Operator and scope
Operator: Ayberk Kolcu. Contact: narutoopenclaw@gmail.com. This notice covers the private Kolcu Heliograph integration used to manage the operator's own portfolio and connected YouTube channel. It is not a privacy notice for an unrelated product or a public Heliograph subscription service. This edition retains the 15 October 2026 public notice's scope and adds the actual account-email, media-preparation and text-quality services.
Data accessed and purposes
- Account and authorization: the operator's email, session and security records; Google access and refresh tokens, granted scopes and connection status, to maintain the connection approved by the account owner. Heliograph does not request or store the Google account password.
- YouTube channel and content: channel identifiers and profile information; video identifiers, titles, descriptions, visibility and processing status; uploaded video files, thumbnails, captions and metadata. These support channel identification, authorized publication and result checks.
- Comments and analytics: comment text, author information supplied by YouTube and aggregate channel/video analytics, when used to manage comments and assess the operator's content within the authorized scopes.
- Owned content preparation: drafts, source claims, persona style rules, media and review results supplied for the operator's portfolio. The selected text-quality service receives the limited content described in the AI-processing notice.
- Operational records: job identifiers, timestamps, content hashes, approval versions and sanitized outcome records used to diagnose failures, account for authorized use and avoid duplicate publication.
Storage, recipients and limited use
The private Heliograph application stores operational records and media on the operator-controlled local installation. Authorization credentials are encrypted and access is restricted. Tokens are not included in this website or in model prompts. Local storage does not make external API or AI processing local-only.
Google and YouTube receive the API requests and media or metadata necessary for the authorized action. Resend processes the operator's recipient email and account-email content, including verification messages. Render serves the public information pages and may process network request information needed for delivery and security. Domain and DNS are managed through GoDaddy.
For the selected quality route, OpenAI receives the operator-supplied text through the operator's authenticated Codex/ChatGPT subscription. Separately authorized speech preparation uses fal.ai and ElevenLabs for narration text and audio transcription. Those services do not receive Google credentials through these routes. Provider processing and retention depend on the applicable service terms and account settings; this notice does not promise zero retention or unverified training exclusions.
Google user data is used to provide the features described here. It is not sold or used by Heliograph for advertising or training generalized AI or machine-learning models. The text-quality route does not fetch Google comments or analytics; Google API data must not be copied into its input. Human access is limited to the owner's use and authorized troubleshooting, security or legal needs.
Kolcu Heliograph's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
TikTok
For TikTok accounts of the owner's brands that the account holder authorizes with Login with TikTok, Heliograph receives the TikTok open ID, display name and avatar (user.info.basic) and access and refresh tokens, and sends the owner's own videos, captions and privacy settings to TikTok (video.upload, video.publish). This data is used only to identify the connected account, upload or publish the owner's content and check the result. Tokens are stored encrypted on the owner's local installation and are never shown on this website. TikTok data is not sold, used for advertising or used to train AI models. Revoking access in TikTok stops future access; to remove retained records, contact the operator above.
Retention and removal
Connection data is retained while needed for the authorized connection. Content metadata and sanitized publication records are retained while needed to operate the portfolio, verify results and investigate unresolved actions, subject to the application's configured retention and deletion controls. They are not retained for advertising or resale.
The owner can disconnect a channel and revoke permission through Google Account connections. Revocation stops future authorized access but does not itself erase previously stored records or delete published YouTube videos. To request access to or removal of retained application data, contact the operator above. The operator will identify relevant records and any legal or unresolved-operation retention constraint. A provider's separate copies and account controls must also be addressed with that provider.
Website and operational application
The public information pages contain no sign-in form, advertising, embedded videos, analytics scripts or tracking cookies. The authenticated operational application uses session/security cookies to support sign-in and access controls. Hosting services may process IP addresses and requested URLs to deliver and protect their service. Google's own services are also governed by the Google Privacy Policy.