Restrict Google OAuth to youtube.force-ssl and document zero Google data sharing.

Addresses Google OAuth verification feedback on scopes and privacy disclosure.

app/privacy/page.tsx

@@ -106,6 +106,16 @@ export default function PrivacyPage() {
         appropriate contractual safeguards where required.
       </p>
 
+      <h2>Google User Data Sharing and Disclosure</h2>
+      <p>
+        We do not sell, share, transfer, or disclose any Google user data to any third parties.
+      </p>
+      <p>
+        All user data retrieved via Google OAuth APIs is used solely and strictly for the core
+        functionality of the application (uploading user-generated media) and is never distributed,
+        transferred, or disclosed to external services, partners, or third parties.
+      </p>
+
       <h2>6. Data retention</h2>
       <ul>
         <li>Uploaded source files and generated outputs are retained only as long as needed to complete your jobs</li>

lib/auth.ts

@@ -19,9 +19,7 @@ export const authOptions: NextAuthOptions = {
             "openid",
             "email",
             "profile",
-            "https://www.googleapis.com/auth/youtube.upload",
-            "https://www.googleapis.com/auth/youtube.readonly",
-            // Required to add uploaded videos to playlists
+            // Single YouTube Data API scope (covers upload, channel, and playlist APIs)
             "https://www.googleapis.com/auth/youtube.force-ssl",
           ].join(" "),
         },