WHAT THE POLICIES SAY

Invidious is a free and open-source, self-hostable web front-end for YouTube, written by a pseudonymous volunteer team ("iv-org") and licensed under the AGPLv3. The project's site and README describe it as ad-free, tracker-free, usable without JavaScript, and independent of Google accounts and official YouTube APIs, and its FAQ states the software itself collects no data about users. The design's privacy limits are architectural and the project's own docs are candid about them: whichever public instance a user picks sees their IP address and every request and logs accessed URLs by default; video streams are fetched directly from Google's servers unless the user enables the optional "Proxy videos" setting; and optional instance accounts store watch history and subscriptions in that instance's database. The public-instance list is currently short (five clearnet instances) because of YouTube's 2024 bot-detection blocking, and the maintainers ask users to self-host where possible. No breach, third-party audit, or regulatory action involving Invidious was found; the notable track-record artifacts are a June 2023 letter from YouTube's legal team asking the project to shut down (the project continued) and the ongoing YouTube blocking that degrades public-instance reliability.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

12 ON FILE

COLLECTION

The project's homepage describes Invidious as privacy-focused — it "protects you from the prying eyes of Google" and "won't track you" — and states users can subscribe to channels and create playlists without needing a YouTube account, so the core feature set requires no Google identity.

invidious.io ↗

COLLECTION

The project FAQ states that Invidious by itself collects no data about its users, but discloses that instance owners can log IP addresses like any web server, that the server logs accessed URLs, response codes, and response times by default, and that creating an optional account stores watch history and the subscribed-channel list in that instance's database, which the user can export, migrate, or delete at any time.

docs.invidious.io ↗

OWNERSHIP TRANSPARENCY

The project's Donate page accepts contributions only via Bitcoin, Monero, Ethereum, and Litecoin wallet addresses held by "the Invidious team", and separately points donors to the individual developer of YouTube.js, the library the project's "Invidious companion" now depends on to keep working with YouTube's changes; no funding totals, sponsors, or fiscal host are disclosed.

invidious.io ↗

OWNERSHIP TRANSPARENCY

The Invidious repository publishes the complete server and front-end source under the GNU Affero General Public License version 3, so the shipped behavior of any compliant instance can be inspected, audited, or forked, and operators who modify it must publish their changes.

raw.githubusercontent.com ↗

OWNERSHIP TRANSPARENCY

The project's Team page describes Invidious as a community-maintained project and names three pseudonymous "Owner" accounts (TheFrenchGhosty, Perflyst, unixfox) plus four developers, states that two owners hold full access to everything including the cryptocurrency wallets, and credits the original developer Omar Roth and contributors from the NewPipe, FreeTube, and yt-dlp teams; no legal entity, registered association, or company is named anywhere.

invidious.io ↗

SHARING

The project's official instance list currently names only five clearnet public instances (in Chile, Ukraine, the US, Germany, and Japan) plus Tor, I2P, and Yggdrasil endpoints, states the list is short because of recent YouTube issues, asks users to host Invidious at home instead of using a public instance, and warns that any instance not on the list is untrustworthy; whichever listed operator a user picks sees their IP and every request, and the rules require instances behind DDoS-protection/MITM services such as Cloudflare to be marked as such.

docs.invidious.io ↗

SHARING

Privacy Guides lists Invidious on its frontends page as a free, open-source, self-hostable YouTube frontend with public instances (some offering Tor onion or I2P access), but warns that it does not proxy video streams by default — videos still connect directly to Google's servers unless the user enables proxying — that it does not provide privacy by itself, and that users should not log into accounts.

privacyguides.org ↗

SHARING

The project FAQ states that by default the video stream is fetched directly from Google's servers (googlevideo.com), so Google can see the user's IP address and browser-sent data such as the user-agent string, and that only when the user enables the "Proxy videos" preference does the Invidious instance act as a relay hiding that information from Google — meaning that in the default configuration both the instance operator and Google see the user's IP.

docs.invidious.io ↗

[2023-06-08] · TRACK RECORD

On 8 June 2023 a project owner opened a public GitHub issue titled "YouTube legal team contacted us", stating that Invidious never agreed to YouTube's terms or policies and does not use its API, that the team would continue until it could not, that the source is mirrored on the project's own Gitea in case of a GitHub takedown, and that any remaining funds would go to Framasoft if the team were forced to quit; this is a documented legal-pressure event with a public outcome (the project continued), not a privacy incident.

github.com ↗

[2024-06-06] · TRACK RECORD

A bug issue opened on 6 June 2024 documents YouTube's "Please sign in to confirm you're not a bot" block hitting Invidious on any video regardless of instance, with a maintainer noting it affects all software using YouTube; this ongoing blocking is why the public-instance list has shrunk and is a reliability risk for users rather than a privacy failing. No breach, third-party audit, transparency report, or bug-bounty program involving Invidious was found in this research.

github.com ↗

TRACKING TECH

The project's rules for inclusion in the official public-instance list forbid instances from using any type of analytics or external scripts and from serving ads or promoting products, and require any modified source to be published under the AGPL; the same page warns that any public instance not on the list is considered untrustworthy, so these guarantees bind only listed instances.

docs.invidious.io ↗

TRACKING TECH

The project README lists "No ads", "No tracking", "No JavaScript required", and "Subscriptions independent from Google" as user features, and states as a technical feature that Invidious does not use official YouTube APIs, so no Google client library, ad, or analytics script is part of the shipped front-end.

raw.githubusercontent.com ↗

DATA SOURCES

Privacy Guides (www.privacyguides.org)

CC BY-SA · PRIVACYGUIDES.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-19 · METHODOLOGY v1.7