The privacy policy

Project Pulse — Privacy Policy

Last updated: 2026-04-25

1. Controller identity

This privacy policy is issued by Bodrogi Bence Barnabás E.V., a Hungarian sole proprietorship (egyéni vállalkozó) trading as “Virdana”(“Virdana”, “we”, “us”, “our”), the data controller under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the Info Act / Infotörvény).

• Controller:Bodrogi Bence Barnabás E.V. (trading as “Virdana”)
• Registered address: Given on request
• Tax number (adószám): 90500619-1-33
• Contact email: info@virdana.dev
• Website: https://pulse.virdana.dev
• Data Protection Officer (DPO): Not appointed. Under Art. 37 GDPR we are not required to appoint a DPO because our processing does not involve (a) a public authority, (b) large-scale systematic monitoring, or (c) large-scale processing of special categories of data. For all privacy matters, contact info@virdana.dev.

2. What this policy covers

This policy applies to the Project Pulse desktop application(“the app”). It describes how the app handles information on your computer and what happens when the app communicates with Google’s YouTube APIs on your behalf. It does not cover any separate Virdana websites or services unless explicitly stated.

3. Key facts (tl;dr)

• Project Pulse is local-first. All of your YouTube data stays on your own computer. Virdana does not receive, store, or transmit it.
• Virdana operates no serversthat handle your YouTube data. The app communicates only with Google’s official YouTube APIs, under your own Google sign-in.
• Only read-only scopes are requested. The app cannot modify your YouTube account.
• No telemetry, no advertising, no profiling, no third-party sharing, no automated decision-making with legal effects.
• You can clear all local data and revoke access at any time.

4. Categories of personal data processed

4.1 Google OAuth token

When you sign in, Google returns an OAuth access token and refresh tokento the app on your computer. These tokens identify your Google account to Google and let the app call Google’s APIs on your behalf.

• Purpose of processing: authenticating API calls to Google on your behalf.
• Legal basis (GDPR Art. 6(1)):(b) performance of a contract to which you are party (providing the service you requested) and (a) your consent, given through Google’s OAuth dialog.
• Storage: locally on your computer, at %APPDATA%\ProjectPulse\auth_cache.json (Windows) or the equivalent XDG / macOS path. File permissions are tightened to owner-only where the operating system supports it.
• Retention: deleted when you sign out, when you revoke access in your Google account, or after 7 days of inactivity — whichever is first.
• Transfers: the token is never transmitted to Virdana.

4.2 YouTube channel and analytics data

The app fetches, on your behalf, data from Google’s YouTube Data API v3 and YouTube Analytics API:

• Channel metadata (name, subscriber count, total views, total videos)
• Video metadata for your uploads (title, publish date, view/like/comment counts, thumbnail URLs)
• Daily channel analytics for the last 28 days (views, subscribers gained, subscribers lost)
• Per-video analytics for the last 28 days (views, likes, comments, subscribers gained)

• Purpose of processing: displaying dashboards, trend charts, and strategy suggestions inside the app, for your own use on your own channel.
• Legal basis (GDPR Art. 6(1)(b)): performance of a contract (providing the service you installed the app to get).
• Storage: locally on your computer, in %APPDATA%\ProjectPulse\data\. Never transmitted to Virdana.
• Retention:up to 7 days (configurable from the app’s Settings), then automatically purged. You can clear all of it immediately at any time.

4.3 Data we do not process

The app does not collect, log, or transmit:

• Telemetry, usage analytics, or crash reports
• Device identifiers, IP addresses, or location data
• Any information about other Google products you use
• Any information about persons other than you as the channel owner

5. Purposes and legal bases summary (GDPR Art. 13)

We do not rely on Art. 6(1)(f) (legitimate interest) for any processing, because all processing is either consent-based or strictly contract-necessary.

6. Recipients of your data

Virdana does notreceive your YouTube data. Because the app runs locally and talks only to Google’s APIs, the recipients of any personal data are:

• You, on your own computer.
• Google LLC / Google Ireland Limited, as the provider of the YouTube APIs you authorize the app to call. Google’s handling of that communication is governed by Google’s Privacy Policy.

