any time from your account settings. Deletion is permanent and immediate.
We do not retain personally identifiable information after account deletion. No retention tricks, no dark patterns, no hassle.
Our Security Architecture
Transport Layer Encryption
Every connection is protected by TLS 1.3 with modern cipher suites that provide forward secrecy. We enforce HSTS headers with a one-year max-age directive to prevent protocol downgrade attacks.
Infrastructure Isolation
Application components run in isolated environments with strict network segmentation. Database servers are not publicly accessible — only authenticated application-layer connections from authorized service instances can reach them.
Separate service accounts with minimum permissions
Automated traffic and behavior analysis
Rules audited and updated on a regular cycle
Admin access requires hardware security keys
Application Security
Continuous static analysis scans every code change for vulnerabilities. All dependencies are monitored through automated scanning that alerts within hours of any newly disclosed issue.
Penetration Testing & Disclosure
Regular security assessments simulate real-world attacks against our web application, API endpoints, and infrastructure. Assessments cover OWASP Top Ten plus business logic flaws specific to our workflows.
Found a vulnerability? Email security@titlehook.com. We acknowledge reports within 48 hours and never pursue legal action against good-faith researchers.
Session & Token Security
Sessions use cryptographically signed tokens with no PII. Magic link tokens are single-use and expire in 15 minutes. OAuth tokens are encrypted at rest and never exposed to client-side code.
In Summary
TitleHook is a title generation tool — not a data company. We make money by helping you create better YouTube titles through Premium subscriptions, not by selling your information to advertisers or data brokers.
Your privacy is not just a policy; it's our product philosophy and a core design principle that influences every decision we make.
We collect the minimum data necessary to provide the service. We never access your YouTube account. We never sell or share your data. We use passwordless authentication to eliminate credential risks.
You can delete your account and all data at any time. TitleHook respects your privacy and protects your information with every security measure described above.
Security & Privacy FAQ
Does TitleHook access or connect to my YouTube account?
No. TitleHook never connects to your YouTube account and never requests access to your channel data.
- We do not access your analytics, subscriber information, video library, revenue data, watch time statistics, comment sections, or any other YouTube account details.
- TitleHook operates entirely independently from YouTube. You describe your video topic in plain text, and we generate title suggestions based on our database of 2,000+ viral frameworks.
- This privacy-first approach is a core design principle, not an afterthought. We intentionally built TitleHook to work without YouTube API access.
- We believe your channel data belongs to you and should never be shared with third-party tools unnecessarily.
- You get the same quality title suggestions whether you have 10 subscribers or 10 million.
What personal data does TitleHook collect and store?
TitleHook collects the minimum data necessary to provide the service and nothing more.
- We store your email address for account creation, login authentication, and occasional important account notifications such as billing confirmations or service changes.
- We store the titles and tags you generate so you can access your generation history and saved favorites across sessions.
- We collect anonymous usage analytics such as which features are most popular, how many titles are generated per day, and which pages users visit so we can improve the product experience.
- We do not collect your name (it is an optional profile field), your geographic location, or your IP address for tracking purposes.
- We also do not collect your browsing history on other websites, your device identifiers, or any personal information beyond what is explicitly listed here.
- Our data collection philosophy is simple: if we do not need it to provide you with a better title generation experience, we do not collect it.
Is my payment information secure when I upgrade to Premium?
Yes. All payment processing is handled entirely by Stripe, which is PCI Level 1 certified, the highest level of payment security certification available in the industry.
- Your credit card number, expiration date, and security code are transmitted directly to Stripe over encrypted connections.
- They never pass through or are stored on TitleHook servers at any point during the transaction. We never see, process, or have access to your full payment details.
- Stripe processes billions of dollars in payments annually for companies like Amazon, Google, Shopify, and thousands of other businesses using the same enterprise-grade security infrastructure that protects your TitleHook transactions.
- All communication between your browser and Stripe is encrypted using TLS, and Stripe undergoes regular independent security audits to maintain its certifications.
- This means your payment information is protected by the same level of security used by the largest ecommerce platforms in the world.
Can I delete my account and all associated data?
Yes. You can delete your account and all associated data at any time from your account settings page.
