Privacy Policy

Last updated: April 11, 2026

SecureVideoStream ("we," "our," or "us") operates the website at securevideostream.com and the SecureVideoStream platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

By using SecureVideoStream, you consent to the practices described in this policy.

1. Information We Collect

a) Account Information

When you create an account, we collect your username and password. Passwords are never stored in plain text — they are hashed using PBKDF2 with 100,000 iterations and a unique salt per user.

b) Usage Data

We collect information about how you use the platform:

• Videos viewed, playback position, and watch history
• Session timestamps and duration
• Device type, browser, and operating system
• IP address (for security and abuse prevention)
• DRM license requests and stream activity

c) Google Drive Data

If you connect your Google Drive account via OAuth 2.0:

• We request read-only access to list and stream video files
• We also request access to your email address (to identify connected accounts)
• We never modify, delete, copy, or permanently store any files from your Google Drive
• OAuth tokens are encrypted with AES-256-CBC and stored server-side in our database
• You can connect multiple Google Drive accounts (based on your plan)
• You can disconnect any account at any time from the admin panel

d) Payment & Plan Data

We store your subscription plan (Free, Starter, Pro, or Business) and usage metrics (storage used, video counts, connected accounts). Payment processing is handled by third-party providers — we do not store credit card numbers.

e) Transcription Data

When you use the AI transcription feature, audio is processed locally on our server using Whisper AI. No audio or video data is sent to external AI services or cloud APIs.

f) Embed & Analytics Data

When videos are embedded on external websites via embed IDs, we track view counts and may log the referring domain. No personal data of embed viewers is collected.

2. How We Use Your Information

• To provide, maintain, and improve our video streaming service
• To manage your account, authentication, and subscription plan
• To enforce DRM licensing, content protection, and stream limits
• To generate video transcriptions and subtitles when requested
• To stream private videos from connected Google Drive accounts
• To proxy and encrypt video content from third-party sources (S3, YouTube, etc.)
• To monitor, detect, and prevent unauthorized access, piracy, or abuse
• To track video view counts and embed analytics
• To communicate with you about your account (if email is provided)

3. Data Security

We implement multiple layers of security:

• Video Encryption: AES-128-CBC with per-chunk key rotation — videos are encrypted on-the-fly
• Signed URLs: AES-256-GCM encrypted, time-limited embed tokens
• Authentication: JWT-based sessions with httpOnly, sameSite cookies
• Password Protection: PBKDF2 hashing with 100,000 iterations and unique salts
• OAuth Token Storage: Encrypted with AES-256-CBC before storing in database
• DRM Licensing: Per-session licenses with concurrent stream limits and automatic expiry
• SSRF Protection: Private IP blocking on remote video proxy to prevent server-side request forgery
• Anti-Capture: Screenshot, screen recording, and DevTools protections in the player
• Database: Hosted on Supabase (PostgreSQL) with row-level security

4. Third-Party Services

We integrate with the following services, each only when explicitly configured:

• Google Drive API: OAuth 2.0 for read-only access to your private video files. Scopes: drive.readonly, userinfo.email
• YouTube: Video streaming via yt-dlp (open-source). Videos may be cached locally for quality optimization
• AWS S3 / EC2: Video streaming from your own AWS infrastructure with stored credentials
• Supabase: PostgreSQL database hosting for user data, video metadata, and access control
• Whisper AI (local): Speech-to-text transcription — runs entirely on our server, no external API calls

We do not share your personal data with any third party for marketing, advertising, or data brokerage purposes.

5. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account termination
• Login sessions: Automatically expire after 24 hours
• DRM licenses: Expire after 4 hours
• Google OAuth tokens: Stored until you disconnect the account
• Watch history: Retained while your account is active
• YouTube cache: Retained until manually cleared by the administrator
• Transcription files: Retained alongside video metadata until deleted
• Embed view counts: Retained indefinitely for analytics
• Signed URLs: Expire based on configured duration (1 hour to 24 hours)

6. Your Rights

You have the right to:

• Access your personal information stored in our system
• Delete your account and all associated data
• Disconnect Google Drive accounts at any time from the admin panel
• Revoke Google OAuth access via your Google Account permissions page
• Export your data upon request
• Opt out of any optional data collection

7. Cookies

We use the following essential cookies only:

• session: httpOnly cookie for login session management (expires: 24 hours)
• gdrive_token: httpOnly cookie for immediate Google Drive access after OAuth (expires: 1 hour)
• gdrive_email: httpOnly cookie to identify the connected Google account

We do not use any tracking cookies, advertising cookies, analytics cookies, or third-party cookie services.

8. Children's Privacy

SecureVideoStream is not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it immediately.

9. International Data Transfers

Your data may be stored and processed in servers located outside your country. By using our service, you consent to the transfer of your data to our servers and third-party service providers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

• Email: support@securevideostream.com
• Website: securevideostream.com