We do not sell, rent, or share your data with any other third party. We do not use processorson your behalf for the app’s core functions.

7. International transfers

The app runs on your computer; your YouTube data does not leave your device via Virdana. Your interaction with Google’s APIs may involve data transfers outside the EEA, which are governed by Google’s own mechanisms (Standard Contractual Clauses and supplementary measures as described in Google’s privacy documentation). Virdana is not a party to those transfers.

8. Retention

You can wipe everything immediately via Settings → Clear ALL local data.

9. Your rights under GDPR

You have the following rights with respect to your personal data. Because Virdana does not receive or store your YouTube data, most of these rights are exercised inside the app itself:

• Right of access (Art. 15) — every piece of data the app holds is visible to you inside the app and stored in plain-text JSON files you can open.
• Right to rectification (Art. 16) — inaccuracies in YouTube data should be corrected at the source (your YouTube account); the app refreshes from Google automatically.
• Right to erasure (Art. 17) — Settings → Clear ALL local data and Settings → Sign out of Googleerase all data held on your device. You can additionally revoke the app’s access from your Google Account permissions.
• Right to restriction (Art. 18) — close the app and it stops processing.
• Right to data portability (Art. 20) — the cache files in %APPDATA%\ProjectPulse\data\ are plain-text JSON, directly portable.
• Right to object (Art. 21) — uninstall the app.
• Right to withdraw consent (Art. 7(3)) — revoke OAuth access at Google Account permissions.

If you wish to exercise any of these rights in writing, email info@virdana.dev. We will respond within one month (Art. 12(3) GDPR).

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Hungary, the competent authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH / Nemzeti Adatvédelmi és Információszabadság Hatóság):

• Address: 1055 Budapest, Falk Miksa utca 9-11.
• Postal: 1363 Budapest, Pf. 9.
• Phone: +36 (1) 391-1400
• Email: ugyfelszolgalat@naih.hu
• Website: https://naih.hu

If you reside in another EU/EEA country, you may also contact your local supervisory authority.

11. Automated decision-making

The app performs local computations on your own data (e.g. simple trend analysis for the “Strategy Lab” tab). None of these produce legal effects on you or significantly affect you in the sense of Art. 22(1) GDPR. No automated profiling is performed.

12. Compliance with Google and YouTube API policies

Project Pulse’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Project Pulse uses access to Google user data only to provide or improve user-facing features that are prominent in the requesting application.
• Project Pulse does not transfer the data for serving advertisements, including personalized, retargeted, or interest-based advertising.
• Project Pulse does not use or transfer the data for determining credit-worthiness or for lending purposes.
• Project Pulse does not allow humans to read the data, except (i) with the user’s affirmative consent for specific messages, (ii) when necessary for security purposes (such as investigating abuse), (iii) when necessary to comply with applicable law, or (iv) when the data has been aggregated and anonymized and is used for internal operations.
• Project Pulse does not use Google user data to develop, improve, or train generalized AI or ML models.

By using Project Pulse you also agree to be bound by the YouTube Terms of Service and Google’s Privacy Policy with respect to your relationship with Google.

13. Children

The app is not directed to children under the age of 16 (Hungarian digital consent age under Act CXII of 2011 § 6). We do not knowingly process data from children.

14. Security

The app stores OAuth tokens and cached data on your own computer. Security depends on the security of your device. We apply:

• Owner-only file permissions on the OAuth token file where the operating system supports it (mode 0600).
• Storage in per-user directories so the operating system enforces separation between user accounts.

We do not protect against malware running under your own user account; that is beyond the scope of the application.

15. Changes to this policy

Updates will be published at https://pulse.virdana.dev/privacy and the “Last updated” date will change. Material changes that affect how your data is handled will be announced in the app’s release notes before they take effect.

16. Governing law

This policy is governed by Hungarian law, without prejudice to mandatory provisions of EU law (including GDPR) and without limiting your right as a consumer to bring proceedings in the country of your habitual residence under Regulation (EU) 1215/2012.

17. Contact

• Email: info@virdana.dev
• Post: Given on request (write to info@virdana.dev to obtain it)
• Website: https://pulse.virdana.dev