Last updated 24 October 2026
This policy covers Proof & Ripple’s website and correspondence, and the account-data practices of our private production application, Faceless AI Studio. The website does not offer visitor accounts or a Google sign-in service.
1. Who is responsible
The operator and privacy contact is Tobias Steger, operating personally as Proof & Ripple, Brgy. Bulata, 6112 Cauayan, Philippines. Contact tobiassteger69@gmail.com with privacy questions or complaints.
2. Website visits
The website has no registration, contact form, payment collection, advertising, analytics scripts, tracking pixels, embedded social feeds or video players. It sets no cookies and uses no browser storage. Page assets are hosted with the site.
The site is hosted on an xCloud-managed Vultr server in Frankfurt, Germany. Ordinary access logs record IP address, time, request method, URL path, protocol, response status and response size. Their format omits query strings, referrers and browser user-agent fields. Error logs may contain request details needed to diagnose faults. These records support operation, security and troubleshooting.
Ordinary access and error logs rotate daily, with an approximate 30-day live-log retention target and additional size checks. High traffic can shorten retention. Routine file access is restricted to the log-writer account and privileged administrators. Hosting and infrastructure providers may also have access for operation, security and support.
Weekly server backups can retain log data after live logs expire, particularly if backup creation stops. No fixed deletion date is promised for backup or provider-held copies. See xCloud’s Privacy Policy.
3. Messages you send us
If you email us, we receive your email address, message and any attachments. We use them to answer your request and handle editorial corrections, rights concerns or privacy questions. Correspondence is processed through Gmail. We do not operate a mailing list or marketing subscription through this website.
Ordinary correspondence is reviewed manually for removal approximately 12 months after the matter is resolved. Information needed for a rights dispute, security matter or legal obligation may be retained longer, with the reason reviewed and recorded. This is a manual process, not an automatic mailbox deletion rule. Gmail and retained backups may have separate deletion and recovery periods.
4. External platforms
Our YouTube, Instagram, Facebook and TikTok links open services with their own privacy policies. Following a link does not connect your account to our website or give us account permissions.
5. Your choices and privacy requests
To ask about access, correction, objection or deletion of information you supplied, email tobiassteger69@gmail.com. Identify the relevant message or account and describe your request. Requests are handled manually, with an appropriate identity check; we do not ask for your password or authorization tokens.
The operator is based in the Philippines. Applicable rights depend on jurisdiction and context. Where the Philippine Data Privacy Act applies, you may raise a complaint with the National Privacy Commission.
For Faceless AI Studio’s Google access, you can also revoke authorization in Google Account third-party permissions. Revocation stops further authorized access but does not itself erase local records or backups. Google data removal is explained below.
6. Faceless AI Studio and Google data
This section concerns the brand operator’s authorized use of Faceless AI Studio, our private production application. It is separate from browsing this website. Proof Ripple Studio is the associated Google Cloud project name.
Access and purpose
Faceless AI Studio uses YouTube API Services to verify the authorized channel and match the intended account. Google handles sign-in and consent. The granted scopes are youtube.readonly, for viewing YouTube account information, and youtube.upload, for uploading and related scope-authorized video management. Upload permission can allow public uploads; the application currently blocks uploading, scheduling and publishing. A future upload requires separate owner authorization.
The current connection does not collect audience analytics, and no YouTube Analytics or revenue permission is granted. Google account data is used for the authorized channel connection. It is not sold, used for advertising, provided to advertisers or sent to AI providers for model training or fine-tuning. It is not shared with website visitors.
Storage and security
Connection records include channel ID, granted scopes, authorization state, expiry and check times, and references to credentials. Access and refresh tokens and imported OAuth configuration are stored in account-isolated macOS Keychain entries, accessible while the device is unlocked and tied to that device. An original configuration download is also retained with owner-only file permissions; Keychain is not necessarily its only copy. Local project records hold credential references rather than raw tokens.
Token exchanges and authorized channel checks communicate with Google over HTTPS. Full channel responses are not persistently cached, and the network session does not retain response cookies. Channel identity and connection metadata are retained in current and recovery copies of the library and verification records. The application does not request the Google password.
Independent production records, including scripts, source references, media and review decisions, are stored on the operator’s Mac and selected storage, including an external SSD and owner-managed backups. Website visitors cannot access that local library, media storage or Keychain.
Retention and review
The application flags an owner review after 28 days. The operator must verify or refresh the connection, or confirm cleanup, before the applicable 30-day API-data limit. This requires owner action; it is not unattended automatic erasure. Restarting the application does not initiate a token refresh or API check. Token expiry alone does not erase credentials.
New credential references are tracked for account-specific cleanup. Older untracked Keychain entries, downloaded configuration files and separate rollback or backup copies require a separate exact-item review. Unrelated Keychain items and files are not scanned or deleted.
Revocation and Google data deletion
The application offers two separately confirmed controls: Review local connection cleanup removes known account-specific credentials and local connection records; Revoke access and clean up first requests Google revocation, then performs local cleanup. Previewing or cancelling changes nothing. Local-only cleanup does not revoke Google’s grant. Google revocation can affect all scopes and clients associated with the same project grant.
Confirmed cleanup clears the selected account’s channel, permissions, expiry and cached analytics records from current and recovery libraries, removes verification receipts and the OAuth registration, and deletes known credential references. Independent editable projects, videos, scripts, branding, approvals and other accounts are preserved. A failed or interrupted cleanup is reported and may require retry.
Downloaded configuration files, external backups and legacy untracked credentials are not silently deleted; the operator must review those exact copies as part of a deletion request. Confirmed deletion requests and revoked access are handled promptly, targeting no later than seven calendar days, including review of retained copies. This is an operational commitment requiring owner action.
Removing local Google data does not delete a YouTube channel or videos held by YouTube. Manage those directly in YouTube. You may also request removal by emailing the privacy contact above.
Faceless AI Studio’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. This statement is not a claim of Google verification.
7. Other connected-account services
No Instagram, Facebook or TikTok API accounts are connected to Faceless AI Studio. No Meta deletion callback or server-side token service is deployed. This policy and any required notices will be updated before introducing such account access.
8. Security and policy changes
Please avoid sending unnecessary sensitive information or putting secrets in URLs. Local access controls and Keychain storage reduce risk, but no system can guarantee absolute security.
Changes in data access or purpose require updated notices and any necessary renewed consent before that use begins. Related information: Google Privacy Policy, YouTube Terms of Service, and our Terms of Use.