OB1 Operation Overbuilt If It Can Fail It Can Become Legendary
Legal // Data

Privacy Policy

What we collect, why we use it, and how member and Google / YouTube data is handled.

Last updated: 10 September 2026

This Privacy Policy explains how Operation Overbuilt uses personal information when you visit operationoverbuilt.co.uk, create or use a member account, verify a YouTube membership, appear on the Wall of Enablers, submit information to the site, download protected member files, or otherwise interact with the project website.

Operation Overbuilt is the application and service presented through this website. Privacy enquiries and data requests can be sent to media@operationoverbuilt.co.uk.

Google User Data — plain-language summary

What Google user data we access: if you choose Google + YouTube member verification, Operation Overbuilt may access basic Google identity information, your email address and basic profile information supplied by Google, together with read-only YouTube channel information such as the channel ID and channel title using https://www.googleapis.com/auth/youtube.readonly.

How we use Google user data: we use this information only to authenticate you, identify the YouTube channel you control, compare that channel with current Operation Overbuilt YouTube membership records, link or create the appropriate Operation Overbuilt website account, and grant, maintain or remove access to member-only website features and protected downloads.

What Google user data we store: we may retain only the minimum identifiers needed to remember the verified relationship between your website account and YouTube identity, including a stable Google account identifier where supplied, verified Google email/name where required for account matching, YouTube channel ID/title, membership status or level, and verification date/time. The custom verification flow does not intentionally retain Google OAuth access tokens or refresh tokens after the verification request has completed.

How we share, transfer or disclose Google user data: Operation Overbuilt does not sell Google user data and does not provide or transfer Google user data to advertisers, data brokers, information resellers or unrelated third parties for their own purposes. Information may only be processed by service providers technically necessary to operate the website and verification service, such as hosting, security and email providers, by Google/YouTube during authentication and API requests, or disclosed where required by law or necessary to protect the service from abuse or unauthorised access.

How we protect Google user data: Google user data is transmitted between the visitor, Operation Overbuilt and Google using HTTPS/TLS. Access to stored account and membership identifiers is restricted using WordPress authentication, role-based administrative permissions and security checks. Protected member files are delivered through authenticated access controls rather than ordinary public media links. The custom verification flow is designed not to persist Google OAuth access or refresh tokens after verification.

Retention and deletion: Google/YouTube verification identifiers are retained only for as long as reasonably necessary to operate the associated account, verify current member access, protect the service, resolve disputes or meet legal obligations. When information is no longer required, it will be deleted or anonymised where reasonably practicable. You may request deletion of your Operation Overbuilt account data or removal of the Google/YouTube link by emailing media@operationoverbuilt.co.uk with the subject Data deletion or Google unlink request.

Prohibited uses: Google-derived user data is not used for targeted or personalised advertising, retargeting, sale to data brokers or information resellers, credit-worthiness or lending decisions, unrelated data products, or training, developing or improving generalised or non-personalised artificial-intelligence or machine-learning models.

1. Information we may collect

Depending on the features you use, we may process:

  • Account information: your WordPress/site account name, display name, email address, account role and login-related records required to operate your account.
  • Member information: your YouTube display name, YouTube channel/profile reference, membership level, membership status, membership dates, roof-inscription request, panel status and member-access status.
  • Profile information: optional display name, profile image and other information you choose to submit through the member profile.
  • Supporter information: supporter display name, recognition tier, note, contribution date and any private administration information required to manage supporter recognition.
  • Technical information: normal web-server records such as IP address, browser/device information, requested pages, security events, cookies and local browser storage required to operate and secure the website.
  • Protected-download information: account access checks and records necessary to provide member-only downloads and protect restricted files.

2. Google and YouTube data we access

Operation Overbuilt offers an optional Google + YouTube member verification feature. This allows a current YouTube channel member to prove which YouTube channel they control and, where that channel matches the current Operation Overbuilt membership records, receive access to member-only website features.

When you choose this feature, the website requests the minimum Google/YouTube access currently needed for that purpose:

  • OpenID / basic Google identity information so the authentication session can be associated with the correct Google account.
  • Email address and basic profile information where supplied by Google, so an existing site account can be linked or the correct account can be identified.
  • Read-only YouTube access using the scope https://www.googleapis.com/auth/youtube.readonly. This is used only to identify the YouTube channel controlled by the authenticated Google account and retrieve the channel identifier/title needed for membership verification.

The YouTube permission is read-only. Operation Overbuilt does not use this permission to upload videos, edit videos, delete videos, post comments, manage subscriptions, change channel settings, publish Community posts, or otherwise modify your YouTube account.

3. How Google and YouTube data is used

Google and YouTube data obtained through the verification flow is used only to:

  • authenticate the person requesting access;
  • identify the YouTube channel controlled by that person;
  • compare that channel identifier with the latest Operation Overbuilt YouTube membership records;
  • link the verified identity to an existing Operation Overbuilt website account or create the appropriate site account where the feature supports this;
  • grant, maintain or remove member-only website access according to the current membership record; and
  • protect member-only pages, files, downloads and features from unauthorised access.

