Pipguin - Floating Player for YouTube™ Privacy Policy
Version: 2026-11-11-paid-cosmetics-v1
Revision date: 2026-11-11
1. Operator and scope
The operator is individual entrepreneur NIKOLAY MENZHILIY, Georgia. Use the Contact form on this website for questions about your data; sign-in is not required. This policy covers the Pipguin extension, our website and available server features. YouTube, Google and optional external services have their own policies. We are not affiliated with YouTube or Google. This version covers public Google sign-in and the available account features. If purchasing the Full Collection is available and you choose to buy it, the Paddle processing described below applies. A purchase is not required for the free player or to sign in to an account.
Free player and optional account
The free player stores player settings, timestamped bookmarks, saved looks and optional local records in the extension profile on this device. It works without a Pipguin account. Local bookmarks and viewing records are not sent to the Pipguin API or Chrome Sync. If you sign in and explicitly save supported settings, the account processing described below applies. It reads data from the current YouTube page for the player features and can request content directly from YouTube when you use them. Optional SponsorBlock sends the current video ID to sponsor.ajay.app only with your separate permission and while the feature is enabled; that provider also receives the request IP address. You can decline permission or disable the feature. Removing the extension removes its local records. The account, cloud progress and payment sections of this policy describe the corresponding services, when they are available and you choose to use them. They apply if you use those services. Opening the website or sending a support request uses the website and support processing described below.
2. Player and data on your device
The extension reads information from the open YouTube page needed for playback: video URL and title, channel, playback position and state, chapters and available page elements. This supports the mini-player, video controls and related panels. The video itself and viewing history are not uploaded to our server. Searches within YouTube are processed by YouTube.
Session data, cached entitlements, settings, selected appearance, bookmarks with a video identifier and timestamp, saved looks and queues are stored in the extension profile on your device. Shorts history and channel settings are enabled separately. They are not sent to Chrome Sync or our API as viewing history. You can remove these data through the extension controls or by deleting its local data. Removing the extension does not delete a separately created server account. On an explicit user action, the server may save five device settings: control density, subtitle scale and background, playback speed step and seek step. Pet names may also be stored in the account.
3. Sign-in and server features
If you choose Google sign-in, our server receives your Google identifier (sub) through OpenID Connect to link an account. The app requests the openid scope; it does not request access to mail, contacts or YouTube history. We do not receive your Google password. We store our own profile, device and session identifiers, selected appearance, item entitlements, balance and grant events. Calendar rewards use the first successful sign-in date and grant records, not a history of watched videos.
Cloud progress requires a separate opt-in. It uses profile and device identifiers, the pet, activity intervals, XP and daily limits, without video or channel titles, URLs or identifiers. Declining progress does not prevent local playback. Signing out ends current account access in the extension, but does not delete account data.
Purchasing the Full Collection
If you buy the Full Collection, Pipguin creates an order and sends the order, offer and product identifiers to Paddle. Paddle sells the collection to you and processes your payment. You enter your email, billing address and card details in Paddle's checkout. Pipguin does not receive your card number or security code. We use order and transaction identifiers, amount, currency and payment or refund status to link the purchase to your profile, unlock the collection and restore access when you sign in. If there is a dispute or refund, we also need records to verify the payment and update access. You can use the free player without making a purchase.
Complimentary access to the collection does not confirm a payment. If no payment transactions are associated with it, the access record is deleted when the account is deleted and is not retained as a financial record.
4. Support and technical data
The support form sends the reply email, category, subject and message you provide. Do not send passwords, sign-in codes, payment credentials or unnecessary personal information. The operator reads requests to respond and fix problems. Email replies are sent manually; the website does not promise an immediate reply. Diagnostic files are not uploaded automatically: you can review their contents before sending them.
When you access the website or API, infrastructure processes your IP address and technical HTTP request information to deliver responses, protect the service and diagnose problems. The website stores the selected theme and display preferences in the browser. Our website does not use advertising pixels, session replay or third-party marketing analytics. Necessary cookies support sign-in, form protection and OAuth. Form sessions last 20 minutes and OAuth transitions up to 10 minutes; ordinary web sessions have a 7-day idle limit and a 30-day maximum lifetime. Expiring access does not mean immediate physical deletion of all associated records.
5. Recipients and locations
Database Mart LLC provides the VPS in the United States for our API, database and backups stored on that server. Operational backups may also be stored on a working device controlled by the operator. Cloudflare, Inc. delivers and protects website traffic through its international network and processes request network data. Google provides sign-in; Google/Gmail also processes your address and correspondence when support replies by email. The operator handles support from Georgia. Google and Cloudflare use infrastructure in multiple countries, including the United States.
SponsorBlock (a project by Ajay Ramachandran) is used only after separate permission to access its service. To find segments, the extension sends the current video's identifier; the service can see the network IP address. We do not select its processing region; its policy is linked below. You can decline permission or disable the feature. YouTube playback continues to contact Google directly under Google's rules.
