Data & privacy

What data Vid Receipts collects, how it's used, and the controls you have over your information.

This guide explains what data Vid Receipts collects, how we use it, and what controls you have over your information.

For the full legal details, see our Privacy Policy and Terms of Service.

Remembering referral invitations

Saving an invitation is an optional Preferences choice in Cookie settings. We ask for a fresh choice under the updated policy, including if you previously accepted Preferences. The saved invitation reference is sent to Vid Receipts at signup to apply the offer; it is not used for analytics. Declining, withdrawing Preferences, or sending Global Privacy Control stops this tab from using the invitation and asks the browser to remove it. If your browser refuses changes to both local storage and cookies, it cannot remember a withdrawal after you reload and Global Privacy Control is off. Clear this site's data through your browser controls to remove the old choice and invitation. You can keep using the app either way. Referral invitations explains expiry, blocked browser storage, and entering a code yourself.

What data we collect

Account information

When you sign up, we store basic account details through our secure authentication system:

Email address: Used for sign-in and account recovery
Display name: Shown on your receipts and comments. Votes are private.
Authentication provider: How you sign in (email/password, Google, etc.)

Content you create

Everything you post on Vid Receipts is stored in our database:

Receipts: Your timestamped annotations on videos
Comments: Replies and discussions on receipts
Votes: Your validate/invalidate votes on receipts and comments
Feeds: Custom feeds you create and their sharing settings

Follow requests

When you ask to follow someone you saw behind a mask, we keep a record of the ask.

Vid Receipts stores each request — who asked, which mask they asked through, and what happened to it — so we can enforce rate limits and investigate abuse. The person you ask never sees your account, only the persona you asked with. If they decline, you are not told: to you, a declined request looks the same as one that was never answered, and it quietly expires after 30 days.

Follow requests covers what each side sees and how to block a persona that keeps asking.

Watch parties and rides

When you sit in a watch party or ride along with someone, our servers keep a private record of your seat: when you joined, how long you were there, whether you were the host or a rider, and which videos the session moved through. Nobody can read it. Not the other people in the room, and not you from inside the app. It exists so that the achievements we hand out later are based on something real rather than on a number your browser reported about itself.

Your seat record keeps its link to your account for 90 days after the session ends, and then the per-seat detail is deleted. What survives is the session's own totals, like how many people were there and how long they overlapped, and those name nobody. If we ever have a legal reason to keep a particular session's detail longer, that hold has to name an end date; it cannot run indefinitely, and it never stops us erasing your account.

You can see all of it. Your seat records, how each of your rides ended, and anything from a session you are in right now are all in your data export, described below. What is not in there is anyone else's half of it: a ride is between two people, so the export tells you that you were the rider and does not tell you who the carrier's account was.

Waiting rooms for scheduled parties

A booked party opens its waiting room shortly before it starts. What people type there, and the captions their own devices produce while the mic is on, live only in that room: the room is built to stop taking new messages the moment the party begins, and it is deleted outright when the party ends or the host calls it off. The piece that starts a booked party is still being built, and the switch that quiets the room ships with it. Nothing from a waiting room reaches your data export, because by the time you could ask for it there is nothing left.

The one exception is a message somebody reports. We keep a copy of that message, and who sent it, so we can act on the report and answer for the decision afterwards. That copy is kept apart from the room and outlives it, exactly like a reported message in a live party, and only a small number of our staff can read it. Party chat covers how to report a message and what happens next.

YouTube data

If you connect your YouTube account, we access:

Subscriptions: A private signal used to personalize the Popular now shelf
Liked videos: A private signal used to personalize Popular now, never displayed, never shown as a score
Channel information: To display your YouTube identity
Playlists and video metadata: To open your playlists as stacks and enrich annotations

YouTube OAuth access tokens are stored securely and are only used to fetch the data described above. We never post to YouTube on your behalf or access data beyond what's needed for the features you use. Your subscriptions and liked videos personalize your own Popular now shelf only, they are a ranking signal, never sold or shared, and we never show you (or anyone) a derived number built from them. Cached YouTube data is deleted within 30 days of you disconnecting or your authorization lapsing, in line with the YouTube API Services Terms.

Facts about a channel itself, such as which playlist holds its uploads, are cached without any record of who subscribes to it, and your private and unlisted playlists are stored only with your own account.

Your data export includes your retained Discover activity and its contribution to shared recommendations, retained progress history, awards and their events, service credits, referral and payment outcomes, and complimentary-access decisions. Staff identifiers, private notes, and other people's account keys are removed from these records.

Payment, refund, dispute and earned-credit details are kept while your account is open, along with the reward eligibility, earned awards and limit records that go with them. Unresolved cases stay on hold. When you delete your account, these records are deleted with it, except the details still needed to finish or check a payment, refund, dispute or credit. Our payment processor keeps invoices and payment records for as long as tax and accounting law requires. A later verified refund can still remove the affected period or referral payment from qualification.

Billing history includes every available invoice page from your current and retained previous payment accounts, after our provider confirms each belongs to you. The file marks billing history or the storage file list as incomplete or unavailable if a read fails. If other account history cannot be read, the export fails and you can try again. An empty list marked complete means no records were found.

Scheduled email summaries

We temporarily retain the information needed to retry a scheduled activity summary, including its recipient and the content in that message. We check your current notification settings and verified sign-in email address before sending. Sent or suppressed summaries lose their stored message content immediately. Unfinished summaries expire after 24 hours, or 23 hours after the first send attempt if that is sooner, and are cleared when processed or swept. We keep a minimal outcome record for seven days. Account erasure removes pending summaries addressed to you or naming you as an author. A message already being sent cannot be recalled.

