Privacy Policy

YourStream ("we," "us," or "our") operates the YourStream video streaming platform at yourstream.app. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use our platform, including our website, applications, and related services (collectively, the "Service"). By accessing or using the Service, you agree to the practices described in this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect the following information:

• Your name, email address, and password (hashed and salted -- we never store plaintext passwords)
• Profile information you choose to provide, such as a display name, bio, profile picture, and channel banner
• Authentication data from third-party sign-in providers (such as Google) if you choose to sign in through those services

1.2 Video and Content Data

When you upload or interact with content on YourStream, we collect:

• Video files, thumbnails, titles, descriptions, tags, and category metadata you provide when uploading content
• Comments, likes, bookmarks, and subscription data reflecting your interactions with other users' content
• Watch history and viewing preferences to personalize your experience

1.3 Usage Data

We automatically collect certain technical and behavioral data when you use the Service:

• Device information, including browser type, operating system, and screen resolution
• IP address and approximate geographic location
• Pages visited, features used, buttons clicked, and time spent on the platform
• Referring URLs and search queries that led you to YourStream
• Error logs and performance data to help us diagnose and fix technical issues

1.4 Payment Information

If you subscribe to a paid plan or make a purchase, payment processing is handled entirely by our payment provider, Polar. We do not directly collect, store, or process your credit card numbers, bank account details, or other sensitive financial information. Polar may share limited transaction data with us, such as your subscription status, plan type, and transaction identifiers, so we can provision your account features accordingly.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and operating the Service: Creating and managing your account, delivering video content, processing subscriptions, and enabling creator and viewer interactions
• Personalization: Tailoring content recommendations, search results, and your feed based on your viewing history and preferences
• Communication: Sending you transactional emails (account verification, password resets, subscription confirmations), platform notifications, and -- only with your consent -- promotional updates about new features
• Analytics and improvement: Analyzing usage patterns to understand how the platform is used, identify areas for improvement, and develop new features
• Safety and moderation: Detecting, preventing, and addressing abuse, fraud, spam, and violations of our Terms of Service
• Legal compliance: Fulfilling legal obligations, responding to lawful requests from authorities, and enforcing our policies

3. Information Sharing and Third-Party Services

We do not sell your personal information. We share data only in the following limited circumstances:

3.1 Service Providers

We work with trusted third-party service providers who process data on our behalf to operate the platform:

• Cloudflare (Video Delivery): We use Cloudflare Stream to encode, store, and deliver video content. Cloudflare processes video files and related delivery metadata (such as viewer IP addresses for CDN optimization) on our behalf.
• Polar (Payment Processing): Polar handles all payment transactions, subscription management, and billing. When you make a purchase, your payment details are collected and processed directly by Polar under their own privacy policy.
• Convex (Database Infrastructure): We use Convex as our backend database platform to store and manage application data, including user profiles, video metadata, and platform interactions.
• PostHog (Analytics): We use PostHog for product analytics to understand how users interact with the platform. PostHog collects anonymized usage data, including page views, feature usage, and session recordings (without capturing sensitive input fields).
• BetterAuth (Authentication): Our authentication system is powered by BetterAuth, which manages secure sign-in, session tokens, and third-party OAuth flows (such as Google sign-in).

3.2 Legal Requirements

We may disclose your information if required to do so by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect and defend our rights or property, prevent fraud, or protect the personal safety of our users or the public.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the platform before your information becomes subject to a different privacy policy.

4. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for authentication, session management, and core platform functionality. These cannot be disabled without breaking the Service.
• Analytics cookies: PostHog uses cookies and local storage to collect anonymized usage data, including page views, session duration, and feature interactions. This data helps us understand how the platform is used and where we can improve.
• Preference cookies: We store your theme preference (light or dark mode) and other display settings locally so they persist across sessions.

We do not use advertising cookies or tracking pixels from ad networks. You can manage cookie preferences through your browser settings. Disabling essential cookies may impair your ability to use the Service.

5. Data Security

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS for all connections
• Secure password storage using modern hashing algorithms with per-user salts
• Access controls that limit employee and contractor access to personal data on a need-to-know basis
• Regular security reviews of our infrastructure and service providers
• Secure session management with token-based authentication and automatic session expiration

While we strive to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any breach and notifying affected users in accordance with applicable law.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to access: You can request a copy of the personal data we hold about you. Much of this information is already accessible through your account settings and profile page.
• Right to correction: You can update or correct your personal information at any time through your account settings.
• Right to deletion: You can request that we delete your account and associated personal data. Upon deletion, we will remove your profile, uploaded videos, comments, and other user-generated content. Certain data may be retained in anonymized form for analytics or as required by law.
• Right to portability: You can request an export of your personal data in a structured, machine-readable format, including your profile information, video metadata, and interaction history.
• Right to restrict processing: You can ask us to limit how we process your personal data in certain circumstances, such as while we verify a correction request or evaluate an objection.
• Right to object: You can object to the processing of your personal data for specific purposes, such as analytics-based personalization.

To exercise any of these rights, contact us at privacy@yourstream.app. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

7. Children's Privacy

YourStream is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child under 13 has provided personal information to us, please contact us at privacy@yourstream.app and we will take steps to delete that information promptly.

Users between the ages of 13 and 18 may use YourStream only with the consent and supervision of a parent or legal guardian. By allowing a minor to use the Service, the parent or guardian agrees to this Privacy Policy on the minor's behalf.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

• Account data: Retained until you delete your account. After account deletion, we remove your personal data within 30 days, except as noted below.
• Video content: Uploaded videos and associated metadata are deleted when you remove them or when your account is deleted. Cached copies on our CDN may persist for a short period after deletion.
• Usage and analytics data: Anonymized and aggregated usage data may be retained indefinitely for product improvement and analytics purposes. This data cannot be used to identify you.
• Legal obligations: We may retain certain data for longer periods if required by law, such as transaction records for tax and accounting compliance, or data relevant to an ongoing legal proceeding.

9. International Data Transfers

YourStream operates globally, and your data may be processed and stored in countries other than your country of residence, including the United States. Our service providers -- including Cloudflare, Convex, and Polar -- may process data in multiple jurisdictions.

When we transfer data internationally, we rely on appropriate safeguards, including contractual commitments with our service providers to protect your data in accordance with applicable privacy laws. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure that transfers comply with applicable data protection regulations, including the use of Standard Contractual Clauses where required.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post a prominent notice on the platform informing you of the changes
• Send you an email notification if the changes significantly affect how we use your personal data

Your continued use of the Service after any changes take effect constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.