Effective August 14, 2026
This policy explains what SteelShort LLC ("SteelShort," "we," "us") collects when you use steelshort.tv or our mobile apps, why we collect it, who else sees it, and how you get it back or get it deleted.
We have tried to write this in plain English and to describe what our software actually does, rather than claim every permission a lawyer could imagine wanting.
The short version
- We collect what we need to run your account, take your payment, remember where you stopped watching, and email you about it.
- We do not sell your personal information, and we have never sold it.
- We do not share what you watch with advertisers, data brokers, or social networks. There are no advertising or analytics trackers on SteelShort — no Meta pixel, no Google Analytics, no third-party ad tags.
- We use two cookies, both necessary to sign you in. We do not use tracking cookies, which is why you are not being asked to click through a cookie banner.
- You can get a copy of your data or have your account deleted by emailing privacy@steelshort.tv.
1. What we collect
When you create an account
- Your email address.
- Your password, stored only as a bcrypt hash — we cannot read your password and neither can anyone who steals our database.
- Your display name, if you give us one.
- The date you signed up.
If you sign in with Google or Apple
- The account identifier that provider assigns you, plus the email address and name they share with us.
- A token that lets us confirm the connection.
- We do not receive your Google or Apple password, and we cannot see anything else in those accounts.
When you buy something
- A customer identifier from Stripe, our payment processor, and a record of what you bought and when.
- Your subscription's plan, status, renewal date, and whether it is set to cancel.
- Your coin balance and a ledger line for every coin that moves, so any balance can be explained.
- Which episodes you have unlocked.
- We never see or store your full card number, expiry, or security code. Those go directly to Stripe.
When you watch
- Which episode you were on and how many seconds in, so you can pick up where you left off on any device.
- Which series you have marked as favorites.
- Daily check-ins and reward claims, if you use them.
Automatically
- A session identifier, stored in a cookie on the web or held by our app on a phone, so you stay signed in.
- Product usage events — for example that a paywall was reached or a purchase screen was opened — recorded with a device identifier and, if you are signed in, your account. These stay on our own servers.
- Standard server logs kept by our hosting provider, which include IP addresses, for security and troubleshooting.
If you use our mobile app and turn on notifications
- A push token for that device, so we can send the notification. You can revoke it in your phone's settings at any time.
2. Why we collect it
| What we use it for | What it covers |
|---|---|
| Running your account | Email, password hash, name, sessions |
| Taking payment and preventing fraud | Stripe customer id, purchase history, subscription state, coin ledger |
| Delivering the thing you paid for | Unlocks, subscription tier, entitlement checks on every video request |
| Remembering your place | Watch progress, favorites |
| Talking to you about your account | Email address, notification preferences |
| Keeping the service secure | Session records, password reset records, server logs |
| Making the product better | First-party usage events |
We rely on the fact that this processing is necessary to perform our contract with you, necessary for our legitimate interests in running a secure service, or done with your consent where the law requires consent (optional marketing messages, push notifications).
3. Your viewing history
We treat what you watch as sensitive, because federal law does too — the Video Privacy Protection Act gives you specific rights over your video viewing records.
We do not disclose your viewing history to third parties for advertising, measurement, or any other purpose, and we do not permit third-party tracking technologies to observe what you watch on SteelShort.
We use your viewing history only to run the service for you: resuming playback, showing your Continue Watching row, deciding which episodes you have unlocked, and — if you have opted in — telling you when a series you were watching has a new episode.
If we ever want to share viewing information with a third party for other purposes, we will ask you for separate, express written consent beforehand, in a form distinct from this policy, and you will be able to withdraw it at any time. We will not bury that permission in a terms update.
4. Who else sees your information
We share only with companies that process data on our behalf, under contract, for the purposes below. None of them are permitted to use your information for their own marketing.
- Stripe — payments, subscriptions, and refunds. Stripe receives your email and payment details and holds them under its own privacy policy.
- Apple — in-app purchases made in our iOS app, and Sign in with Apple.
- Google — Sign in with Google, when you choose it.
- Resend — delivery of our transactional and notification emails. Receives your email address and the content of the message.
- Expo — delivery of mobile push notifications, if you enable them.
- Our hosting provider — stores the database and video files that make up the service.
We may also disclose information if the law requires it (a subpoena, court order, or lawful government request), to protect our rights or someone's safety, or to a buyer if our business is acquired — in which case we will tell you before your information becomes subject to a different policy.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We have no advertising business.
5. Cookies
We use two, and only two:
| Cookie | What it does | How long |
|---|---|---|
ss_session | Keeps you signed in. Marked HttpOnly so scripts cannot read it. | Until it expires or you sign out |
ss_oauth | Holds a short-lived security token during Google or Apple sign-in, to prevent request forgery. | A few minutes |
Both are strictly necessary to operate the service you asked for. We do not use advertising, analytics, or cross-site tracking cookies. If that ever changes, we will ask for your consent first and this table will change with it.
6. How long we keep things
- Account information — until you delete your account, then removed within 30 days.
- Purchase and coin ledger records — kept up to 7 years after the transaction, because tax and accounting rules require us to be able to account for money received. These are retained even after account deletion, reduced to what those rules require.
- Watch progress, favorites, reward claims — deleted with your account.
- Sessions — until they expire; all of them are destroyed immediately whenever you change your password.
- Password reset links — 45 minutes, and only ever as a one-way hash.
- Usage events — up to 24 months, then deleted.
- Server logs — typically 30 days.
7. Your rights
Wherever you live, you can ask us to:
- Access — get a copy of the personal information we hold about you.
- Correct — fix anything inaccurate.
- Delete — close your account and erase your data, except records we must keep (Section 6).
- Take it with you — receive your data in a portable, machine-readable format.
- Opt out — of optional marketing email and push notifications, from your account settings or any unsubscribe link.
Email privacy@steelshort.tv from the address on your account and we will respond within 45 days. We will never charge you for a request or give you worse service for making one.
If you live in California, you also have the right to know the categories of personal information we collect and disclose, the right to delete, the right to correct, and the right to opt out of sale or sharing — which requires nothing from you here, because we do not sell or share personal information. You may designate an authorized agent to make a request for you; we will ask for proof of their authority.
If you live in another U.S. state with a privacy law — Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and a growing list of others — you have substantially the same rights listed above, and the right to appeal if we refuse a request. To appeal, reply to our decision and say you are appealing; a different person will review it.
If you are in the UK or EEA, you also have the right to object to processing, to restrict it, and to lodge a complaint with your data protection authority. SteelShort is operated from the United States and your information is processed there.
8. Children
SteelShort is for adults. You must be 18 or older to have an account. We do not knowingly collect information from children. If you believe a child has given us information, write to privacy@steelshort.tv and we will delete it.
9. How we protect your information
- Passwords are hashed with bcrypt; we never store them in a readable form.
- Sign-in cookies are HttpOnly, so page scripts cannot read them.
- Resetting your password immediately signs out every device on the account, everywhere.
- Video is never served from a public folder — every request is checked against your entitlements before a single byte is sent.
- Payment card data goes straight to Stripe and never touches our servers.
- Access to production data is limited to people who need it to run the service.
No system is perfectly secure. If a breach ever affects your personal information, we will notify you and the appropriate regulators as the law requires.
10. Changes to this policy
If we make a material change, we will email you or tell you in the app at least 30 days before it takes effect. The effective date at the top always reflects the current version.
11. How to reach us
SteelShort LLC [Street address], [City], [State] [ZIP]
- Privacy questions and requests: privacy@steelshort.tv
- Everything else: support@steelshort.tv