Measured for you, stored with the host you choose.

The owner's Vercel, Supabase and Google Cloud accounts run the app, database and YouTube connection. The owner controls the database and server secrets and can access stored data. Only join a Villow run by someone you trust.

Sharing controls govern what other members see through the app. They don't make data private from the operator. There isn't a central collection of everyone's viewing data at Fix the Web.

• Watching and browsing time, opens, channels and sources, to show where time goes and apply chosen limits.
• Skips, saved progress and optional worthwhile ratings, for reflection and explained suggestions.
• A 30-day Viewing Review.
• Connected YouTube browser counts and supported shared settings, described in the extension policy.

Native YouTube apps, unconnected browsers and other apps are outside that coverage.

Review the sharing choices for people on your Villow. Recommendations, participating in a shared room and sharing activity have their own social context. You can use Villow without social participation or ratings. The operator's database access remains separate.

Google sign-in requests email/profile and youtube.force-ssl, a broad permission with write access. Villow can change subscriptions and supported managed playlists when you use those features. Its worthwhile ratings stay in Villow rather than becoming YouTube likes.

Google Tasks and Todoist ask for access when you choose to connect them. Their task-management permissions allow writes and deletion; supported task moves can delete the original after recreating it elsewhere.

You can revoke Villow's Google access. Revocation, logout and deleting stored data are separate actions. New server token writes are encrypted; historical rows transition on their next write. That encryption doesn't hide data from the host.

Optional surveys are hosted on Tally and send your submitted answers to Fix the Web. Links use a separate participant code rather than your name or email. Your installation's private viewing measurements aren't automatically submitted. Feedback helps test the design; it isn't proof of a wellbeing outcome.

Ask the owner about stored data. Admin controls can revoke another member and separately delete that revoked member's data. Logging out or revoking Google access doesn't itself erase the database. General retention, backups and minimum age still need completion in the draft app policy.

The site's source includes no analytics, cookie-setting code or third-party embeds. Assets are served with the site. Cloudflare hosts it and may process requests or provide network diagnostics under its own configuration; the app and extension have separate data flows.