Privacy policy

Last updated 2 November 2026

Small Shipyard is a one-person app studio run by Gökhan Özdemir, a sole proprietor based in Türkiye. I’m responsible for the personal data described on this page (the “data controller”). For anything about your data, email privacy@smallshipyard.com.

This policy covers this website, email you send to Small Shipyard, and Small Shipyard Analytics, the Google sign-in that Small Shipyard’s internal tools use to work with its own YouTube channels. Each Small Shipyard app will get its own privacy policy when it launches, linked from the app and its store page.

This website

smallshipyard.com sets no cookies, runs no analytics, and loads no scripts, fonts or images from other services. Everything on the page comes from this domain.

The site is hosted on Cloudflare. Like any web host, Cloudflare processes technical data from each visit, such as your IP address and browser type, to deliver the pages and protect the site from attacks. Cloudflare’s privacy policy explains how it handles that data.

Email

If you write to hello@, support@ or privacy@smallshipyard.com, I get your email address and whatever you put in the message. These mailboxes run on Google Workspace.

I use your message only to reply and to deal with what you asked. I don’t add you to a mailing list, and I don’t share your message with anyone unless you ask me to or the law requires it. I keep the conversation while it’s useful for follow-up questions, and delete it sooner if you ask.

Small Shipyard Analytics

Small Shipyard Analytics is the Google sign-in for a few tools I built for Small Shipyard’s own YouTube channels, currently Paper Midas and Meeple Melodies. The tools read each channel’s performance data, and for Meeple Melodies they also keep video descriptions, categories and tags up to date. Small Shipyard Analytics uses YouTube API Services. It isn’t offered to the public, and the only Google accounts that sign in to it are the ones that own those channels.

What it can access

Every account that signs in grants two read-only permissions:

• youtube.readonly (YouTube Data API): channel and video details, such as titles, publish dates, and view, like and comment counts.
• yt-analytics.readonly (YouTube Analytics and Reporting APIs): channel reports, such as watch time, audience retention, traffic sources, viewer countries, impressions and click-through rate.

The Meeple Melodies account also grants one more:

• youtube.force-ssl (YouTube Data API): Google describes it as permission to see, edit and permanently delete the account’s YouTube videos, ratings, comments and captions. The tools use it for one job: updating the description, category and tags of Meeple Melodies’ own videos.

The tools never upload or delete videos, post or delete comments, change channel settings, or touch any channel other than these two. YouTube Analytics reports are aggregated, so they don’t identify individual viewers.

How the data is used and stored

• The data is used only to see how the channels’ videos perform, to plan new ones, and to keep Meeple Melodies’ video descriptions, categories and tags up to date.
• Access tokens and downloaded reports are stored on my own computer, in a folder only my user account can open. They aren’t uploaded to any server I run.
• I review the reports with the help of an AI assistant, Claude, made by Anthropic. When I ask it about a channel’s performance, the figures it needs are sent to Anthropic to produce the answer, under Anthropic’s privacy policy.
• The data is never sold, used for advertising, or shared with anyone else.

How long it’s kept

• Access tokens are kept while the tools are in use.
• YouTube Analytics and Reporting data are kept while they’re useful for comparing videos over time. At least every 30 days, the tools check that their access is still authorized. If it isn’t, the stored data for that account is deleted.
• Other channel and video details are deleted or refreshed within 30 days.

Removing access

Any account that signed in can remove Small Shipyard Analytics’ access on Google’s security settings page. After that, I delete the stored tokens and data for that account within 30 days. To have the data deleted without removing access, email privacy@smallshipyard.com and I’ll delete it within 7 days. Deleting data here doesn’t affect anything YouTube stores.

Google’s policies

Small Shipyard Analytics’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google’s own handling of data is covered by the Google Privacy Policy. Using the tools also means agreeing to the YouTube Terms of Service.

Your rights

Depending on where you live, data protection law (such as the GDPR in the EU or KVKK in Türkiye) may give you the right to see the data I hold about you, correct it, delete it, or object to how I use it. Email privacy@smallshipyard.com and I’ll reply within 30 days. You can also complain to your local data protection authority.

Changes

When this policy changes, I’ll update this page and the date at the top.