Daftar

Privacy Policy

Last updated: 2026-10-01

This policy describes what data we collect, why, and your rights. We try to collect as little as possible.

1. Data we collect

Account data. When you create an account, we store your email address and a password hash. Email verification and password reset tokens are single-use and expire. We never store your raw password.

Activity data. We log request IP, timestamp, path, and HTTP status for operational debugging and abuse detection. Access logs are retained for 30 days.

Cookies. See section 4.

Saved activity. If you sign in, you can save favorites and watch history. You can pause history recording in your account settings.

2. Why we collect it

  • to operate the service (authentication, playback, favorites, history)
  • to prevent and investigate abuse
  • to comply with legal obligations (DMCA, lawful access requests)
  • to debug operational issues

3. Third parties

We share the minimum data necessary with the following processors:

  • Cloudflare — edge proxy, DDoS protection, CDN, encrypted object storage (R2)
  • AWS — application hosting, database (Seoul region), and transactional email (SES)
  • PostHog — product analytics and browser error tracking. Hosted by PostHog Cloud (US region for this project). Session Replay is enabled only within the anonymous signup and email-verification funnel on myav.ai; it is off everywhere else, including myav.app. All form-input values are masked. Replay does not capture console logs, network request or response headers or bodies, or URL query strings; the authenticated header's account email are excluded. We keep PostHog's hosted Replay network-payload setting off as a mandatory release-acceptance condition, with local browser settings as additional protection.

We do not sell personal data.

4. Cookies

  • better-auth.session_token — your sign-in session; cleared on sign-out
  • locale — your locale preference, when set explicitly
  • ph_anon_distinct_id — a first-party anonymous analytics identity cookie. It has SameSite=Lax, lasts one year, and identifies browser analytics events sent through our first-party /ingest path. It can also be the fallback ID for server-side named analytics events, which we forward directly to PostHog.

PostHog also uses first-party browser storage on our domain — local storage and a project-keyed first-party cookie — to retain analytics identity and session/event state. We do not use third-party advertising cookies. Passive browser analytics (page views and browser error reports) are sent to PostHog through our first-party /ingest path. Product feature-use analytics are sent as named server-side events. By visiting or using myav, you accept these cookies and this privacy policy.

5. Your rights

Depending on your jurisdiction (GDPR — EU/UK, CCPA — California, and similar laws elsewhere), you may have the right to:

  • request a copy of the personal data we hold about you
  • request correction or deletion
  • object to processing or withdraw consent
  • lodge a complaint with your data-protection authority

To exercise these rights, email [email protected] or use the /legal/contact form. We will respond within 30 days.

6. Children

The service is for adults only (18+). We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please email [email protected] and we will delete it.

7. International transfers

Data is stored in the AWS Asia-Pacific (Seoul) region. If you access the service from outside that region your data is transferred to Seoul to be processed.

8. Changes

We may update this policy. Material changes will be reflected on this page before they take effect.

9. Contact

Privacy questions: [email protected] or /legal/contact.