Effective August 23, 2026
This Privacy Policy describes how Steelshort LLC ("SteelShort," the "Company," "we," "us," or "our") collects, uses, discloses, and safeguards information about you when you visit steelshort.com, use our mobile applications, or otherwise access our video streaming services (collectively, the "Services"). Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.
1. Information We Collect
1.1 Information You Provide to Us
Account information. When you register for an account, we collect your email address, a password, your display name (if you choose to provide one), and the date of registration. Passwords are stored solely as a one-way cryptographic hash; we do not have the ability to view your password in readable form.
Third-party sign-in information. If you sign in using Google or Apple, we receive the stable account identifier assigned to you by that provider, together with the email address and name the provider shares with us, and a token used to confirm the connection. We do not receive your Google or Apple password, and we do not obtain access to any other content in those accounts.
Communications. If you contact us, we collect the information you choose to provide in that communication.
1.2 Payment and Transaction Information
When you make a purchase, we collect and maintain: a customer identifier assigned by our payment processor, Stripe, or by Apple for purchases made in our iOS application; records of what you purchased and when; your subscription plan, status, renewal date, and cancellation election; your virtual currency ("coin") balance, together with a ledger entry for each credit and debit; records of the episodes you have unlocked; and records of the renewal disclosures presented to you at the time of purchase. We do not collect, receive, or store full payment card numbers, expiration dates, or security codes. Payment card information is provided directly to Stripe or Apple and is governed by their respective privacy policies.
1.3 Viewing Information
In order to operate the Services, we maintain records of the episodes you watch and your playback position within them; the series you have saved to your list; and your daily check-ins and reward claims, if you use those features. Viewing information receives the specific protections described in Section 3.
1.4 Information Collected Automatically
Session identifiers. A session identifier, stored in a cookie on the web or held by our mobile application on your device, keeps you signed in.
Usage data. We record first-party product usage events, such as the screens you open, and, for playback and paywall events, the series and episode concerned, together with a device identifier and, if you are signed in, your account identifier. These records are collected and stored exclusively on our own systems, are treated as viewing records under Section 3, and are automatically deleted after twenty-four (24) months.
Push notification tokens. If you enable notifications in our mobile application, we collect a push token for that device. You may revoke notification permission at any time in your device settings.
Server logs. Our hosting infrastructure maintains standard server logs, which include IP addresses, for security, fraud prevention, and troubleshooting purposes.
2. How We Use Information
We use the information described in Section 1 for the following purposes:
- to create, maintain, secure, and authenticate your account;
- to process payments, deliver purchased content and subscriptions, maintain accurate balances and entitlements, and prevent fraud and abuse;
- to remember your playback position and preferences across devices;
- to communicate with you about your account, your purchases, and, subject to your opt-out rights, new content and features;
- to comply with legal obligations, including tax, accounting, and consumer-protection requirements;
- to monitor, analyze, and improve the performance, reliability, and content of the Services using first-party usage data.
Where the law of your jurisdiction so requires, we process personal information on the following legal bases: performance of our contract with you; our legitimate interests in operating, securing, and improving the Services; compliance with legal obligations; and your consent, where consent is required (including for optional marketing communications and push notifications).
3. Video Viewing Information
We treat records of the video content you request or obtain as sensitive information, consistent with the federal Video Privacy Protection Act and analogous state laws.
We do not disclose your video viewing information to third parties for advertising, marketing, measurement, or analytics purposes, and we do not permit third-party tracking technologies to operate on any surface of the Services where video is selected or viewed.
We use viewing information solely to provide the Services to you: resuming playback, displaying your viewing history and continue-watching functionality, determining your entitlements, and — if you have not opted out — notifying you of new episodes of series you watch.
If we ever propose to disclose your viewing information to any third party for any purpose not described above, we will first obtain your separate, informed, express written consent, in a form distinct from this Privacy Policy, and you will be able to withdraw that consent at any time. We will not seek such consent through a general update to this Privacy Policy or our Terms of Service.
4. How We Disclose Information
We disclose personal information only as described below.
Service providers. We disclose information to vendors that process it on our behalf, under contractual obligations of confidentiality and limited use, solely to provide services to us. None of these providers is permitted to use your information for its own marketing purposes. Our service providers are:
- Stripe, Inc. — payment processing, subscription billing, and refunds;
- Apple Inc. — in-app purchases in our iOS application and Sign in with Apple;
- Google LLC — Sign in with Google, where you elect to use it;
- Resend — delivery of transactional and notification email;
- Expo — delivery of mobile push notifications, where you have enabled them;
- our hosting provider — infrastructure on which the Services, including our databases and video content, are stored and operated.