If you make a purchase, Paddle sells the purchase as merchant of record, takes payment, issues the receipt and handles refunds. The applicable entity - Paddle.com Market Limited, Paddle.com Inc. or Paddle Payments Limited - is identified in Paddle's Buyer Terms. At checkout, Paddle processes order, offer, product and transaction identifiers, the email and billing address supplied by the buyer, and payment, fraud prevention and refund information. The United Kingdom, United States and Ireland are jurisdictions of Paddle entities; this does not mean that processing is limited to those countries. International transfers to other group companies and service providers may occur as described in Paddle's privacy notice. Data held by Paddle are subject to its own retention policy.
Policies: Database Mart https://www.databasemart.com/privacy-policy ; Cloudflare https://www.cloudflare.com/privacypolicy/ ; Google https://policies.google.com/privacy ; SponsorBlock https://wiki.sponsor.ajay.app/w/SponsorBlock:Privacy_policy ; Paddle privacy https://www.paddle.com/legal/privacy ; Paddle Buyer Terms https://www.paddle.com/legal/buyer-terms . Data may be processed outside your country. This policy does not claim certification or universal compliance with every country's laws.
6. Purposes, retention and deletion
Data are used for requested features, responding to support, protection and troubleshooting. Separate consent is used where required; optional features are not required for the local player. We do not sell data, use them for advertising profiles, or transfer them to assess creditworthiness or for lending purposes.
Local settings remain until cleared. Server account data remain until a deletion request, subject to applicable mandatory exceptions. Requested exports and deletions are handled by a separate background job; failures require retry. A completed export is available for 24 hours, after which its contents are cleared.
Primary database cleanup runs every 15 minutes: raw progression intervals are removed after 48 hours, daily aggregates after 90 days, and closed support tickets together with messages and internal notes after 90 days from closure. Total XP remains until profile deletion. Expired sign-in and form records are cleared after related retry periods and references have ended. Active sessions and open tickets remain. Deletion happens during the next successful run; failures or a backlog can delay completion.
New daily database backups are encrypted and verified by restoration. For local daily copies on the server: Their retention period is 30 days, after which older copies are removed during the next successful daily run. The latest verified copy is kept if a new copy has not been created; cleanup stops on failure to protect recovery. Older release archives and copies on the operator work device are tracked separately and are not covered by this automatic period yet. This database job also does not delete Gmail correspondence. The 30 day period is therefore not a promise of physical deletion from every storage location. Encrypted daily database backups are also stored in private Cloudflare R2 object storage. Objects under working/daily/ are protected from ordinary deletion for 30 days and are scheduled for automatic deletion after 35 days. This R2 rule operates independently of the local backup job and may also delete the last R2 copy if no new backup arrives. Provider cleanup may be delayed; 35 days is not a guarantee of physical deletion at an exact time. Verification copies and other prefixes are not covered by this rule.
Use the contact form or the available account deletion request to request removal. The operator checks related copies and correspondence and reports the outcome and mandatory exceptions. The deletion journal remains while backups can restore the data; it must be applied before access resumes after restoration.
After you delete your account, we keep your purchase confirmation, amount and related payment references to reconcile payments and refunds. The normal retention period ends three full calendar years after the end of the year of the last confirmed payment or adjustment, using Tbilisi time. Deleting your account or checking the same payment again does not restart this period. If a payment or refund is under review, a dispute is open, or evidence of the transaction date is missing, we keep the records needed for that case and schedule a further check after 24 hours. After account deletion, an unfinished checkout becomes due for review seven days after the offer expires. While the checkout can still accept a payment, we keep the details needed to verify a late payment. Once we confirm its cancellation and the absence of payments, we delete those details at the next check. The cleanup also covers direct references to the payment in manual reconciliation records. The deletion journal keeps verification hashes so we can check that the deletion is respected when restoring a backup. These markers contain neither the original payment reference nor the amount. The operator separately keeps tax records for at least three years after the end of the year for which they are needed to determine tax liabilities.
7. Your requests and protection
Use the Contact form to request access, correction, export or deletion, withdraw previously given consent, or ask about retention. Proportionate verification of data ownership may be needed to protect your account. Applicable legal rights, including the right to contact a competent supervisory authority, remain available. We use HTTPS, access restrictions and session protection; absolute security cannot be guaranteed.
The product is intended for people aged 16 and over. If you believe we have received data about a younger child, contact us through the form. Material changes to processing will appear in a new policy version before the relevant feature launches, with separate consent where required.
8. Chrome Web Store Limited Use
Pipguin's use and transfer of data obtained through the extension comply with the Chrome Web Store User Data Policy, including its Limited Use requirements. This includes information received from Google APIs. We use data only to provide or improve the disclosed YouTube viewing features and their related support, security and reliability. We do not use or transfer these data for personalized advertising, sale to data brokers, creditworthiness or lending decisions. Human access is limited to the exceptions allowed by that policy, such as your explicit consent for a support request or a security investigation. The Chrome Web Store User Data Policy is available at https://developer.chrome.com/docs/webstore/program-policies/limited-use .