In short
- We collect only what we need to run ZapFlix: your account details, what you watch and save, and technical data that keeps the service working and secure.
- We do not sell or rent your personal data, and we do not send you marketing emails.
- If you sign in with Google we receive only your name, email address, Google account ID and profile picture link — never your Google password, emails, contacts or files.
- You can ask us at any time to see, correct, export or delete your data by writing to [email protected].
1Who we are
ZapFlix ("ZapFlix", "we", "us") runs the website zapflix.me and its related services, including our Telegram channel, discussion group and bot (together, the "Service"). We decide why and how the personal data described here is processed, which makes us the "controller" of that data.
This policy applies to everyone who visits or uses the Service, with or without an account. Please also read our Terms of Use.
You can contact us about privacy at [email protected].
2The data we collect
Depending on how you use the Service, we collect:
- Account details: username, email address, your password (stored only as a one-way cryptographic hash, so nobody at ZapFlix can read it), account type, the date you joined, the IP address and country you signed up from, and whether your email address has been verified.
- Google sign-in details: if you choose "Continue with Google", see section 3.
- Your activity on ZapFlix: titles you play and where you stopped, your list, likes, notifications, reward points and how you earned or used them, your profile picture choice, subtitle preferences and timing adjustments, subtitles you upload, and problem reports you send together with our replies.
- Technical and usage data: IP address, browser and device type (user agent), the pages you open and when, your approximate country derived from your IP address, your language, and error and security logs.
- Advertising measurement: when an ad is shown we record which ad, where, and whether it started, finished, was skipped or clicked, together with pseudonymous identifiers (a hash of your IP address, a hash of your browser details and a random visitor ID). We use these to count views, limit how often you see the same ad and prevent fraud.
- Security data: sign-in attempts with their IP address, anti-bot check results and whether an ad blocker was detected during your visit.
- Email verification: the 6-digit codes we email you are stored only as hashes and expire after a few minutes; pending messages are stored encrypted until they are sent.
- Telegram: if you use our bot or comment in our group, your Telegram user ID, your name and username as provided by Telegram, your language choice and moderation records (for example a temporary mute). If you link Telegram to claim the follow reward, we keep that Telegram user ID with your ZapFlix account so the reward is given only once.
- Messages to us: anything you send us by email or through the in-site report form.
We do not collect payment card details, and we do not ask for sensitive information such as health, religion or political opinions. Please do not include such information in reports or messages.
3Signing in with Google
If you choose to sign in with Google, we request only the basic permissions "openid", "email" and "profile". From Google we receive your Google account ID, email address, name and the link to your profile picture. We never receive your Google password and we have no access to Gmail, Contacts, Drive, YouTube or any other Google data.
- How we use it: only to create your ZapFlix account, sign you in, keep the account secure and contact you about the account (for example a security notice).
- How we store it: on our servers, together with your ZapFlix account, for as long as the account exists.
- Who we share it with: nobody, except service providers that help us run the Service under confidentiality obligations (such as hosting and email delivery), when the law requires it, or with your consent.
- What we never do: we do not sell Google user data, use it for advertising or ad targeting, use it to build profiles for others, or use it to train artificial-intelligence or machine-learning models.
ZapFlix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove ZapFlix's access at any time at myaccount.google.com/permissions. Removing access does not delete your ZapFlix account; to delete it, write to [email protected].
4How and why we use your data
We use personal data only for the purposes below. Where the law requires a legal basis (for example the GDPR), it is shown in brackets.
- To provide the Service and your account — sign-in, playback, continue watching, your list, subtitles, notifications and rewards (performance of our agreement with you).
- To remember your preferences — language, playback quality, subtitle style (our legitimate interest in a working service; for visitors without an account this is stored on your device).
- To show and measure ads — ads keep ZapFlix free; we measure them to count views, cap frequency and stop fraud (legitimate interest; consent where the law of your country requires it).
- To keep the Service secure — preventing spam, abuse, account takeover, fraud and attacks, and enforcing our Terms of Use (legitimate interest and legal obligations).
