1. API client identity
Creator Finder is a local application used by its independent developer. It is not a public SaaS product, does not provide public login or registration, and does not expose YouTube API Data or API credentials to third parties.
2. Purpose
Creator Finder is used to discover and evaluate publicly available gaming creators for potential outreach relating to XOTOX STUDIO's own videogame campaigns.
The application helps the developer organize public channel and video information, manually review candidates, manage public professional contact routes, prepare communications, and track campaign status. Advanced suitability metrics based on YouTube API Data remain disabled unless and until the applicable YouTube derived-metrics approval is granted.
3. Why YouTube Data API v3 is used
The API provides the public channel and video information needed to perform thematic discovery and candidate review in a consistent way. Source-code review of the current build confirmed this resource and method inventory:
search.listwithpart=snippet, a campaign query,type=videoortype=channel,order=relevance, result limits and pagination; a relevance language may be supplied;channels.listwithpart=snippet,statistics,contentDetailsfor channel IDs, batched where possible;playlistItems.listwithpart=contentDetailsfor a channel's uploads playlist;videos.listwithpart=snippet,statisticsfor video IDs, batched where possible.
YouTube access uses a developer API key. The reviewed build does not request a YouTube OAuth scope or access a reviewer's private YouTube account data.
Creator Finder does not sell or redistribute YouTube API Data, provide third-party access to it, or attempt to bypass quota restrictions. It obtains YouTube API Data only through the documented API methods above; it does not scrape YouTube or Google pages.
Provenance identifies YouTube-derived records separately from local campaign state. Non-authorized YouTube API Data is refreshed through the appropriate documented endpoint or invalidated/deleted no later than 30 days. Expired data is not displayed or used as current, including when quota prevents refresh. Independent campaign history, notes, approvals, and do-not-contact decisions are preserved.
4. Gmail OAuth scopes and functions
Gmail is optional and uses incremental, contextual authorization. The current build requests exactly:
https://www.googleapis.com/auth/gmail.compose: list drafts to locate a campaign message by its RFC 822 Message-ID, retrieve minimal draft metadata, create a draft, and send a user-approved draft or message;https://www.googleapis.com/auth/gmail.readonly: retrieve a thread already identified by a locally stored campaign thread ID and inspect it for a reply.
gmail.compose is requested when the user connects draft/send functionality. gmail.readonly is requested separately only after the user activates reply tracking. Without read-only authorization, draft creation and explicit sending continue to work while reply tracking stays disabled. The reply feature inspects only locally identified campaign thread IDs and does not search the general inbox, mark mail read, move messages, or modify labels.
5. Campaign workflow
Gmail actions are limited to the scopes and functions listed above. Sending requires selected campaign recipients, approval, send mode, a confirmation checkbox, and the explicit confirmation text required by the application. Connecting a Google account or selecting candidates never sends mail. Reply checking is optional and limited to known campaign threads.
6. Why additional quota is requested
Creator Finder needs to discover multiple potentially relevant channels through thematic searches. Search operations are required because the developer does not begin with a fixed list of known channel IDs, and different videogame campaigns require different topics, languages, and creator niches.
The application already implements measures intended to reduce consumption:
- cache: reuse previously retrieved information instead of repeating equivalent requests;
- deduplication: avoid processing the same channel, video, candidate, or contact repeatedly;
- batching: group compatible lookups when the API and workflow allow it;
- adaptive query selection: prioritize useful queries and stop low-value exploration;
- quota budgeting: limit campaign activity according to an explicit quota budget;
- stored data reuse: reuse compliant local data while it remains valid.
Additional quota would allow the developer to complete legitimate discovery campaigns without attempting to avoid or circumvent YouTube's established limits. This page intentionally states no requested quota amount because no amount was available in the website brief.
7. Data and outreach controls
- Application data is held primarily in a local database on the developer's device.
- Caching and deduplication reduce redundant API requests.
- Campaign quota budgets constrain discovery activity.
- Emails require explicit review and approval before sending.
- Duplicate-contact and do-not-contact states help prevent repeated or inappropriate outreach.
- Only public professional contact routes associated with the creator or their representative are intended for use.
- Contacts are not extracted from YouTube API descriptions, comments, chat, or scraped YouTube/Google pages; creator-linked external public sites and manual entries are the permitted baseline sources.
- Non-authorized YouTube API Data is refreshed or invalidated/deleted no later than 30 days and cannot be used as current after expiry.
- Google Workspace user data is used only for the user-facing Gmail features described in the Privacy Policy.
- The settings privacy panel can revoke the Gmail token through Google's official endpoint, remove the local token and Gmail-derived local data, and erase a creator's local data by internal ID.
8. Derived metrics and pre-submission notes
DERIVED METRICS
Advanced Creator Finder suitability metrics based on YouTube API Data remain disabled unless/until the applicable YouTube approval for derived metrics is granted.
XOTOX STUDIO intends to request the applicable Analytics & Reporting / Additional Derived Metrics authorization for future Game Match Score, horror gaming, gaming, indie, demo/content-type, gameplay, and activity/relevance categories. This page does not claim that authorization has been granted.
The method inventory, retention controls, contact-discovery restrictions, Gmail scopes, and user-facing deletion controls above were checked against the source code reviewed on 11 August 2026. The following external or submission-specific items remain:
- request and obtain YouTube approval before enabling any advanced derived metric;
- complete any OAuth verification/security assessment Google requires for restricted Gmail scopes;
- insert the configured quota amount and final public URLs in the official form;
- replace screenshots that do not show the same compliance-gated, attributed build submitted for review.