Usage data

When Analytics is allowed, we measure web sessions, new-account signups, and successful receipt or party creation to understand how people begin using Vid Receipts. A saved party booking counts separately from starting a live party. These events use your analytics account identifier across devices; new party measurement includes no title, invitation list, private link, chat or receipt content. Declining Analytics or sending Global Privacy Control stops these new measurements. The extension sends no analytics. You can change your choice in Cookie settings.

We collect basic usage information to keep the platform running smoothly:

Page views and feature usage: Helps us understand which features are popular
Error logs: Helps us find and fix bugs
Error tracking: When application errors occur, our error-tracking service collects error details and browser/device metadata to diagnose and fix issues. Personal information is filtered before transmission.
AI moderation telemetry: We track the performance and outcomes of our AI content moderation system to ensure quality and fairness

How we use your data

Your data is used to:

Provide the service: Display your receipts, process votes, manage feeds
Improve the platform: Understand usage patterns and fix issues
Moderate content: AI moderation reviews public receipt content for quality (see AI moderation)
Communicate with you: Account notifications and important updates

We do not sell your personal data to third parties.

Managing your data

Open Cookie settings from the footer or Settings to review your privacy choices. Use Tab or Shift+Tab to move between controls inside the open dialog. Choose Save choices to apply them. Close or Escape dismisses the dialog without saving changes. Focus returns to the control that opened it when that control is still available. If you have not made a choice yet, the cookie notice stays available.

Editing your profile

Update your display name and other profile details anytime from Account settings.

Disconnecting YouTube

You can unlink your YouTube account at any time from Settings. When you disconnect:

Your YouTube subscriptions are no longer synced
Stored access tokens are removed
Cached YouTube data (subscriptions, liked videos, and the metadata used to personalize Popular now) is deleted within 30 days
Your existing receipts and content are not affected

Deleting your content

You can delete individual receipts, comments, and feeds at any time. Deleted content is permanently removed from our database.

Deleting your account

If you'd like to delete your entire account:

Go to Settings
Scroll to the Danger Zone section
Click Delete Account

You can cancel during the 30-day grace period. Once erasure starts, a new request cannot restart that period or clear a paused deletion. If deletion needs support review, contact support. Your export includes the deletion request, retained progress and completion record, with internal execution details removed.

Account deletion removes:

Your profile and authentication data
Your votes and the author identity on retained receipts and comments
All custom feeds you own
Your YouTube connection data
Complimentary-access grant and revocation records about your account
The link between your account and any watch party or ride you sat in

A watch party's totals cover everyone who was in the room, so deleting your account does not rewrite them or take away what other people earned. We remove the personal detail that links your seat to your account, including for a session still running when erasure starts.

A scheduled room temporarily keeps a minimal access-denial record linking your account ID to that room so an old login cannot let you back in. It records that access was revoked; your persona, membership and admission details are removed. Cleanup can remove it after account erasure, including deletion of your login, succeeds and another two hours have passed. Failed erasure keeps the denial in place until it can finish. Separate records for closing media connections contain connection identifiers and retry information, with no account, persona or membership link. They remain until closure is confirmed and the one-hour window for requests already in flight has passed.

Retained receipts and comments show Deleted User without a name, avatar, or profile link. Comment previews are refreshed, and saved or tagged copies no longer retain the erased author identity. Saved and tagged lists read authors from the current receipt; an unavailable receipt shows no author.

This action is permanent and cannot be undone.

Paid subscriptions must be canceled before erasure continues. If the payment provider cannot confirm ownership or complete the cancellation, deletion waits for a retry or support review. We retain the account records needed to resolve the problem and do not mark deletion complete while it is unresolved.

Erasure removes your private Discover contribution records and subtracts them from shared recommendation totals. Public totals contain no account identities.

Deletion also waits for YouTube refreshes already in progress to finish. If we cannot confirm that a refresh has stopped, deletion waits for support review. We keep its status record until the issue is resolved and do not mark deletion complete while it is unresolved. Your export includes any retained refresh status records.

Erasure deletes your complimentary-access audit history, your reward eligibility history and your payment and reward records. Only the details still needed to finish or check a payment, refund, dispute or credit remain, and an unresolved case stays on hold until it is resolved.

An existing referral-offer marker stays for 400 days after erasure first starts, then is removed. It lets us recognize a repeated claim from the same email address. The separate free-trial record keeps its existing policy and is not reset when the referral marker expires.

Activity history

We keep detailed daily and weekly activity history for 30 UTC weeks. Older resolved activity is folded into lifetime totals and earned progress, including original badge dates, while your account exists. If evidence needs reconciliation, we keep the relevant detail until it can be resolved. Your export includes all retained personal activity and these summaries. It excludes other members' private identifiers and evidence keys.

Your rights

Depending on where you live, you may have additional rights under privacy laws like GDPR or CCPA:

Access: Request a copy of the data we hold about you
Correction: Ask us to fix inaccurate information
Deletion: Request that we delete your data (or use the self-service option above)
Portability: Request your data in a machine-readable format
Objection: Object to certain types of data processing

To exercise any of these rights, contact us at privacy@vidreceipts.com.

Data security

We use industry-standard security practices to protect your data:

A managed authentication service handles sign-in securely
Server-side security rules enforce access control at the database level
OAuth tokens are stored securely and scoped to minimum required permissions
HTTPS is used for all data transmission
Error tracking filters PII before transmitting error reports
Analytics data is collected only in production and never in emulator/development mode

Contact us

If you have questions about your data or privacy:

Privacy inquiries: privacy@vidreceipts.com
Legal inquiries: legal@vidreceipts.com

We aim to respond to all privacy-related requests within 30 days.