Privacy policy

Who is responsible

[Operator legal name], [Operator postal address] ("we") is the controller of your data. Contact: [contact@domain.example].

What we collect

• An anonymous id. On your first visit we create an anonymous account for you, with no name or password. Your browser keeps its session in a cookie.
• Your place in each series: the episode and second you reached, and when.
• How you first arrived: the link you opened (for example the one in an Instagram or TikTok profile) and any campaign tags in it, saved once.
• Your cookie choice and when you made it.
• Your email address, only if you tap Notify me: the address, the series you asked about, the version of the text you agreed to and when. We send a confirmation link first and email only confirmed addresses. Confirming links the address to your anonymous account.
• QR handoff codes. On a computer the site shows a QR code. It holds a random one-time code, valid for 15 minutes, tied to your anonymous id and the series you are watching. When a phone scans it, your place in that series is copied to the phone's own anonymous account and the code is used up. It never carries your login.
• Analytics events, only if analytics is allowed (see below): which episodes start, reach the halfway point and finish, reaching the end of a series, Home views, taps on Continue watching and Share, the email form being shown, sent and confirmed, links opened, and QR codes shown and used. They carry your anonymous id and the series and episode, never your email. Our analytics provider also receives what your browser sends with them: device type, operating system, browser, language and IP address (used to estimate your country and city).
• Technical data. Our hosting and video providers process your IP address and request data to deliver pages and video and to keep the service secure. We use your country, derived from your IP address, only to decide whether to ask for cookie consent; we do not store it.

We do not use advertising cookies. If we add ads later, this policy will be updated first.

Cookies and storage

• sb-…-auth-token (essential): your anonymous session, so the site keeps your place. Up to 400 days.
• consent (essential): your cookie choice. 180 days, then we ask again.
• consent_region (essential): whether your region needs your consent for analytics. Until you close the browser.
• AMP_… (analytics): Amplitude's device and session ids, in cookies and local storage. Up to 365 days. Set only when analytics is allowed.

In the EEA, the UK and Switzerland analytics starts only after you tap Accept. Elsewhere it is on unless your browser sends a Global Privacy Control signal, which we honor as a no. You can change your choice at any time in Cookie settings (also in the menu on Home).

Why we use it (legal bases)

• Showing the series, keeping your place and the QR handoff: needed to provide the service you use (GDPR Art. 6(1)(b)).
• Knowing which links bring viewers, and keeping the site secure: our legitimate interests (Art. 6(1)(f)).
• Analytics: your consent in the EEA, UK and Switzerland (Art. 6(1)(a)); elsewhere our legitimate interest in learning which episodes people enjoy, and you can switch it off in Cookie settings.
• New-episode emails: your consent (Art. 6(1)(a)), which you can withdraw by unsubscribing.

Who processes it for us

• Supabase: database and anonymous accounts.
• Vercel: hosting.
• Bunny.net: video delivery.
• Amplitude: analytics (only as described above).
• Resend: sending emails.

They process data only on our behalf. Where data leaves the EEA or the UK, we rely on the safeguards the law requires, such as the European Commission's standard contractual clauses. We never sell your data.

How long we keep it

• Your anonymous account, your place in each series, how you arrived and your cookie choice: until you delete them with Delete my data.
• Email requests: until you unsubscribe or delete your data. After unsubscribing, the confirmed address stays linked to your anonymous account until you delete your data.
• QR codes: they expire after 15 minutes and are removed when you show a new one or delete your data.
• Analytics events stay with Amplitude, linked only to your anonymous id. Delete my data does not reach them: email us and we will have them deleted.

Your rights and deleting your data

Open the menu on Home and tap Delete my data: your anonymous account and everything linked to it (progress, email requests, cookie choice, QR codes) are deleted from our database immediately, and you start again as a new viewer. To unsubscribe from emails, use Menu → Notifications.

You also have the right to access, correct, export or restrict your data and to object to how we use it. Email [contact@domain.example] and we will answer within 30 days. You can also complain to your data protection authority.

Children

Episodia is for people aged 13 and over. It is not directed at children.

Changes

We will update this policy when what we collect changes. The date at the top shows the latest version.