Who We Are
TubeUpgrade (accessible at https://tubeupgrade.com) is a free web-based utility that allows users to view and download publicly available thumbnail images from YouTube videos. This Privacy Policy explains how we handle information when you use our service.
By using TubeUpgrade, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the service.
Chrome Extension
TubeUpgrade offers a free Chrome browser extension — YouTube Thumbnail Downloader — that adds a "Download Thumbnail" button directly to YouTube video pages, Shorts, and live streams. This section explains specifically how the extension handles your data.
How the Extension Works
The extension runs entirely within your browser. When you click "Download Thumbnail" on a YouTube page, the extension:
- Reads the video ID directly from the YouTube page URL you are already visiting
- Makes a direct request from your browser to YouTube's public CDN (
img.youtube.com) to fetch the thumbnail image - Saves the downloaded image file to your local device automatically
This entire process happens locally in your browser. No data passes through our servers at any point.
What the Extension Does NOT Do
- It does not send any data to TubeUpgrade or any third-party server we control
- It does not collect or store your browsing history, watch history, or YouTube activity
- It does not use cookies, localStorage, or any form of persistent storage
- It does not track which videos you download thumbnails for
- It does not require you to log in or create an account
- It does not contain any analytics or crash-reporting libraries
- It does not inject any advertisements or modify YouTube's interface beyond adding the single download button
Permissions Explained
The extension requests the minimum permissions necessary to function:
| Permission | Why it is needed |
|---|---|
https://www.youtube.com/* |
Allows the extension to inject the download button into YouTube video pages |
https://img.youtube.com/* |
Allows the extension to fetch thumbnail images directly from YouTube's public CDN on your behalf |
No other permissions are requested. The extension does not request access to your tabs, bookmarks, browsing history, clipboard, or any other browser data.
Third-Party Data: YouTube / Google
When the extension fetches a thumbnail, your browser makes a direct HTTP request to img.youtube.com. This is identical to your browser loading any public image on the web. Google's servers may receive your IP address as part of this standard network request. This is outside our control. Google's privacy policy applies: policies.google.com/privacy.
Information We Collect
We collect the minimum information necessary to operate the service. Here is a complete breakdown:
| Data type | What it is | Why we collect it | How long kept |
|---|---|---|---|
| YouTube video ID | The 11-character ID extracted from the URL you submit (e.g. dQw4w9WgXcQ) |
To fetch the video title and thumbnail images from YouTube | Up to 1 hour in server cache, then deleted |
| Video title & channel name | Publicly available metadata fetched from YouTube's oEmbed API | Displayed to you on screen to confirm you have the right video | Up to 1 hour in server cache, then deleted |
| IP address | Your internet address, logged automatically by the web server | Standard server operation, security monitoring, abuse prevention | Up to 30 days in server logs, then automatically deleted |
| Browser & device type | User-agent string sent by your browser (e.g. Chrome on Android) | Analytics — understanding which browsers and devices our users have | Aggregated by Google Analytics; raw data 14 months |
| Pages visited & actions | Which pages you visit, how long you spend, buttons clicked | Analytics — improving the service and understanding usage patterns | Aggregated by Google Analytics; raw data 14 months |
| Referrer URL | The website you came from before visiting TubeUpgrade | Analytics — understanding where our traffic comes from | Aggregated by Google Analytics |
| Contact form — name & email | Your name and email address submitted via the contact form | To respond to your enquiry and identify you as the sender | Until your enquiry is resolved, then deleted from our inbox |
| Contact form — reason & message | The reason you selected and the message you wrote | To understand and respond to your enquiry | Until your enquiry is resolved, then deleted from our inbox |
| Contact form — masked IP address | Your IP address with the last octet removed (e.g. 192.168.1.xxx) | Abuse prevention — rate limiting and spam detection only | Included in the contact email; deleted when that email is deleted |
192.168.1.xxx) before being included in the email, in line with GDPR data minimisation. We do not store contact form submissions in any database.
How We Use Your Information
We use the information collected for the following purposes only:
- Providing the service — processing your submitted YouTube URL, fetching thumbnail images, and displaying them to you
- Performance caching — temporarily caching video title and author data to reduce load on YouTube's servers and improve response speed for popular videos
- Security and abuse prevention — monitoring server logs to detect and block automated attacks, excessive requests, or other abuse of the service
- Analytics and improvement — understanding how users interact with the service so we can fix bugs, improve the interface, and prioritise new features
- Legal compliance — retaining minimal records as required by applicable law
We do not use your information for advertising profiling, automated decision-making, or any purpose not listed above.
What We Do NOT Collect
We want to be completely clear about what we do not collect:
- We do not collect your name, email address, phone number, or any other contact information
- We do not require you to create an account or log in
- We do not store, cache, or save any thumbnail image files on our servers
- We do not collect payment information of any kind (the service is free)
- We do not collect your YouTube account credentials or watch history
- We do not track you across other websites
- We do not build individual user profiles
- We do not use fingerprinting, canvas tracking, or other invasive tracking techniques
Cookies & Tracking
What are cookies?
Cookies are small text files stored on your device by your browser when you visit a website. They allow websites to remember information between page loads.
