PRIVACY POLICY

Account data

When you create an account through our authentication provider, Clerk, we receive and store:

• Your email address
• An encrypted password (or a federated sign-in token if you use Google)
• Your display name and profile picture, if you provide them or sign in with Google

Activity data

• Your wishlist and favourites
• Your unavailable-video list (so we can skip videos that don’t work for you)
• Flag reports you submit (broken, wrong video, wrong decade, etc.)
• Limited playback history used to power the recommendation queue

Technical data

• IP address and approximate geographic location, used to detect abuse and to localize regional video availability
• Browser, device, and operating-system information
• Server logs and error reports captured by Sentry
• Authentication cookies set by Clerk

What we do not collect

We do not collect payment information (the Service is free). We do not run advertising trackers. We do not collect Google data beyond basic sign-in (see Section 5).

• Operate the Service and personalize the playback queue
• Authenticate you and keep your account secure
• Send service-related emails (account verification, sign-in, security notices)
• Curate the catalogue based on flag reports and aggregate signals
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell personal information.

We send service-related emails only — for example, email verification, sign-in links, and security notices. We do not currently send marketing or promotional emails. If we ever do, those emails will include our business name, mailing address, and an unsubscribe link, and we will process unsubscribe requests promptly in accordance with CASL.

We use third-party providers to operate the Service. Each one only receives the data it needs to do its job:

• Clerk — authentication and account management (email, name, profile picture, password)
• Railway — application hosting and database (your account data, activity data, and server logs)
• Sentry — error monitoring (technical error reports, which may include your IP address and the page you were on)
• YouTube (Google) — video playback through embedded players. When a video loads, YouTube may set its own cookies and collect data subject to Google’s Privacy Policy.
• Spotify, Last.fm, Genius, lrclib, Wikipedia, Deezer, and iTunes — accessed server-side for artist images, lyrics, and metadata. No personal data about you is shared with these providers.

These providers may process data outside Canada (see Section 7) and are expected to protect your data appropriately.

Video Hits TV lets you sign in using your Google account via Clerk. This section describes how we handle data received from Google APIs, in compliance with the Google API Services User Data Policy.

Data accessed

When you sign in with Google, we receive:

• Your name
• Your email address
• Your profile picture

We do not request access to Gmail, Google Drive, Google Calendar, or any other Google services beyond basic sign-in.

Data usage

Google user data is used solely to:

• Create and authenticate your Video Hits TV account
• Display your name and profile picture inside the app
• Send essential service emails to your email address

We do not use Google user data for advertising, do not share it with third-party marketers, and do not use it for any purpose unrelated to operating Video Hits TV.

Data sharing

We do not sell, rent, or share your Google user data with any third parties, except as necessary for the service providers listed in Section 4 (Clerk for authentication; Railway for application hosting). These providers process data only on our behalf.

Data retention & deletion

Google user data is retained for as long as your account is active. When you delete your Video Hits TV account, your profile data is removed from our systems within 30 days and your authentication record is removed from Clerk. You can also revoke Video Hits TV’s access to your Google account at any time via your Google Account permissions page.

Video Hits TV uses cookies and similar technologies (such as browser local storage) only for essential functionality:

• Authentication session (Clerk) — keeps you signed in
• Player preferences — volume, autoplay, and UI preferences saved locally on your device

We do not run Google Analytics, PostHog, or any other analytics or advertising tracker. Embedded YouTube videos set their own cookies as described in Section 4.

You can block cookies in your browser settings, but some features — including sign-in — may stop working.

Because we use providers such as Clerk, Railway, Sentry, and Google (for YouTube embeds), your data may be processed in the United States or other jurisdictions outside Canada and may be subject to the laws of those jurisdictions.

• Account data: until you delete your account
• Activity data (wishlist, flags, unavailable list, playback signals): until you delete the entry, your account, or we determine the data is no longer needed
• Server logs and error reports: up to 90 days
• Authentication records (Clerk): until your account is deleted

We use reasonable safeguards to protect personal information, including encrypted connections (TLS), encrypted password storage through Clerk, restricted production access, and ongoing error monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Under PIPEDA, you may request access to the personal information we hold about you and request corrections if anything is inaccurate. Contact us using the details in Section 13.

You can request account deletion by emailing us. When you delete your account:

• Your personal data (email, profile, IP records, activity data) is scrubbed from our database
• Your authentication record is removed from Clerk
• Your wishlist, flag reports, and unavailable-video list are deleted
• Within 30 days, all associated personal data is permanently and irreversibly removed

Retention exceptions: Server logs and error reports may be retained for up to 90 days. Aggregated, anonymized signals used to curate the catalogue (with no link back to you) may be retained indefinitely.

The Service is not intended for, and we do not knowingly collect personal information from, individuals under the age of 13. If we learn that we have collected personal information from a child under 13, we will delete it. Parents or guardians who believe their child has provided us with personal information should contact us using the details in Section 13.

We may update this Privacy Policy periodically. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after an update means you accept the revised Policy.

Under PIPEDA, Canadian users have the following rights:

• Right to access: request a copy of the personal data we hold about you
• Right to correction: request that inaccurate personal data be corrected
• Right to deletion: request deletion of your account and personal data
• Right to withdraw consent: withdraw your consent to our processing of your data at any time

Response timeline: we will respond to data requests within 30 days. To make a request, email us using the details in Section 15. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Privacy Officer — Mighty Web Design

143 Fairway Rd, Emerald Park, SK, S4L 1C8, Canada

Email: trent@mightydesign.ca