Legal
Privacy Policy
StreamVault is built with privacy in mind. This policy explains what data we collect, why, and how we protect it. The short version: we collect as little as possible.
Privacy-First Approach
StreamVault is open source. You can audit exactly what data is collected by reading the source code. We do not sell, share, or monetize your data. There are no analytics trackers, no ad networks, and no third-party data brokers.
1
Information We Collect
Account Data (if you register)
| Data | Purpose | Storage |
|---|---|---|
| Name | Display in your profile | Local database |
| Authentication, password reset | Local database | |
| Password | Authentication | Stored as bcrypt hash only |
Usage Data (if logged in)
| Data | Purpose | Retention |
|---|---|---|
| Favorites | Your saved list | Until you remove them |
| Watch history | Continue watching | Until you clear or delete account |
| Playback position | Resume from where you left off | Overwritten each session |
What We Do Not Collect
- IP addresses — we do not log or store visitor IPs.
- Device fingerprints or browser identifiers.
- Tracking cookies or advertising identifiers.
- Usage analytics or behavioral profiling data.
- Payment information — the service is completely free.
2
How We Use Your Data
- Authentication — to let you log in and maintain your session.
- Personalization — to show your favorites, watch history, and continue-watching state.
- Account management — to let you update your profile and delete your account.
We do not use your data for advertising, profiling, or any purpose other than those listed above.
3
Third-Party Services
| Service | Data Shared | Purpose |
|---|---|---|
| TMDB API | Search queries, content IDs | Fetching metadata |
| TMDB CDN | Your IP (browser request) | Loading images |
| Stream sources | Content IDs, your IP | Loading video content |
When you play content, your browser connects directly to third-party streaming servers. These servers may have their own data collection practices outside our control. We recommend using a VPN if privacy during playback is a concern.
4
Cookies & Local Storage
- Session cookie — maintains your login state. Essential only.
- CSRF token — protects forms from cross-site request forgery.
We do not use tracking cookies, analytics cookies, or any third-party cookie services.
5
Data Storage & Security
- Passwords are hashed using bcrypt with a cost factor of 12.
- Sessions are encrypted and stored server-side.
- CSRF protection on all forms and state-changing requests.
- All communication over HTTPS in production.
6
Your Rights
- Access — view all data we hold about you through your profile settings.
- Rectify — update your name, email, or password at any time.
- Delete — permanently delete your account and all associated data.
- Export — since the platform is open source, you can self-host and control your data entirely.
7
Children's Privacy
StreamVault is not directed at children under 13. We do not knowingly collect personal information from children.
8
Self-Hosted Instances
This privacy policy applies only to instances operated by the original project maintainers. Operators of self-hosted instances are responsible for their own privacy practices.
9
Changes to This Policy
We may update this privacy policy as the project evolves. Since the project is open source, you can track all changes through the version control history.
Last updated July 22, 2026. StreamVault is committed to transparency.