From bcca0a6e6f3f1fe0a7129b3e07934796aa5d22f4 Mon Sep 17 00:00:00 2001
From: Songs2YT <songs2yt@atakanozban.com>
Date: Wed, 22 Jul 2026 18:17:09 +0200
Subject: [PATCH] Restrict Google OAuth to youtube.force-ssl and document zero
 Google data sharing.

Addresses Google OAuth verification feedback on scopes and privacy disclosure.
---
 app/privacy/page.tsx | 10 ++++++++++
 lib/auth.ts          |  4 +---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/app/privacy/page.tsx b/app/privacy/page.tsx
index 21c8a90..f3c4eeb 100644
--- a/app/privacy/page.tsx
+++ b/app/privacy/page.tsx
@@ -106,6 +106,16 @@ export default function PrivacyPage() {
         appropriate contractual safeguards where required.
       </p>
 
+      <h2>Google User Data Sharing and Disclosure</h2>
+      <p>
+        We do not sell, share, transfer, or disclose any Google user data to any third parties.
+      </p>
+      <p>
+        All user data retrieved via Google OAuth APIs is used solely and strictly for the core
+        functionality of the application (uploading user-generated media) and is never distributed,
+        transferred, or disclosed to external services, partners, or third parties.
+      </p>
+
       <h2>6. Data retention</h2>
       <ul>
         <li>Uploaded source files and generated outputs are retained only as long as needed to complete your jobs</li>
diff --git a/lib/auth.ts b/lib/auth.ts
index ee596f9..7e9c9a9 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -19,9 +19,7 @@ export const authOptions: NextAuthOptions = {
             "openid",
             "email",
             "profile",
-            "https://www.googleapis.com/auth/youtube.upload",
-            "https://www.googleapis.com/auth/youtube.readonly",
-            // Required to add uploaded videos to playlists
+            // Single YouTube Data API scope (covers upload, channel, and playlist APIs)
             "https://www.googleapis.com/auth/youtube.force-ssl",
           ].join(" "),
         },