Legal process and protection. We may disclose information if we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other legal process, or is reasonably necessary to protect the rights, property, or safety of the Company, our users, or others.
Corporate transactions. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, information may be transferred to the successor entity. We will notify you before your personal information becomes subject to a materially different privacy policy.
No sale or sharing. We do not sell personal information, and we have never sold it. We do not share personal information for cross-context behavioral advertising. We operate no advertising business.
5. Cookies and Similar Technologies
The Services use two cookies, each of which is strictly necessary to provide functionality you request:
| Cookie | Purpose | Duration |
|---|---|---|
ss_session | Authenticates your session and keeps you signed in. Marked HttpOnly. | Until expiration or sign-out |
ss_oauth | Holds a short-lived security token during third-party sign-in to prevent request forgery. | Approximately ten minutes |
We do not use advertising, analytics, or cross-site tracking cookies, and no third party sets cookies through the Services. Should this ever change, we will obtain any legally required consent before deployment and will update this section.
6. Data Retention
We retain personal information for the periods stated below, after which it is deleted:
- Account information — for the life of your account, and removed within thirty (30) days of account deletion;
- Purchase records and the coin ledger — up to seven (7) years following the transaction, as required for tax, accounting, and financial reporting purposes; upon account deletion these records are reduced to what those obligations require;
- Viewing information, saved series, and reward activity — deleted upon account deletion;
- Usage events — a maximum of twenty-four (24) months, and deleted upon account deletion;
- Sessions — until expiration; all sessions are revoked immediately upon any password change;
- Password reset records — forty-five (45) minutes, stored only as a one-way hash;
- Server logs — typically thirty (30) days.
7. Your Rights and Choices
7.1 Rights Available to All Users
Regardless of where you reside, you may: (a) access a copy of the personal information we hold about you, including through the self-service export available on your Account page; (b) correct inaccurate information; (c) delete your account and associated personal information from your Account page or within the mobile application, subject to the retention obligations in Section 6; (d) receive your information in a portable, machine-readable format; and (e) opt out of marketing email and push notifications through your account settings or the unsubscribe mechanism included in every marketing email.
To exercise any right, you may also email privacy@steelshort.com from the email address associated with your account. We will respond within forty-five (45) days. We will not charge a fee for, or discriminate against you in response to, the exercise of any privacy right.
7.2 California Residents
If you are a California resident, the California Consumer Privacy Act, as amended, provides you the rights to know, delete, correct, and opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information. Because we do not sell or share personal information as those terms are defined by the CCPA, and use sensitive personal information only to provide the Services, no action is required to exercise the opt-out and limitation rights. You may designate an authorized agent to submit requests on your behalf; we will require reasonable proof of the agent's authority.
7.3 Residents of Other U.S. States
If you reside in a state with a comprehensive consumer privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana), you have substantially the rights described in Section 7.1, together with the right to appeal a refusal of a request. To appeal, reply to our decision stating that you are appealing, and a person not involved in the original decision will review it.
7.4 United Kingdom and European Economic Area
The Services are operated from the United States, are directed to a United States audience, and are not currently offered in the United Kingdom or the European Economic Area; our mobile application is distributed on United States storefronts, and we do not target, advertise to, or monitor the behavior of individuals in those regions. If you nevertheless access the Services from those regions, you do so on your own initiative, and your information will be processed in the United States. You have the rights described in Section 7.1, together with the rights to object to and restrict processing and to lodge a complaint with your supervisory authority, and requests submitted to privacy@steelshort.com will be honored.
8. Children's Privacy
The Services are intended for adults. You must be at least 18 years of age to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information to us, contact privacy@steelshort.com and we will delete it.
9. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including: storage of passwords exclusively as salted one-way hashes; storage of session credentials as cryptographic hashes; HttpOnly session cookies inaccessible to page scripts; immediate revocation of all sessions upon password change; entitlement verification on every video request, with no video served from publicly accessible storage; transmission of payment card data directly to our payment processors without transiting our servers; and access to production systems limited to personnel who require it to operate the Services. No security program is infallible; in the event of a breach affecting your personal information, we will notify you and the appropriate regulators as required by applicable law.
10. International Processing
The Services are hosted and operated in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your jurisdiction.
11. Changes to This Privacy Policy
We may amend this Privacy Policy from time to time. If we make a material change, we will notify you by email or through the Services at least thirty (30) days before the change takes effect. The effective date at the top of this Privacy Policy reflects the current version. Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acknowledgment of the revised policy.
12. Contact Us
Steelshort LLC 2108 N St Ste N, Sacramento, CA 95816
- Privacy questions and requests: privacy@steelshort.com
- All other inquiries: support@steelshort.com