- When you delete your account, we permanently remove your email address, all generated titles, all saved favorites, your complete generation history, and any other data linked to your account from our databases.
- We do not retain any personally identifiable data after account deletion.
- The deletion process is straightforward and does not require contacting support or going through a complicated multi-step process.
- If you have an active Premium subscription, we recommend canceling it through the billing portal before deleting your account to avoid any future charges.
- Once your account is deleted, the action cannot be undone, so please make sure to export any titles or favorites you want to keep before proceeding with deletion.
Does TitleHook use tracking cookies or advertising pixels?
No. TitleHook uses a single authentication cookie to keep you logged in to your account, and that is the only cookie our site sets.
- We do not use tracking pixels, advertising cookies, retargeting scripts, fingerprinting techniques, or any form of cross-site tracking.
- We do not participate in advertising networks and we do not serve ads of any kind on our platform.
- The authentication cookie contains no personally identifiable information and exists solely to maintain your login session so you do not have to sign in every time you visit the site.
- We do not use Facebook Pixel, Google Ads tracking, or any other advertising-related tracking technology.
- This means your browsing activity on TitleHook is never shared with advertising platforms and you will never see retargeting ads based on your TitleHook usage.
- Our revenue comes from Premium subscriptions, not from selling your attention to advertisers.
Does TitleHook sell or share my data with third parties?
No. Your data is never sold, shared, licensed, rented, or given to any third party for advertising, marketing, data brokering, audience profiling, or any other purpose.
- The only third-party service that receives any of your information is Stripe for payment processing, and only when you voluntarily choose to upgrade to a paid Premium plan.
- We do not integrate with data brokers, advertising networks, analytics platforms that share data across websites, or any other service that would compromise your privacy. We do not share anonymized or aggregated data with third parties either.
- Your usage of TitleHook remains between you and TitleHook.
- This commitment to data privacy is fundamental to our business model because we believe that a title generation tool should help you create better titles, not monetize your personal information.
How does TitleHook handle authentication security?
TitleHook uses passwordless authentication through two secure methods: Google OAuth 2.0 and magic link email sign-in. This means there are no passwords stored on our servers that could be compromised in a data breach.
- When you sign in with Google, the entire authentication process is handled by Google servers using their enterprise-grade security infrastructure.
- TitleHook receives only your email address and basic profile information from Google after you authorize access.
- When you use magic link sign-in, a unique one-time-use secure link is sent to your email address. This link expires after a short period and can only be used once, making it resistant to interception and replay attacks.
- Both methods are significantly more secure than traditional password-based authentication because they eliminate the risks associated with weak passwords, password reuse across sites, and credential stuffing attacks.
- You never need to remember or manage a password for TitleHook.
What happens to my data if TitleHook experiences a security breach?
While we take extensive precautions to prevent security breaches through regular code audits, dependency updates, and following security best practices.
- Our minimal data collection approach means that even in a worst-case scenario, the potential exposure is extremely limited.
- We do not store passwords because we use passwordless authentication. We do not store payment details because all payment processing is handled by Stripe.
- We do not store YouTube credentials because we never connect to YouTube accounts. The most sensitive piece of data we hold is your email address.
- All data in transit is encrypted via HTTPS using modern TLS protocols, and we follow the principle of least privilege for all system access, meaning each component of our infrastructure has only the minimum permissions it needs to function.
- In the unlikely event of a breach, we would immediately notify affected users, take steps to secure the system, and cooperate with any relevant authorities as required by applicable data protection laws including GDPR and CCPA.
Does TitleHook comply with GDPR and CCPA privacy regulations?
Yes. TitleHook is designed to comply with both the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
- Under GDPR, our legal basis for processing your data is the performance of our contract with you (providing the title generation service) and your consent (for optional features like analytics).
- You have the right to access your data, request corrections, request deletion, and port your data in a machine-readable format.
- Under CCPA, we do not sell personal information, we do not use personal information for targeted advertising, and California residents may designate an authorized agent to make requests on their behalf.
- You can exercise any of your privacy rights by contacting us at support@titlehook.com, and we will respond within the timeframes required by applicable law.
- Our minimal data collection approach means that compliance is straightforward because we simply do not collect the types of sensitive data that create complex regulatory obligations.
Have questions about your privacy?