← Legal
Privacy Policy
Last updated: June 2025
Data we collect
| Data | Where stored | Purpose |
|---|---|---|
| Name, email, profile picture | Sbrizi server | Authentication (Google OAuth) |
| AniList access token | Sbrizi server | AniList integration (optional) |
| Current page (heartbeat) | Sbrizi server, 60-day retention | Online presence indicator |
| Module security audit (hash + scan verdict) | Sbrizi server | Security scan record, module ban enforcement |
| Module metadata (name, author, version) | Your device (IndexedDB) | Module management — never sent to server |
| Module scripts (encrypted) | Your device (IndexedDB) + Sbrizi server (AES-256-GCM encrypted blob, opt-in sync) | Execution in browser — server stores only ciphertext |
| Watch progress, favorites | Your device (IndexedDB) | Playback resume, library |
| Settings (theme, language, etc.) | Your device (localStorage) | User preferences |
| Watch party sync signals, chat and voice messages | Relayed through Sbrizi server in transit only, end-to-end encrypted, never stored | Watching together (optional) |
| DMCA notice content | Sbrizi server, permanent | Legal compliance |
What we do NOT collect
- Search queries or titles you look up
- Episodes or content you watch
- URLs or sources accessed by your modules
- Contents of module scripts (only hash + security scan result)
- Plaintext content of module scripts (server stores only AES-256-GCM encrypted blobs)
- What a watch party is watching, or its chat and voice messages
Watch together
A watch party is identified by a code that only its members know. The encryption key is derived from the code on your device and never reaches Sbrizi's server, which only relays encrypted messages between members and sees a hashed room identifier, the number of members and message sizes. Nothing is stored: rooms exist in memory and disappear shortly after the last member leaves. Other members of your party see your name, profile picture and what you are watching. The microphone is used only while you hold the voice button, and voice messages are kept on the devices of party members only until they leave the party.
Module sync
If you use the module sync feature, encrypted module blobs are stored on Sbrizi's server. Blobs are encrypted client-side with AES-256-GCM before upload — Sbrizi's server stores only ciphertext and cannot read module contents. The encryption key is derived from your account identity and is never transmitted in plaintext.
Data retention
- Account data: retained while account is active, deleted within 30 days of deletion request
- Heartbeat / page view log: 60 days
- Module metadata: deleted with account
- DMCA notices: retained permanently for legal compliance
Your rights (GDPR)
If you are in the EU/EEA, you have rights to access, correct, delete, or export your personal data. To exercise these rights, email [email protected]. Most user data (watch progress, favorites, settings) lives on your own device and can be deleted at any time without contacting us.
Cookies and tracking
Sbrizi uses a session cookie for authentication only. No advertising cookies, tracking pixels, or third-party analytics.
Third parties
- Google — OAuth sign-in
- AniList — optional tracking integration
- AniList / MAL (Jikan) / TMDB / TVmaze / AniSkip — metadata lookups (no PII sent). TV data provided by TVmaze.com under CC BY-SA.
- Cloudflare — DDoS protection (processes IP addresses)
Contact
Privacy inquiries: [email protected]