Privacy policy

Account information

We store your email address, name, date of birth and a one-way password hash to create and protect your account. Your date of birth and email address are not included in the public video feed. Existing accounts without a separate name may display the part of their email before the @ symbol as a public handle.

What you share publicly

Posted videos, cover images, titles, descriptions, your public name and an available profile picture can be viewed by other visitors. If there is no profile picture, your initials are displayed. You control your own videos through Your videos.

You can set or remove your profile photo from your protected Profile page. Uploaded profile photos are checked and resized, and embedded image metadata is removed before storage. If your name or date of birth is missing, you can add it once in Profile. Saved details and your sign-in email are read-only.

Email and parent-managed accounts

Email addresses are checked for formatting, known temporary services and mail delivery records. A confirmation link verifies control of the inbox. Confirmation links expire after 24 hours and work once. Email domains are checked through DNS; addresses are not sent to an external email-verification service.

For users under 13, we request a parent or guardian’s email and an explicit management choice. Both the account’s own inbox and the parent’s inbox must confirm the named address before parent management starts. The confirmed parent receives account notifications and password-reset links, which allow access to the account. Parent email addresses and birth dates are private. Analytics remains off for accounts known to belong to users under 13.

Email confirmation verifies access to an inbox. It does not independently prove a person’s age or legal relationship to another person.

Storage and delivery

MongoDB stores account and video records. ImageKit stores and delivers video files and images. Transactional email is delivered through the configured email provider, using SMTP in the current configuration. These providers process the information needed to perform those services.

Account messages and security

We send messages related to your account, password changes and posted videos. Password reset links expire after 20 minutes and work once. Reset tokens are stored as hashes; unused tokens are replaced by a later request. Temporary security counters help limit repeated requests. Queued account messages expire after seven days and their message content is removed after successful sending.

Cookies and preferences

Sign-in uses authentication cookies. Your browser also stores appearance and sidebar preferences. The player can use connection and device information exposed by your browser to choose a suitable video quality. Your cookie choice is stored in this browser for up to 180 days.

Appearance, autoplay and picture-quality preferences are saved in this browser. You can manage them in Settings. Security limits use temporary hashed account and network counters to reduce automated abuse.

Optional Google Analytics loads only after you allow analytics cookies. It helps us understand page visits and site usage. Account pages, form details, search queries and password-reset links are excluded from our page-view tracking. Google receives usage and device information when analytics is enabled. Advertising features are disabled. Choosing essential cookies keeps analytics off and leaves sign-in, uploads and playback available.

You can withdraw or change your choice at any time using Cookie settings. Turning analytics off stops future tracking and removes this site’s Google Analytics cookies. It does not erase data already received by Google.

Managing your information

You can remove your posted videos and their unshared linked files from Your videos. For other account or privacy requests, contact the project maintainer through the project’s GitHub page to arrange a private conversation. Public issue reports are for service problems; account information should be handled privately.