Project and policy
NightsPost is a privately operated Windows publishing utility with a browser-based Deck. Contact the project at contact@nightspost.site for privacy, deletion, security or support requests. The project is operated in Texas, USA. Each installation is controlled by its owner; information and messages you deliberately send to support are received by the project operator. This policy describes this application build, not every future build or every destination service.
Acceptance and YouTube
Read and accept this policy before using NightsPost features. Using NightsPost also means you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms . NightsPost uses YouTube API Services. Google's privacy policy is available at https://policies.google.com/privacy . A revised policy requires renewed acceptance on the Host and each paired browser. Acceptance is recorded locally by version and time and does not enable delivery automatically. You may decline by quitting; no provider connection is required to read this policy. The Host privacy screen includes withdrawal and YouTube disconnect controls.
Data accessed and purposes
With your authorization, NightsPost requests the YouTube read-only OAuth scope to identify your selected channel and uploads playlist, monitor videos and publication status, and prepare and send announcements to destinations you configure. Responses may include titles, descriptions, channel and video identifiers, dates, thumbnails, live or scheduled status, and visibility, including private or unlisted metadata returned under your authorization. This scope does not allow NightsPost to upload, modify or delete YouTube videos. You can also enter local plans, messages, tags, templates and media files, and import or export campaign data.
Storage and access
The Host keeps a local SQLite database, media files, logs, configuration and delivery records under the Windows account's NightsPost application-data directory. OAuth credentials and other supported connection secrets are protected with Windows DPAPI for that Windows user. The database and exported files as a whole are not encrypted by NightsPost. People or software with sufficient access to the Windows account or its backups may read stored data. The Host may create migration snapshots. User-made backups, exports, downloaded recovery files and independently copied text or media are separate copies.
Browser storage
The Deck uses an essential Secure, HttpOnly, SameSite=Strict session cookie, normally expiring after 30 days, and stores device and layout records on the Host. Draft edits can remain in the open browser tab until saved or closed. Revoking a paired device on the Host stops its future access. No third-party analytics scripts are bundled. External links have their own policies; contacting support by email also involves mail providers.
Retention and refresh
While running with current consent and authorization, NightsPost refreshes cached channel title and uploads-playlist details at least daily when checks succeed. Unrefreshed details are removed at the 30-day boundary; unknown refresh dates in older versions are treated as expired. This pauses delivery and requires reconnecting and completing a baseline before release. Video metadata and thumbnails have their own 30-day cache cleanup, request receipts expire after seven days, and diagnostic logs are bounded and expire after 30 days. Processing occurs when the Host runs; if it was shut down, overdue cleanup happens when it starts again. Cleanup cannot run while the computer is off. Local plans, authored text, custom drafts, attached originals, some operational records and user-made copies are not all erased by cache expiry. Review and remove these through the appropriate app/file controls when no longer needed. Automatic migration snapshots are subject to cleanup; external backups and exports must be managed by their owner.
Disconnect, revocation and deletion
Use Disconnect YouTube on the Host or an authorized owner Deck. It immediately removes the active local Google session, cached YouTube data and related delivery receipts and requests revocation at Google's OAuth endpoint. Revocation can affect every scope/client for the same Google API project. If Google cannot confirm success, a DPAPI-protected credential is retained only for revocation retries, not API access, for up to seven days while the Host runs. Reconnection is blocked during that retry period. After seven days the retry credential is discarded and the app displays manual action required. A lost credential, offline computer or failed request cannot be represented as successful remote revocation. You may remove access directly at https://security.google.com/settings/security/permissions . Google may take time to apply a successful revocation. Local cleanup does not delete videos on YouTube or posts already delivered to other services.
If authorization fails during checks, the Host pauses related operation and removes the local YouTube cache after the recorded failure persists for seven days. You can disconnect sooner. To delete all locally held installation data, quit NightsPost and use the documented maintenance/data-removal procedure, including copies you made yourself. Do not delete a shared installation's data without its owner's permission. Contact contact@nightspost.site if assistance is needed. Review independently authored drafts, exports, backup copies, screenshots and messages at third-party destinations separately. Failed file cleanup requires manual follow-up; the software cannot erase inaccessible files or copies elsewhere.
Use and responsibility
The app is intended for its owner and expressly authorized collaborators; it is not offered to children under 13. Keep credentials, pairing codes and private content secure, verify audience and rights before publishing, and follow applicable platform rules and law. This private-use designation is not an exemption from applicable requirements. NightsPost is independent and is not endorsed or certified by Google, YouTube or other destination providers. Availability, delivery and legal or regulatory compliance are not guaranteed by this notice. Nothing here waives rights or duties that cannot legally be waived. No attorney-client relationship is created by using this app or reading this notice.
Public website and contact messages
This informational website is hosted on Cloudflare Pages. It does not host the private NightsPost installation, receive its database, or provide public accounts, sign-in, or administrative access. These static pages contain no analytics scripts, advertising, embedded video players, application cookies, or submission forms.
Cloudflare processes network requests to deliver and protect the website. This can include IP addresses, request details and operational logs. See Cloudflare’s privacy policy. The website does not claim that its hosting provider performs no processing or logging.
Messages sent to contact@nightspost.site pass through Cloudflare Email Routing and the operator’s receiving mailbox. Your email provider and those mail services process the sender details, message and attachments. Contact correspondence is separate from the application’s cache-expiry timers. Contact the operator about access, retention or deletion of correspondence. Do not send passwords, tokens, private databases or other credentials.
For Texas and U.S. regulatory references and applicable-rights information, see the legal notice. The app-policy text above matches the policy bundled with v2.0.3. This website section additionally describes this public site and contact channel. Changes to application data use require updated disclosures and any required renewed consent.