🔒Is FolderTube Safe? A Look at Permissions, Data, and Privacy

The Google permission prompt: read-only, and only that

When you sign in to FolderTube with Google, the consent screen references a single YouTube API scope: youtube.readonly. This is defined directly in the extension's source (constants.ts) and it is the only scope requested.

'Readonly' is a real restriction enforced by Google, not a description FolderTube gets to choose on its own. With this scope, FolderTube can read the list of channels your Google account is subscribed to. It cannot use that same permission to write anything back to your account.

• It cannot upload, edit, or delete videos on your behalf.
• It cannot post or delete comments.
• It cannot subscribe to or unsubscribe from channels on YouTube itself.
• It cannot change your channel settings, playlists, or account details.

Everything FolderTube does with your subscriptions — sorting them into folders, marking them as watched, searching within them — happens inside FolderTube's own interface. None of it writes back to your actual YouTube account or channel.

Host permissions: two domains, nothing else

Chrome extensions declare which websites they are allowed to run on via host_permissions in the manifest. FolderTube's manifest lists exactly two:

• https://www.youtube.com/* — required to inject the sidebar and folder UI into YouTube.
• https://datibase.dev/* — FolderTube's own backend, used for authentication and syncing your folder data.

There are no other domains in that list. FolderTube cannot read or modify content on any site outside those two — not your email, not your bank, not other tabs you have open.

Browser permissions

Beyond host access, the manifest requests three general Chrome permissions: identity (needed to run the Google sign-in flow), storage (needed to cache local settings like your last-used sidebar state), and alarms (needed to schedule periodic background syncs). None of these grant access to other extensions, your browsing history, or files on your computer.

Where your data lives

FolderTube uses Supabase as its backend database, and authentication runs through Supabase's own auth system tied to your Google sign-in. Once you sign in and sync, the following is stored on the backend, associated with your account:

• Your subscribed channel names, IDs, and icons (pulled via the read-only scope above).
• The folder structure you build — folder names, nesting, and which channels are assigned to which folder.
• Basic usage data used to keep the extension working and to improve it.

This is what makes multi-device sync possible — sign in on a second browser and your folders show up without re-creating them. It also means your folder structure exists independently of any single browser profile.

Chrome Web Store review

Extensions distributed through the Chrome Web Store, including FolderTube, go through Google's standard listing review process — a mix of automated scanning and manual checks before publication and on updates. This does not replace reading the permissions yourself, but it is an additional layer beyond the extension's own claims.

Deleting your data

According to FolderTube's privacy policy, you can request deletion of your account data at any time by emailing support with a data deletion request. Requests are processed within 14 days, with backups purged within 30 days of that. Uninstalling the extension alone does not delete your backend data — the email request is the actual deletion path.

The honest summary

FolderTube requests a narrow, specific set of permissions: read-only access to your subscription list, and the ability to run on YouTube plus its own backend domain. It cannot post, comment, subscribe, unsubscribe, or touch any other site you visit. Your folder data is stored on FolderTube's Supabase backend, tied to your account, so it can sync across devices. None of this makes any software immune to bugs or breaches — no vendor can honestly promise that — but the scope of access it asks for is limited and verifiable from the manifest itself, not just from what the company says.