Privacy Policy

Draft for legal review. Data controller: [[LEGAL ENTITY NAME]], [[REGISTERED BUSINESS ADDRESS]]. Contact: [[privacy@yourdomain]]. [[DATA PROTECTION OFFICER / REPRESENTATIVE, if required]].

This policy explains what personal data we collect, why, and your rights. It is written to support GDPR (EU/UK) and CCPA/CPRA (California) obligations; your counsel should confirm coverage for your specific markets.

1. Data we collect

• Account data: username, display name, password (stored only as a salted hash), and your year of birth / age confirmation (to enforce the minimum age and age-gate content).
• Content data: the videos, audio, captions, thumbnails, titles, descriptions, tags, and comments you provide, plus the upload attestations you make.
• Usage data: watch history, likes, subscriptions, playlists, and reports you file.
• Node data (if you run a node): node identifier, owner, performance/quality metrics, uptime, and bytes served/stored (to calculate rewards).
• Technical data: IP address and basic request metadata, used for security, abuse prevention, and delivering content across the network.

2. Why we use it (legal bases)

• To provide the Service (contract): accounts, hosting and delivering content, playback, search.
• For safety and legal compliance (legal obligation / legitimate interests): moderation, reports, age-gating, copyright handling, fraud and abuse prevention.
• For node rewards (contract / legitimate interests): metering and settlement.
• We do not sell your personal data, and we do not run third-party behavioural ad tracking. (If advertising changes, this section must be updated.)

3. Sharing

We share data only with: service providers who help us operate (under contract); other network nodes, which receive encrypted content chunks to deliver the Service; and authorities where required by law or to protect safety. Content you publish publicly is visible to others by design.

4. The peer-to-peer network

Content chunks are encrypted and content-addressed, then distributed and cached across independent nodes to deliver playback. When you delete content or your account, we remove your manifests and stop serving the content; already-cached encrypted chunks on independent nodes age out over time and are not re-served once the manifest is gone.

5. Retention

We keep personal data only as long as needed for the purposes above or as required by law. Account data is kept while your account is active; some records (e.g. copyright/abuse logs, transaction records) may be retained longer where legally required. (Counsel to set exact retention periods.)

6. Your rights

Depending on where you live, you may have the right to: access your data, correct it, delete it ("right to erasure"), export it (portability), object to or restrict processing, and withdraw consent. Swarmcast provides in-product account deletion and data export. To exercise other rights, contact [[privacy@yourdomain]]. You may also complain to your local data-protection authority.

7. International transfers

If data is transferred across borders, we rely on appropriate safeguards. (Counsel to specify mechanisms, e.g. Standard Contractual Clauses.)

8. Security

We hash passwords, encrypt content at rest, and restrict access. No system is perfectly secure, but we work to protect your data and will notify you and regulators of breaches where required.

9. Children

The Service is not for users under 13. We do not knowingly collect their data and will delete it if discovered.

10. Changes and contact

We will post updates with a new effective date. Contact: [[privacy@yourdomain]], [[LEGAL ENTITY NAME]], [[REGISTERED BUSINESS ADDRESS]].