Google user data is not used for advertising, profiling, unrelated analytics, credit decisions, sale of data, or any purpose unrelated to the member-verification functionality described above.

4. What Google data we store

The custom verification flow may retain the minimum identifiers needed to remember the verified relationship between the website account and the YouTube identity, including the stable Google account identifier where supplied, the verified Google email/name where required for account matching, the YouTube channel ID/title, the membership status/level imported from the creator’s current membership records, and the date/time of verification.

Operation Overbuilt does not intentionally persist Google OAuth access tokens or refresh tokens in the website database after the verification request has completed. The temporary access token supplied during the OAuth flow is used to make the required read-only YouTube request and is then discarded by the custom verification process.

5. How Google and YouTube data is shared

Operation Overbuilt does not sell Google user data and does not provide Google user data to advertisers or data brokers.

Information may be processed by service providers that are technically necessary to operate the website, such as the web host, security services, email delivery providers and Google/YouTube themselves during authentication and API requests. Those providers process information according to their own applicable terms and privacy obligations.

We may also disclose information where required by law, to protect the security or integrity of the service, or to investigate abuse or unauthorised access.

6. Google API Services User Data Policy / Limited Use

Operation Overbuilt’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google-derived user data is used only for the member-verification and account-access purposes described in this Privacy Policy.

7. YouTube membership records

Operation Overbuilt may import a current membership snapshot supplied through YouTube Studio. The membership data used by the Hub can include the member display name, channel/profile reference, membership level and membership timing/status information contained in that export.

This snapshot is used as an entitlement source for member access and supporter recognition. If a previously imported YouTube membership is no longer present in a later current-member snapshot, associated member-only access may be removed or marked inactive.

8. Profile images and member-submitted content

Members may optionally submit a profile image and certain profile information. Submitted profile images may be held for moderation before public display. Operation Overbuilt may reject or remove material that is unlawful, abusive, unsafe, misleading, explicit, infringes third-party rights, or is otherwise unsuitable for the public member area.

9. Cookies and browser storage

The website may use WordPress authentication cookies, security/session cookies and limited browser storage required for features such as colour preferences, interface-sound preferences and Bunker Breach state. Google uses its own cookies and account/session technology on Google-controlled pages during Google + YouTube authentication.

More information is available in the Cookie Policy.

10. Legal bases and purposes

Where UK data-protection law applies, information is processed as necessary to provide requested account/member services, operate and secure the website, administer the project and supporter/member benefits, comply with legal obligations, and pursue legitimate interests in protecting the service and the project. Where consent is the appropriate basis, it may be withdrawn where applicable.

11. Data retention

We retain account and member information only for as long as reasonably necessary for the purposes described above, including operating the member service, maintaining security and administration records, resolving disputes and meeting legal obligations.

Google/YouTube verification identifiers may be retained while the associated Operation Overbuilt account remains active or while they are required to verify member access. Data that is no longer required will be deleted or anonymised where reasonably practicable, subject to legitimate security, legal, accounting or record-keeping requirements.

12. Revoking Google access

You can revoke Operation Overbuilt’s access to your Google account through your Google Account’s connected-app / third-party access controls. Revoking access prevents future Google/YouTube verification requests unless you authorise the application again.

Revoking Google’s permission does not by itself necessarily delete an Operation Overbuilt website account or historical membership administration records already required by the site. You can separately request deletion or unlinking as described below.

13. Your choices, deletion and unlinking

You may request access to, correction of or deletion of personal information held by Operation Overbuilt where applicable. You may also request removal of the Google/YouTube link associated with your Operation Overbuilt account.

To make a request, email media@operationoverbuilt.co.uk with the subject Data deletion or Google unlink request. We may need to verify that the request relates to the correct account before acting on it.

YouTube memberships themselves are purchased, billed and cancelled through YouTube. Removing your Operation Overbuilt site account or Google link does not automatically cancel a YouTube membership.

14. Security

Reasonable technical and organisational measures are used to protect account information, Google/YouTube verification identifiers and member-only files. These measures include HTTPS/TLS for data in transit, authenticated WordPress accounts, role-based administrative permissions, short-lived OAuth state validation, security/nonces for protected actions, and authenticated delivery of protected member downloads rather than ordinary public media links.

No internet service can guarantee absolute security, so users should also protect their own Google and website login credentials.

15. Children

The Operation Overbuilt member features are not designed to knowingly collect Google/YouTube account data from children through the verification flow. If information is believed to have been provided inappropriately, contact us so it can be reviewed.

16. Changes to this policy

This Privacy Policy may be updated when the website, member-verification flow, Google/YouTube scopes, service providers or legal obligations change. The date at the top of this page will be updated when material changes are published.

17. Contact

Privacy, Google/YouTube data, account deletion and data-handling questions can be sent to media@operationoverbuilt.co.uk.