Privacy Policy

MCP Initask · last updated 11 October 2026

MCP Initask ("the app") is a personal connector operated by Vitalii Miniailo (Initask) at https://agent.initask.com. It serves one user, the owner, and the Google account he connects himself. This policy explains what the app does with Google user data, in particular YouTube data obtained through Google OAuth.

1. Data the app accesses

Permission (scope)	What the app does with it
`youtube`, `youtube.force-ssl`	Reads the connected channel, its videos, playlists and comments; updates video titles, descriptions, tags, thumbnails, playlists and channel description after the owner approves the change; posts replies to comments on the owner's request.
`youtube.upload`	Uploads videos the owner prepared and approved for publication.
`yt-analytics.readonly`	Reads YouTube Analytics reports (views, watch time, audience retention) of the owner's channel to show him how his videos perform.
`webmasters` (with `openid`, `email`)	Separate connection of the owner's Google Search Console: lists his verified sites and reads search performance, URL inspection and sitemap status to report them to him, and on his request submits sitemaps of his own sites. The email is used only to check that the intended account signed in. Sites, users and settings in Search Console are never changed or removed.
Threads: `threads_basic`, `threads_read_replies`, `threads_manage_replies`, `threads_content_publish`, `threads_manage_insights`	Reads the owner's own Threads posts and the replies to them, notifies him about new replies, and publishes or hides a reply only after he approves that exact reply (or within an auto-reply rule he switched on himself, limited in scope and time and logged).
Facebook Pages: `pages_show_list`, `pages_read_engagement`, `pages_read_user_content`, `pages_manage_engagement`, `pages_manage_metadata`, `pages_manage_posts`, `business_management`	Lists the Pages the owner administers, reads their posts and comments, notifies him about new comments, and replies or hides a comment as the Page only after his approval (or within his auto-reply rule). Personal Facebook profiles are not accessed.
`analytics.readonly` (with `openid`, `email`)	Separate read-only connection of the owner's Google Analytics 4: lists his accounts and properties and runs reports and realtime reports on his request. Nothing in Google Analytics is changed.
`adwords` (with `openid`, `email`)	Separate connection of the owner's Google Ads: lists his accounts and reads campaigns, spend and conversions. The app prepares changes (new campaigns, which are always created paused, budgets, ads, keywords, offline conversions) as drafts, checks them with Google's validate-only mode, and applies a change only after the owner approves that exact change in his Telegram approval bot. It never spends or publishes on its own.

The app also stores the channel ID and channel title returned by the YouTube Data API to keep the selected channel fixed.

2. How the data is used

Only to provide the features the owner asks for: managing and analysing his own channel and publishing his own approved content.
YouTube data is shown to the owner through his AI assistant (Claude by Anthropic) when he asks for it. The assistant receives the result of the specific request, for example a list of videos or an analytics report, and processes it under the owner's own Anthropic account.
The app does not sell Google user data, does not use it for advertising, and does not use it to train or improve artificial intelligence or machine learning models.
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Where and how it is stored

The OAuth refresh token, the short-lived access token, the channel ID and title are stored in a database on a virtual machine of the operator in Microsoft Azure. The database file is readable only by the server process (file mode 0600). Traffic to the app uses HTTPS.
Videos and thumbnails prepared for upload are stored as working files on the same server. Working files are deleted automatically after 14 days; files attached to a publication that waits for approval are kept until the owner deletes or cancels that publication.
The app keeps a journal of its actions (for example "video uploaded", with the video ID and title) so the owner can see what was done on his behalf.
Server logs may contain technical details of failed requests (for example an API error message); they rotate automatically and are limited to 60 MB.
Backups: once a day the server makes a backup of its database, which includes the tokens; the 14 most recent backups are kept. Before each software update a snapshot of the data folder is made; the last 30 snapshots are kept. Backups are stored on the same virtual machine in a folder accessible only to the administrator.
YouTube data received through the API (video lists, statistics, analytics) is fetched on request and returned to the owner; the app does not build a separate copy of it, except entries in the action journal and publication records described above.
Google Search Console: the refresh token of this separate connection is stored in the same database encrypted (Fernet) with a key held by the server; the short-lived access token is kept only in memory. Search Console data (sites, search performance, URL inspection, sitemaps) is fetched on request and returned to the owner; the app does not keep a copy of it.
Threads and Facebook Pages tokens are stored encrypted in the same database. Comments the app monitors (author name as returned by Meta, text, time, the post they belong to) are kept so the owner can see what was answered and how; the owner can ask to delete them at any time.
Google Analytics and Google Ads connections are stored the same way: separate encrypted refresh tokens, access tokens only in memory; report data is fetched on request and not kept by the app.

4. Who has access

The owner, through the password-protected connection page and through AI assistant sessions he authorises (sign-in with his password, or his personal access token).
The operator's infrastructure administrators (Initask), acting on the owner's instructions, to maintain the server.
Service providers that process data as part of the requests described above: Google (YouTube APIs, Search Console API, Google Analytics APIs, Google Ads API), Meta (Threads API, Graph API), Microsoft Azure (hosting), Anthropic (the owner's AI assistant). The app shares data with no other parties, except where required by law.

5. Revoking access and deleting data

Revoke the app's access to your Google account at any time: https://myaccount.google.com/connections (also available at https://security.google.com/settings/security/permissions). After revocation the stored token stops working and the app stops all requests to YouTube.
On the connection page the owner can disconnect a channel: the app revokes the token at Google and deletes the token, channel ID and title from its database immediately.
Disconnecting Google Search Console on the connection page deletes its token from the app's database immediately. The app does not revoke that grant automatically, because the YouTube and Search Console connections share one OAuth client; to revoke Search Console access at Google, use the link above. The same applies to the Google Analytics and Google Ads connections.
To delete everything else (working files, journal entries, publication records), write to vitalii.miniailo@gmail.com; it is deleted from the live database on request. Copies inside existing backups disappear when those backups rotate (the 14 most recent daily backups are kept; snapshots rotate with the next 30 software updates), or earlier on request.

6. Other services the owner connects

When the owner connects another service through its official API (for example OLX Partner API via OLX OAuth), the app stores that service's tokens the same way as described in section 3 and uses them only to read the owner's own listings and conversations and to send replies or publish listings that the owner approved in the approval step. Paid features of such services are not used. Tokens are deleted on disconnect or on request.

7. Other Google policies

YouTube features of the app use YouTube API Services. See the YouTube Terms of Service and the Google Privacy Policy.

8. Changes and contact

This policy is updated when the app's handling of data changes; the date above shows the current version. Questions and requests: Vitalii Miniailo, vitalii.miniailo@gmail.com.