Privacy Policy

CIHE Growth Dashboard · Effective 15 October 2026 · Last updated 15 October 2026

This policy explains how the CIHE Growth Dashboard (“the dashboard”) accesses, uses, stores, shares, protects and deletes data obtained from YouTube, Google and Meta (Instagram and Facebook), and how to revoke its access. It also covers this website, dashboard.cihe.ca.

• Who we are
• What the dashboard is
• Data from YouTube and Google
• Data from Meta
• How the data is used
• Google API Services User Data Policy
• Sharing
• Storage and security
• Retention and deletion
• Revoking access
• Cookies and this website
• Your choices and contact
• Changes to this policy

Who we are

The dashboard belongs to the Canadian Institute for Historical Education (CIHE), which is responsible for the data described here. It is built and operated on CIHE's behalf by Collective Motion. Questions, complaints and requests: raaid@collectivemotion.ca.

What the dashboard is

An internal analytics and reporting tool. It reads performance data from social media accounts that CIHE owns, after CIHE's account owner authorizes it, and shows that data to authorized CIHE and Collective Motion staff and in CIHE's monthly reports. Members of the public do not use or sign in to the dashboard. Its access is read-only: it never posts, uploads, edits, deletes, comments, messages or changes anything on YouTube, Instagram or Facebook.

Data from YouTube and Google

The dashboard uses YouTube API Services. When CIHE's account owner connects CIHE's YouTube channel through Google's sign-in, they grant exactly two read-only permissions:

The dashboard does not request or receive the Google account's email address, contacts or any other Google service data. It does not read the text of comments, and it receives no information about individual viewers or subscribers — every figure is a total or an average for the channel or a video. Private and unlisted videos are skipped.

Data from Meta (Instagram and Facebook)

With an access token issued to CIHE's own Meta account, the dashboard reads, read-only: the profile name, username and follower count of CIHE's Instagram account and Facebook Page; CIHE's own posts (caption or text, publish time, format, link and thumbnail image link); aggregate insights for the account and its posts (such as reach, views, interactions, profile visits and follows); and, for CIHE's own Meta ad account, the names and status of campaigns, ad sets and ads with their aggregate delivery figures (such as spend, impressions, clicks and results). It does not read messages or comment text and receives no information about individual followers or people who saw an ad.

How the data is used

Data from YouTube, Google and Meta is used only to:

• show CIHE's own performance figures, trends and comparisons to authorized CIHE and Collective Motion staff in the dashboard; and
• prepare CIHE's monthly measurement reports (presentation, PDF and text files) for CIHE.

It is not used for advertising, profiling, selling or any purpose unrelated to reporting on CIHE's own accounts. The dashboard does not send data to any artificial-intelligence service, and data obtained through Google APIs is not used to develop, improve or train generalized artificial-intelligence or machine-learning models.

Google API Services User Data Policy

The CIHE Growth Dashboard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing

Data is not sold, rented or shared with advertisers or data brokers. It is shown only to authorized CIHE and Collective Motion staff, and monthly reports are shared within CIHE. Data obtained through Google APIs is not transferred to anyone else, except where required by law or to protect against fraud, abuse or security issues, or with CIHE's explicit consent.

Storage and security

• Data is stored in a local database on computers controlled by CIHE's operator, Collective Motion — not in a public or shared cloud service. Generated reports are stored with it.
• Connections to YouTube, Google and Meta use HTTPS, and the dashboard only reads from them.
• The long-lived YouTube authorization (Google refresh token) is stored only on the operator's computer, in a file restricted to the operator's account. It is never shown in the dashboard, sent to a web browser, written to logs or reports, or stored in source code. Short-lived access tokens are held in memory only.
• The Meta access token is kept in a local configuration file on the operator's computer, under the same rules.
• Access to the dashboard is limited to authorized CIHE and Collective Motion staff.

Retention and deletion

• YouTube Analytics figures are kept as CIHE's reporting history for as long as CIHE needs them for its reporting. The dashboard re-confirms its authorization at every sync, which normally runs daily and in any case far more often than every 30 days.
• Other YouTube data — video titles, descriptions, thumbnail links, durations and the public subscriber count — is refreshed from YouTube at every sync. Anything that has not been refreshed for 30 days (for example, a video made private or deleted, or an older subscriber-count reading) is automatically deleted.
• Revocation. If CIHE revokes the dashboard's access to YouTube, all stored YouTube data and the stored authorization are deleted within 30 days of the revocation — or within 7 days if CIHE also asks us to.
• Deletion requests. On request to raaid@collectivemotion.ca, stored YouTube data is deleted within 7 days, and stored Meta data as soon as practicable. Deleting the dashboard's copy does not affect any data stored by YouTube, Google or Meta.
• Meta data is kept as CIHE's reporting history until CIHE asks for it to be deleted or the dashboard is retired.

Revoking access

• Google / YouTube: revoke the dashboard's access at any time from your Google Account's security settings: myaccount.google.com/permissions.
• Facebook: remove the app in Facebook Settings › Business integrations. Instagram: remove it in Settings › Apps and websites.

After access is revoked the dashboard can no longer read new data; stored data is then deleted as described above.

Cookies and this website

This website (dashboard.cihe.ca) has no sign-in, sets no cookies of its own, and uses no analytics, advertising or tracking. It is served by Cloudflare, which processes standard request information such as IP addresses to deliver and protect the site and may set a strictly necessary security cookie to filter automated traffic; see Cloudflare's privacy policy.

The dashboard places no advertising or tracking cookies. While CIHE's account owner connects YouTube, it sets two strictly necessary, short-lived (10-minute) security cookies that protect the Google sign-in against forgery; they are deleted when the connection completes. It also remembers, in the staff member's own browser, whether the navigation menu is pinned open.

Your choices and contact

For questions, complaints, or requests to access, correct or delete data, contact raaid@collectivemotion.ca. We aim to reply within 7 days.

YouTube's own terms and Google's privacy practices also apply to the YouTube data described here: see the YouTube Terms of Service and the Google Privacy Policy.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new “Last updated” date. Material changes affecting the use of YouTube or Google data will be made before any such new use begins.