Cookies we use
TubeUpgrade itself does not set any first-party cookies. However, third-party services we use may set cookies:
| Cookie / service | Purpose | Type | Duration |
|---|---|---|---|
Google Analytics (_ga, _gid) |
Measures website traffic and usage patterns | Analytics | Up to 2 years |
| Google Fonts | Delivers web fonts — may log your IP for performance | Functional | Session |
How to control cookies
You can control, disable, or delete cookies through your browser settings. Disabling analytics cookies will not affect your ability to use TubeUpgrade. For more information, visit allaboutcookies.org.
You can also opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.
Third-Party Services
We use the following third-party services. Each has its own privacy policy:
YouTube / Google LLC
When you submit a YouTube URL, our server makes a request to YouTube's public oEmbed API (youtube.com/oembed) to retrieve the video title and channel name, and displays thumbnail images from YouTube's public CDN (img.youtube.com). This means YouTube's servers receive a request indicating that someone is looking up that video's thumbnail. Google's privacy policy applies: policies.google.com/privacy.
Google Analytics
We use Google Analytics 4 to understand how visitors use our service. Google Analytics collects data such as pages visited, time on site, device type, and approximate geographic location (country/region level). This data is anonymised and aggregated. We have enabled IP anonymisation. Google's data processing terms apply: policies.google.com/privacy.
Google Fonts
We load web fonts from Google Fonts, which may cause your browser to send a request to Google's servers. Google may log your IP address as part of this request. Privacy policy: policies.google.com/privacy.
Cloudflare (if enabled)
We may use Cloudflare as a CDN and security layer. Cloudflare may process your IP address and request metadata. Privacy policy: cloudflare.com/privacypolicy.
Data Sharing & Selling
We may share limited information only in the following circumstances:
- Service providers — third-party services listed above (Google Analytics, Cloudflare) that help us operate the service, under strict data processing agreements
- Legal requirements — if required to do so by law, court order, or government authority, or to protect the rights, property, or safety of TubeUpgrade, our users, or the public
- Business transfers — in the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. You will be notified via a notice on this page.
Data Retention
We retain data for the shortest time necessary:
- Cached video metadata (title, channel name) — deleted automatically after 1 hour
- Server access logs (IP address, request details) — deleted after 30 days
- Contact form submissions (name, email, reason, message, masked IP) — stored only in our email inbox; deleted once the enquiry is resolved. No database copy is kept.
- Contact form rate-limiting data (hashed IP in session) — cleared when your browser session ends or after 1 hour, whichever comes first
- Google Analytics data — retained for 14 months per Google's default settings, then automatically deleted
When data is no longer needed, it is securely deleted and not recoverable.
Security
We implement appropriate technical and organisational measures to protect the limited data we hold:
- HTTPS encryption — all traffic between your browser and our server is encrypted using TLS
- Security headers — including Content Security Policy, X-Frame-Options, X-Content-Type-Options, and Referrer Policy
- Input validation — all user-submitted data is strictly validated and sanitised before processing
- No persistent storage — we do not store personal data in databases, reducing the attack surface significantly
- POST-only API — our data endpoint only accepts POST requests, reducing bot and scraper access
While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to following industry best practices and notifying users of any breach that affects their data.
Your Rights
You have the following rights regarding your personal data, regardless of where you are located:
Right to Access
Request a copy of the personal data we hold about you
Right to Correction
Ask us to correct any inaccurate data
Right to Deletion
Request deletion of your personal data
Right to Portability
Receive your data in a portable, machine-readable format
Right to Objection
Object to how we process your data
Right to Restriction
Ask us to restrict processing in certain circumstances
Because TubeUpgrade does not require account creation and stores minimal personal data, most requests can be fulfilled immediately. To exercise any of these rights, please contact us.
GDPR — EU & UK Users
If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply to your data. Our legal bases for processing are:
- Legitimate interests — processing your YouTube URL submission to provide the service you requested, and server logging for security purposes
- Consent — analytics cookies, where consent is obtained
- Legal obligation — where required by applicable law
You have the right to lodge a complaint with your local supervisory authority. For EU users, find your authority at edpb.europa.eu. For UK users, contact the Information Commissioner's Office (ICO).
International data transfers: data may be processed by Google Analytics and Google Fonts servers located outside the EEA, under Google's Standard Contractual Clauses.
CCPA — California Users
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:
- Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you
- Right to delete — you may request deletion of personal information we have collected from you
- Right to opt-out of sale — we do not sell personal information, so this right is not applicable
- Right to non-discrimination — we will not discriminate against you for exercising any CCPA rights
To exercise these rights, please contact us. We will respond within 45 days as required by law.
Children's Privacy
TubeUpgrade is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Since we do not require account registration or collect any identifying personal information to use the service, the risk is minimal. However, if you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.
If you are between 13 and 18 years old, please ensure you have the permission of a parent or guardian before using this service.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the service, technology, legal requirements, or best practices. When we make material changes, we will update the "Last updated" date at the top of this page.
We encourage you to review this policy periodically. Your continued use of TubeUpgrade after any changes constitutes your acceptance of the updated policy.
For significant changes that materially affect your rights, we will display a notice on the main page.
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please get in touch:
Privacy enquiries
For data access requests, deletion requests, GDPR/CCPA enquiries, or any other privacy concern, please use our contact page. We respond to all privacy requests within 5 business days (45 days for CCPA requests).
Contact TubeUpgrade →