- To send service messages — verification codes, password resets and important notices about your account or these policies. We do not send marketing emails.
- To improve the Service — fixing errors and improving speed using logs and aggregated statistics (legitimate interest).
- To comply with the law — responding to lawful requests and keeping records the law requires (legal obligation).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The ad-blocker check and anti-bot checks only decide whether a page or video can load.
5Cookies and similar technologies
We use a small number of our own cookies and browser storage items. We do not use third-party analytics or advertising tracking cookies of our own.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| PHPSESSID | Essential cookie | Keeps you signed in and protects forms against forgery | Until you close the browser or sign out |
| zf_lang | Functional cookie | Remembers the language you chose | 1 year |
| zf_visitor_id | First-party statistics cookie | Random ID used to count visitors who are online; it is not linked to your name for visitors without an account | 1 year |
| zf_sub_guest | Functional cookie | Saves subtitle choices for visitors without an account | 1 year |
| zf_consent | Consent cookie | Remembers whether you accepted or declined ads from advertising networks (asked in the EEA, the UK and Switzerland) | 6 months |
| Local and session storage | Browser storage | Player settings (quality, subtitle style, list or grid view), where you stopped watching, favourite live channels, and which ad breaks you have already seen so they are not repeated | Until you clear it; watch position 90 days, ad breaks 12 hours |
Services embedded in some pages — YouTube trailers, Google Cast and advertising partners — may set or read their own cookies under their own policies. You can delete or block cookies in your browser settings; if you block essential cookies you will not be able to sign in.
7International transfers
Our servers and service providers may be located outside your country, including outside the European Economic Area. When we transfer personal data internationally we rely on safeguards recognised by applicable law, such as adequacy decisions or standard contractual clauses offered by our providers, and we only use providers that commit to protecting the data.
8How long we keep data
- Account, list, watch history and preferences: for as long as your account exists. When you ask us to delete your account we delete or anonymise this data within 30 days, unless the law requires us to keep part of it (for example records of fraud).
- Activity, security and server logs: up to 12 months.
- Sign-in attempts and anti-bot counters: up to 30 days.
- Online-presence records: up to 90 days after your last visit.
- Advertising measurement records: up to 25 months, after which the pseudonymous identifiers are deleted and only anonymous totals remain.
- Email verification codes and pending messages: minutes for the codes; records are deleted within 7 days of expiring.
- Problem reports: up to 24 months.
- Subtitles you upload: until you or we delete them; if you delete your account, published subtitles may stay available without your name.
9How we protect your data
We use encrypted connections (HTTPS), slow salted password hashing, signed and expiring playback tokens, protection against forged requests, limits on repeated attempts, encrypted email queues and restricted administrator access. No online service can be completely secure; if a breach affects your data in a way that puts you at risk, we will notify you and the competent authorities as the law requires.
10Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your account and data (signed-in members can do this at once from "Delete my account" in the account menu);
- restrict or object to processing based on our legitimate interests, including ad measurement;
- receive your data in a portable format;
- withdraw any consent you gave, without affecting earlier processing;
- complain to a data-protection authority — for example the authority in your EU or UK country, or the Personal Data Protection Council in Jordan.
To use these rights, write to [email protected] from the email address of your account. We may ask you to confirm your identity. We answer within 30 days and it is free of charge. If you live in a US state with privacy laws (such as California), you also have the right to know, correct and delete your data; we do not sell or share personal data and we will never treat you differently for exercising your rights.
11Children
The Service is not intended for children under 13, and we do not knowingly collect personal data from them. In the European Economic Area, users under 16 may only create an account with the consent of a parent or guardian. Some titles are intended for adults. If you believe a child has given us personal data, contact [email protected] and we will delete it.
12Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows the latest version. If we make significant changes we will tell you on the site or by email before they take effect.
13Contact
For any question or request about privacy, write to [email protected]. Please include enough detail for us to help you, and never send your password.
Questions about this page? Write to us at [email protected].