Privacy Policy

Last updated: June 22, 2026

Fathom is a YouTube-to-revenue analytics tool for content creators. It connects a creator's YouTube channels (and, optionally, their Stripe account) to report how individual videos perform and which ones drive subscriptions. This policy explains what data Fathom accesses, how it is used, and how it is protected.

Information we access

  • YouTube data (read-only). With your authorization, Fathom reads — and only reads — your channel and video information and analytics: channel and video metadata (titles, descriptions, publish dates, thumbnails), view counts, likes, comments, watch-time and audience-retention metrics, and subscribers gained. Fathom requests only read-only scopes (youtube.readonly and yt-analytics.readonly) and has no ability to create, edit, upload, or delete anything on YouTube. You may also add public channels by URL, in which case only publicly available data is read.
  • Stripe data (read-only, optional). If you connect Stripe, Fathom uses a restricted, read-only key limited to coupon / promotion-code usage, solely to attribute subscription conversions to the videos whose promo codes were used. It does not access customers, charges, or any other Stripe data.
  • Account data. The email address and password you use to sign in to Fathom, and the workspaces, channels, and team members you set up.

How we use it

Data is used only to provide the service to you: to compute and display per-video, per-channel, and all-channel metrics, and to tie conversions back to videos. Fathom does not use your data for advertising, and does not sell or rent it.

How we share data

Fathom does not sell, rent, or trade your data, and does not share, transfer, or disclose Google user data to any third party for that party's own purposes. We share, transfer, or disclose Google user data only in the limited circumstances below:

  • Service providers that operate Fathom on our behalf. Fathom's application and its database run on cloud hosting infrastructure provided by Railway. Your Google user data is stored on that infrastructure solely so Railway can host and run the service for us; Railway acts as our processor under our instructions and does not use your data for any other purpose. We do not use any other third party to process Google user data. (Account email addresses — not Google user data — are also passed to our email provider, Resend, only to deliver team-invitation emails.)
  • To comply with the law. We may disclose data if required to do so by law, regulation, legal process, or an enforceable governmental request.
  • With your consent. We may share data in any other way if you direct or explicitly consent to it.

We do not share, transfer, or disclose Google user data to anyone else, and we never transfer it to others for advertising, market research, or for the development, improvement, or training of generalized or non-personalized AI and/or ML models.

Limited Use disclosure

Fathom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, the YouTube data Fathom accesses is used only to provide and improve the user-facing analytics features described above; it is not transferred to others except as necessary to provide the service, to comply with applicable law, or with your consent; it is not used for advertising; and no humans read the data except where required for security, to comply with law, or with your explicit consent. Fathom's use of YouTube data is also governed by the YouTube Terms of Service and the Google Privacy Policy.

How we store and protect it

Fathom protects your data, including Google user data and other sensitive data, with the following safeguards:

  • Encryption in transit. All data exchanged with Fathom — including every request to and from Google's APIs — is sent over encrypted HTTPS/TLS connections.
  • Encryption at rest. The most sensitive credentials — your Google OAuth access and refresh tokens and your Stripe restricted key — are encrypted at the application layer with authenticated AES-256 encryption before they are written to the database, so they are never stored in plain text. The database itself resides on access-controlled cloud infrastructure.
  • Access controls and tenant isolation. Your data lives in your own workspace and is accessible only to the members you invite. Every request is scoped to a single workspace, so one customer's data can never be read by another. Operational access to the underlying systems is limited to authorized personnel and used only for maintenance, security, or to meet a legal obligation.
  • Read-only access and data minimization. Fathom requests only read-only Google scopes and stores only the metrics it needs to provide the analytics features — it cannot create, edit, or delete anything in your YouTube account.

Data retention and deletion

You can disconnect a channel or Stripe at any time from Settings, which removes the associated data and tokens. You may request deletion of your account and all associated data by contacting us. Revoking Fathom's access from your Google Account permissions immediately stops any further access to your YouTube data.

Contact

Questions or deletion requests: justinglow@gmail.com.

← Back