Production readiness: make YouTube subscription organization available to many users

[djbclark]

Goal

Make SuperBrain's YouTube subscription and category-management features safely available to many users. The user value remains making subscriptions easier to manage, helping users switch between categories of videos they want to watch, and returning users to YouTube for playback. This is not a creator-growth product or replacement video player.

The YouTube quota/compliance form submitted on 2026-07-31 describes a free, open-source, self-hosted application with OAuth credentials, tokens, playlist mappings, and related data stored locally. A hosted multi-user service would materially change that use case, architecture, data handling, audience, and quota model. Treat the existing development approval request as insufficient for broad production availability.

Distribution decision

Choose and document one of these models before implementation:

• Hosted multi-user service: SuperBrain operates the production OAuth client, stores tokens and user data centrally, and provides the simplest consumer experience. Complete all work below.
• Self-hosted distribution: each operator supplies and controls their own Google Cloud project and OAuth client. Do not distribute a shared client secret. Document setup, verification responsibilities, and limitations clearly.

The checklist below assumes the hosted multi-user model.

Google Cloud and YouTube approvals

• Create a dedicated production Google Cloud project, separate from development/testing.
• Keep production traffic under one legitimate quota pool; do not shard projects to evade quota limits.
• Confirm that quota requested for the development project does not automatically transfer to the production project.
• Resubmit the YouTube API Services compliance audit for the production project and materially changed multi-user use case.
• In the audit, describe the end-user benefit, multi-tenant architecture, expected users/DAU, shared quota calculations, centralized token storage, retention/deletion, subprocessors and AI providers, and all YouTube API endpoints and scopes.
• Obtain written approval before applying the previously described quota/use case to the multi-user service.

Policy references:

• https://developers.google.com/youtube/terms/developer-policies
• https://developers.google.com/youtube/terms/developer-policies-guide

OAuth production verification

• Configure the production consent screen as an External app and publish it to In production.
• Use a verified domain owned by the operator.
• Publish an accurate product homepage, privacy policy, terms of service, and support contact on that domain.
• Link the privacy policy from both the homepage and OAuth consent screen.
• Request the minimum scopes required. Reassess whether the current full https://www.googleapis.com/auth/youtube scope can be narrowed.
• Write a justification for every requested scope.
• Record an unlisted end-to-end demo showing the consent screen, exact scopes, OAuth grant, and every feature that uses the scopes.
• Submit and complete OAuth verification for all sensitive access before public launch.

Testing mode is only suitable for a small named-user beta: it supports at most 100 test users and authorizations generally expire after seven days. Do not treat the unverified-app warning or user cap as a production launch strategy.

References:

• https://support.google.com/cloud/answer/13461325?hl=en
• https://support.google.com/cloud/answer/13464321?hl=en
• https://support.google.com/cloud/answer/15549945?hl=en
• https://developers.google.com/identity/protocols/oauth2/production-readiness/policy-compliance
• https://developers.google.com/identity/protocols/oauth2/production-readiness/sensitive-scope-verification

Multi-user security and account isolation

• Establish hard tenant boundaries so one user can never read or modify another user's subscriptions, playlists, mappings, jobs, or derived data.
• Store refresh tokens and secrets encrypted server-side, with narrowly scoped access and key-rotation procedures.
• Require HTTPS and exact allowlisted redirect URIs.
• Implement OAuth state/CSRF protection and other controls appropriate to the selected client architecture.
• Provide user-visible disconnect/revoke access, account deletion, and data deletion controls.
• Delete tokens and associated data when authorization is revoked, deletion is requested, or authorization can no longer be verified.
• Add access/audit logging without recording tokens or sensitive payloads.
• Document incident detection, containment, notification, and credential-rotation procedures.
• Threat-model background jobs, queues, webhooks/callbacks, administrators, backups, and support access.

Implementation reference:

• https://developers.google.com/youtube/v3/guides/auth/server-side-web-apps

Privacy, retention, and subprocessors

• Replace the current local-only statements such as "no SuperBrain cloud SaaS" and local-only credential storage before hosted launch.
• Disclose what YouTube and account data is accessed, why it is used, where it is stored, retention periods, deletion behavior, and whether it is shared.
• List infrastructure, analytics, error-reporting, and AI/LLM subprocessors that may receive user or YouTube-derived data.
• If titles, descriptions, transcripts, or other data are sent to third-party AI services, obtain clear user-facing consent and verify that every transfer complies with Google/YouTube limited-use requirements.
• Implement applicable YouTube API data refresh/deletion requirements, including the 30-day rules.
• Ensure backups and logs honor deletion requests within the required period.
• Make deletion easy to find and verify its end-to-end operation.

Quota and operational controls

The production project's daily quota is shared by every user. The previously requested 500,000 units/day is not a per-user allocation.

• Model quota consumption by endpoint and scenario: initial import, normal refresh, subscription polling, category-playlist creation, item insertion/deletion, retries, and reconnects.
• Convert projected users/DAU and activity into daily and per-minute quota requirements.
• Add per-user and system-wide limits.
• Queue and rate-limit background operations.
• Add idempotency so retries do not duplicate playlist changes.
• Cache safely while complying with freshness and deletion requirements.
• Implement bounded retries, exponential backoff, and graceful degraded behavior when quota is exhausted.
• Add quota dashboards and alerts by endpoint and workload.
• Request production quota based on measured beta behavior and defensible growth projections.

Product and UX constraints

• Keep positioning focused on organizing a user's subscriptions and selected videos into useful categories.
• Keep playback on YouTube and preserve clear YouTube attribution and current metadata.
• Do not present SuperBrain as a replacement YouTube player, remove standard YouTube functionality, or imply creator-growth services.
• Explain OAuth access in plain language immediately before authorization.
• Show sync state, failures, quota-related delays, and how to disconnect/delete data.

Rollout plan

• Phase 1: retain the existing project for development and, if useful, run a small named-user beta within Testing-mode constraints.
• Phase 2: implement the production project, hosted architecture, multi-tenant safeguards, public site, and legal/privacy documentation.
• Phase 3: submit OAuth verification and the revised YouTube compliance/quota request as separate reviews.
• Phase 4: conduct a limited production rollout, observe quota/security/deletion behavior, and expand only after approvals and acceptance checks pass.

Acceptance criteria

• Distribution model and data-flow diagram are documented.
• Production and development Cloud projects are separate and correctly configured.
• OAuth verification and YouTube production audit/quota approval are complete.
• Privacy policy and consent language match actual production behavior.
• Independent security review finds no cross-user access or token exposure.
• Revocation and deletion tests prove timely removal from primary storage, queues, logs, and backups as applicable.
• Load/quota tests demonstrate safe behavior at the intended launch size.
• A limited beta validates the product promise: users can manage subscriptions, switch among video categories, and return to YouTube to watch.