This Privacy Policy describes how ReplayVOD collects, uses, and protects your information when you use ReplayVOD Connect. The self-hosted ReplayVOD software runs entirely on your hardware and is not covered by this policy — it never sends your data to us.
What we collect
To operate Connect, we collect and store the following:
- Account email. Provided by you (via Polar checkout) and used to send your magic-link sign-in emails and service notifications.
- Polar customer ID. Provided by Polar after a successful checkout. Used to look up your subscription state and to redirect you to the Polar-hosted customer portal.
- Subscription state. Status, current period end, and relevant lifecycle events received from Polar webhooks.
- Relay tokens. Random opaque tokens we issue to identify your relay endpoint. Tokens are scoped to your account and revocable.
- Session cookies. A single HTTP-only cookie (
rv_session) is set when you sign in, scoped to our API domain. - Service logs. Cloudflare Workers automatically logs request metadata (IP address, user agent, status, timing). Logs are retained briefly for operational purposes.
What we do not collect
- Webhook payload contents. The relay forwards bytes verbatim to your self-hosted instance. Payloads are buffered briefly (currently five minutes) only so that a brief reconnect does not lose events. We do not parse, log, or persist them long-term.
- Video recordings. Video files stay on your hardware. We never receive or store them.
- Twitch credentials. The relay does not authenticate to Twitch on your behalf. You hold your own Twitch developer application's keys.
- Payment-card information. Card data is handled by Polar (and its underlying processor) and never reaches our servers.
How we use information
- To provision and operate your relay tokens.
- To send transactional email (magic-link sign-in, service notices).
- To process subscription billing and payments (via Polar).
- To investigate abuse, fraud, or operational issues.
- To comply with legal obligations.
We do not sell your personal information. We do not use it for advertising or marketing to third parties.
Third-party processors
We rely on the following processors. Each has its own privacy policy.
- Polar — merchant of record, payment processing, billing, customer portal. polar.sh/legal/privacy
- Cloudflare — Workers (compute), D1 (database), R2/Pages (static hosting), DNS. cloudflare.com/privacypolicy
- Cloudflare Email — transactional email delivery. cloudflare.com/privacypolicy
Cookies
We set one cookie: rv_session, an HTTP-only, Secure session cookie used to keep you signed
in. It expires thirty (30) days after sign-in and is deleted on logout. We do not use third-party cookies,
advertising cookies, or analytics cookies on the marketing site.
Data retention
- Account data (email, Polar customer ID, tokens, subscription state) is kept for as long as your account is active.
- Closed-account data is deleted within thirty (30) days of cancellation, except for records we are legally required to retain (Polar maintains its own retention separately).
- Magic-link tokens expire fifteen (15) minutes after issuance and are marked used immediately on consumption.
- Webhook payload buffer is purged on a five-minute TTL.
Your rights
Depending on your jurisdiction (notably the EU/EEA, UK, and California), you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
To exercise these rights, email legal@replayvod.com from the address associated with your account. We respond within thirty (30) days.
International transfers
Our processors operate global infrastructure. Your data may be processed in countries other than the one you reside in. We rely on the contractual and technical protections each processor provides, including standard contractual clauses where applicable.
Children
Connect is not intended for users under sixteen (16). We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy by posting an updated version. Material changes will be announced by email to active subscribers.
Contact
Privacy questions or requests: legal@replayvod.com. Operator: ReplayVOD, Available on request at legal@replayvod.com.