Privacy Policy
Effective date: 26 October 2026
This policy explains what information Laysh Lab (“we”, “us”) handles through this website (layshlab.com) and through our own publishing tool, Laysh Lab Publisher. We keep it short and plain, and we only describe what we actually do.
1. This website
What we collect
Nothing directly. The site is a set of static pages. It has no sign-up, no comment box, no contact form, no cookies, no analytics or tracking code, no advertising and no JavaScript.
Hosting logs (GitHub Pages)
The site is hosted on GitHub Pages. Like any web host, GitHub receives technical data when your browser requests a page, such as your IP address, browser type and the page requested, and GitHub says it logs visitor IP addresses for security purposes. We do not receive or use these logs. See the GitHub General Privacy Statement.
Fonts (Google Fonts)
Our pages load the Poppins and Cairo fonts from Google Fonts, so your browser contacts Google’s font servers, which receive your IP address and browser details. Google states that the Google Fonts API does not use cookies. See the Google Fonts privacy FAQ and the Google Privacy Policy.
Links to other sites
We link to YouTube, Instagram, TikTok and to the sources behind our videos. Those sites have their own privacy policies; we are not responsible for them.
If we change this
If we ever add analytics, cookies or anything else that collects data on this site, we will update this policy first and change the date at the top.
2. Laysh Lab Publisher (our developer apps)
“Laysh Lab Publisher” is our internal publishing tool. It connects to Google (YouTube), Meta (Instagram) and TikTok through developer apps we registered ourselves. It runs on our own computer, is used only by the Laysh Lab team, and connects only to our own @layshlab accounts. It is not offered to the public, and no one else can sign in to it.
What platform data the apps access
| Platform and API | Permissions (scopes) | What we use them for |
|---|---|---|
| YouTube Data API v3 and YouTube Analytics API (Google) | https://www.googleapis.com/auth/youtube.force-sslhttps://www.googleapis.com/auth/yt-analytics.readonly | Upload our own videos with their titles, descriptions, captions and publishing schedule; read our channel’s and videos’ details and public comments on our videos; read our own channel analytics (views, watch time, likes, subscribers gained). |
| Instagram API with Instagram Login (Meta) | instagram_business_basicinstagram_business_content_publishand, if we enable it, instagram_business_manage_insights | Read our own account’s basic profile (user ID, username); publish our own Reels and posts; read our own posts’ insights, if that permission is enabled. |
| TikTok Login Kit and Content Posting API | user.info.basicvideo.uploadand, if enabled, video.publish | Confirm we are connected to @layshlab (open ID, display name, avatar); send our own videos to our TikTok drafts or post them to our own account. |
We will add new permissions only after updating this table.
Whose data this is
The apps work only with data about our own accounts and our own videos. Analytics from the platforms is aggregated (for example, total views per video). It does not identify individual viewers. Public comments on our videos may include commenters’ public usernames. We read them only to answer questions and to pick “Ask Laysh” topics, and if we feature your question we credit you by your public username.
How we store tokens and data
- Access and refresh tokens, and app credentials, are stored only on our own computer, in a private folder. They are never put on this website, in public code, or in chat or email.
- Uploads go straight from our computer to each platform’s official API over encrypted (HTTPS) connections. For Instagram, the platform requires each video to be at a public web address, so we first upload our own finished video file to our media-hosting account (Cloudinary), which Instagram fetches it from.
- Analytics we read are saved as simple statistics files on the same computer, for planning our content.
- We use AI tools to help run our workflow. An AI assistant (Anthropic’s Claude) runs our publishing scripts and summarises our own statistics. ElevenLabs generates our narration from our scripts. We do not use or transfer platform data to train AI models.
Sharing and selling
We do not sell, rent or trade any data. We do not share platform data with anyone, except the service providers listed above where needed to do the job (the platforms themselves, our media host for Instagram uploads, and our AI tools), or if the law requires it. We do not use it for advertising.
Google API Services: Limited Use
Laysh Lab Publisher’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data we receive through the YouTube APIs is:
- used only to provide the app’s features: publishing our own videos and showing us our own channel statistics;
- not transferred to others, except as needed to provide those features, to comply with the law, or as part of a merger or acquisition;
- not used or transferred for advertising, retargeting or personalised ads, or to determine creditworthiness or for lending;
- not sold, and not used or transferred to develop, improve or train AI or machine-learning models;
- not read by people, except our own team looking at our own channel’s data, or where needed for security or to comply with the law.
Laysh Lab Publisher uses YouTube API Services. By using YouTube you are subject to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy.
How to revoke access
- Google / YouTube: remove “Laysh Lab Publisher” in the Google security settings at security.google.com/settings/security/permissions.
- Instagram: in the Instagram app, go to Settings → Website permissions → Apps and websites, and remove the app. Or remove the account’s role in the Meta developer dashboard.
- TikTok: in the TikTok app, go to Settings and privacy → Security and permissions → Apps and services permissions, and remove the app.
Because these apps only connect to our own accounts, in practice we are the only people who would ever do this. If you believe an app of ours has access to an account that is not ours, email us and we will remove it.
Data retention and deletion
- Tokens are kept only while we need the connection. When we disconnect an app or access is revoked, we delete the tokens.
- Statistics are kept as long as they are useful for running our channels. For YouTube data, we confirm at least every 30 days that our access is still authorised. We refresh or delete any other stored YouTube data within 30 days.
- After revocation we delete the related tokens and stored platform data within 7 days.
- Videos and their files are our own content and are kept as long as we publish them. Copies placed on our media host for Instagram uploads can be deleted at any time.
- Deletion requests: email layshlab@outlook.com and we will delete any data we hold about you as soon as possible, and within 7 days.
3. Email and social media
If you email us, we receive your email address and message and use them only to reply. Email is handled by our email provider (Microsoft Outlook). We keep messages only as long as needed to deal with them. If you comment on or message our social accounts, the platform’s own privacy policy applies.
4. Children
Our videos are general-audience educational content and are not made specifically for children. This website does not collect personal information from anyone, including children.
5. Your rights
Depending on where you live, you may have rights to access, correct or delete personal data about you. Because we hold almost none, the easiest step is to email us and we will tell you exactly what, if anything, we have.
6. Changes
If we change this policy, we will post the new version here with a new effective date.
7. Contact
Privacy questions or complaints: layshlab@outlook.com. Laysh Lab is based in the Kingdom of Bahrain.