Privacy Policy

STO TV is operated by [registered company name], [registered address]. For data protection purposes, that operator is the controller of the personal data described here.

Privacy questions and requests: [contact email address].

Account details. Your first name, last name and email address. If you sign in with Google, we receive the name, email address and profile photo that Google shares with us. Your password is handled by Firebase Authentication and stored as a hash. We never see it. If you upload a profile photo, it is stored in Firebase Storage.

Viewing data. The titles you open, the progress you reach, your watch history, and the searches you run.

Device and usage data. Browser type and version, device type, operating system, screen size, the pages you request, the time of each request, error reports and your IP address. Our host and our authentication provider record part of this in their own logs.

Messages. Anything you send to [contact email address].

We do not collect card details today, because there is no paid plan.

We use personal data to:

• create and secure your account, and keep you signed in;
• show your watch history and resume a title where you stopped;
• run, maintain and debug the service;
• detect abuse, fraud and attempts to break the rules in the Terms of Service;
• answer your messages and requests;
• meet legal obligations, such as answering a lawful request;
• understand which parts of the catalogue are watched, in aggregate.

Where data protection law asks for a legal basis, we rely on the performance of a contract (running your account), our legitimate interests (keeping the service working and safe), consent where we ask for it, and legal obligation where it applies.

We use cookies and browser storage that the service needs to work:

• Firebase Authentication stores a session so you stay signed in between visits.
• Local storage keeps your playback and display preferences on your device.
• Our host may set security cookies and keep request logs.

We do not use advertising cookies, and we do not run third-party ad trackers today. If we add analytics or advertising later, we will update this policy and ask for consent where the law requires it.

You can clear or block cookies in your browser. If you block the authentication cookie, you will not be able to stay signed in.

We do not sell personal data. We use these processors:

• Google, for Firebase Authentication and Firebase Storage. Firebase holds your account record, the hashed password and your profile photo. Google processes this data under its own terms and may store it outside your country.
• Vercel, for hosting and content delivery. Vercel processes request data, including IP addresses, to serve the site and keep it secure.
• TMDB, for catalogue artwork and title metadata. A request for artwork or metadata may reach TMDB servers directly from your browser, in which case TMDB receives your IP address and basic request data. This product uses the TMDB API but is not endorsed or certified by TMDB.

We may also share data where the law requires it, or to protect the rights and safety of users and of STO TV.

• Account details: while your account is open, then deleted within [retention period] of account closure.
• Viewing history: while your account is open, then deleted with the account.
• Server and error logs: for [log retention period], then deleted or aggregated.
• Backups: for [backup retention period], then overwritten.
• Support messages: for [support retention period] after the conversation ends.

We may keep a limited record for longer where the law requires it, or to resolve a dispute.

Depending on where you live, you may have the right to:

• ask what personal data we hold about you, and get a copy;
• ask us to correct data that is wrong;
• ask us to delete your data;
• ask us to restrict or object to some processing;
• receive your data in a portable format;
• withdraw consent you gave earlier;
• complain to a data protection authority, which in your country is [supervisory authority].

To use a right, write to [contact email address]. We answer within [response period]. We may need to confirm who you are before we act.

To delete your account and its data, send the request to [contact email address]. We will confirm when it is done. Some records may be kept where the law requires it.

STO TV is not intended for children under [minimum age]. We do not knowingly collect personal data from a child under that age.

If you believe a child has created an account, write to [contact email address] and we will delete the account and its data.

We may update this policy. The date at the top of the page shows the current version. For a material change, we will tell you by email or in the service before it takes effect.

[contact email address]
[registered company name]
[registered address]