Privacy Policy
Last updated: 2026-09-07
CPEBuddy turns YouTube security videos into CPE (Continuing Professional Education) documentation. This page describes, in plain language, what data the CPEBuddy web application and Android app store and where it goes. It covers the application as implemented; it does not describe hosting or network infrastructure outside the application.
Account data we store
When you create an account, CPEBuddy stores:
- Your email address (required).
- A hashed form of your password. The plain password is not stored.
- A display name (optional). Registration sets it to the part of your email before the "@" sign; you can change it in Settings.
- An avatar image if you upload one (JPEG, PNG, SVG, or GIF, up to 5 MB).
- Whether your email is marked verified, and account created/updated timestamps.
- If you sign in with Google or GitHub on the web, a link between your account and that provider (the provider name and your user ID at that provider). These sign-in options are not shown in the Android app.
Application data we store
As you use CPEBuddy, the following records are stored against your internal account ID:
- CPE records: the video ID, title, and channel, credit hours, CISSP domains, learning objectives, key takeaways, self-assessment questions, the generated summary and document, video duration and word count, and generated/viewed timestamps.
- Portfolio totals: your overall and per-domain credit totals.
- Processing log entries: the outcome of each generation attempt (for example generated, incomplete, or rejected as not relevant) with a timestamp and related details.
- Submissions: the YouTube URL you typed, the YouTube video or channel IDs derived from it, catalog IDs, status, status reason, and timestamps.
- Ratings: your 1-5 rating of a video and when you gave it.
The video catalog and transcripts come from the separate TLDR HQ catalog and are read only. These catalog records are separate from your account and CPE tracking records.
Third parties that receive data
- AI model provider: to generate a CPE document, CPEBuddy sends the video title, channel name, transcript, duration, and publish date to a third-party AI model provider. Your account ID, email, and name are not sent.
- TLDR HQ: when you submit a video or channel, CPEBuddy sends only the YouTube video URL or ID, or the channel reference, to the TLDR HQ ingestion service using a CPEBuddy service account. Your identity is not sent.
- DiceBear: if you have not uploaded an avatar, your browser requests a placeholder avatar from DiceBear using your display name as the seed, so your display name is sent to DiceBear.
- Thumbnail hosts: video thumbnails are loaded by your browser directly from the image hosts referenced by the catalog (YouTube-hosted images, with a local fallback when an image fails to load).
Server request logs
The backend records each request's method, path, response status, the signed-in account ID when present, your browser's user agent string, and your IP address. Backend and processing logs also include account IDs and request IDs. These logs are used to operate and troubleshoot the service. The application code does not set a retention period, and this page does not promise one.
How to change or delete your data
- In Settings you can change your display name, upload or replace your avatar, change your password, and request an email verification message. Your email address cannot be changed in the app.
- You can delete your account from the Danger Zone in Settings. Deletion removes your account record and all records keyed to your account: see Account Deletion for exactly what is removed.
What the application does not do
- It does not include advertising or analytics trackers.
- It does not send your account ID, email, or name to the AI model provider.
- It does not send your identity to TLDR HQ when you submit a video.
These statements describe the application code. They do not cover hosting or network providers, and this page does not make claims about them.
Contact
For privacy questions or data deletion requests, email [email protected].