Legal
Privacy Policy
Last updated: 23 September 2026
Who we are. SHOXA is the controller of the personal data described here. Use the privacy request form, which reaches us whether or not an address is published. Privacy requests do not go through the copyright form.
What we collect, why, and for how long
| Data | Source | Purpose | Shared with | Retention |
|---|---|---|---|---|
| Email, password credential, display name, username, avatar, bio, links, country | You | Running your account | Supabase | Deleted when you delete your account |
| Films, titles, synopses, artwork, credits, tool tags | Creators | Publishing the film | Supabase, Bunny Stream | While published; deleted with the film |
| Terms and rights-declaration acceptances, with wording, version, timestamp, IP and user agent | Sign-up and submission | Evidence of what was agreed | Supabase | Kept while the account or film exists, and afterwards only as evidence of a past agreement |
| Exclusivity agreements, with IP and user agent | Submission | Evidence of the agreed commitment | Supabase | Kept as evidence of the agreement |
| Likes, My List, follows, watch progress | Your actions | Continue Watching, My List, follows | Supabase | Deleted when you delete your account |
| Views: watch seconds, completion, country, device, referrer, browser id | Playback | Creator analytics, ranking | Supabase | Personal identifiers deleted with your account; aggregate counts remain |
| Product events: page views, plays, shares, sign-ups, uploads | The analytics id, only after you accept | Understanding how the site is used | Supabase | Deleted with your account |
| Taste profile: genre, tool and creator affinity | Computed from your viewing | Recommendations | Supabase | Deleted with your account |
| Tool link clicks | Clicking a partner link | Measuring interest; some links are affiliate links | Supabase | Deleted with your account |
| Copyright notices, counter-notices and reports, with name, email, address, phone | The forms | Handling the complaint; repeat-infringer records | Supabase; substance shared with the affected uploader | Kept as a record of the complaint and its outcome |
| Privacy requests | The form | Handling and evidencing your request | Supabase | Kept as a record that we answered |
| Newsletter email and consent record | You, if you opt in | The newsletter you asked for | Supabase, Resend | Until you unsubscribe, then a suppression record |
| Error reports | Automatic on failure | Fixing faults | Lovable | Held by Lovable |
Where a retention period is not fixed above, the criterion governs instead: we keep the record while it still serves the purpose it was collected for, and then delete it. Deleted rows can persist briefly in our providers' backups.
You can browse without an account. An account is needed to like, follow, save, sync progress or submit a film; without an email address we cannot create one. The newsletter is optional and nothing depends on it.
Legal bases
(where EU or UK law applies): contract for your account and publishing films; consent for the newsletter and for analytics; legitimate interests for security, fraud prevention, handling complaints and improving the service; legal obligation where we must keep or disclose something.
Who processes data for us.
Lovable (hosting, error reporting) · Supabase (database, authentication, file storage) · Bunny Stream (hosting and playback of creator uploads) · Resend (email) · Google, through Lovable's AI gateway, for generating film descriptions and artwork. We do not sell personal data and there is no advertising tracker on the site.
YouTube.
SHOXA uses YouTube API Services to find and present curated films. Curated films play through YouTube's official embedded player, which is not loaded at all until you accept below or deliberately press play. Once it loads, YouTube and Google receive your IP address and information about your browser, under their own terms. See the Google Privacy Policy and the YouTube Terms of Service, which you agree to be bound by when you use those parts of SHOXA.
Fonts.
Our fonts are served from our own servers. Nothing is requested from Google Fonts.
AI processing of films.
When a film is published, a small number of still frames and the creator's own title and synopsis are sent to a Google Gemini model for automated analysis. This happens once per film; the film file itself is never sent. We do not use films, frames or descriptions to train any AI model of our own, and we do not sell or share them for advertising. These requests are processed by Lovable, which routes them to Google. Our platform provider reserves the right under its own terms to use content processed through its AI service to train and improve its models. Google's handling is governed by its Gemini API terms; for paid API use Google states it does not use prompts or responses to improve its products. We rely on our platform provider's arrangement with Google and cannot independently verify which tier is used.
Recommendations.
We build a taste profile from what you watch and use it to order the rails you see. It has no legal or similarly significant effect, and you can ask us to delete it.
Cookies and browser storage.
Two things only:
- Necessary — your sign-in session and settings you choose. The site cannot work without these.
- Analytics — a random id (shoxa-session-id) linking your page views and plays. It identifies a browser, not a person, and it is not created until you accept. Decline, and nothing is stored, no events are recorded, and no embedded YouTube player is loaded until you press play yourself. You can change your mind, or withdraw, in Account settings; withdrawing deletes the id.
International transfers.
Our providers process data outside your country, including in the United States.
Your rights.
Depending on where you live you may ask for access, correction, deletion, a copy, restriction, objection, and you may withdraw consent at any time. Use the privacy request form. We may ask you to confirm your identity from the account's email address, and we aim to answer within 30 days. In the EU or UK you may also complain to your national data protection authority.
You can delete your account yourself in Account settings. It tells you exactly what is deleted and what is kept before you confirm.
Security.
Access control, encryption in transit, row-level database permissions, restricted administrator access, and complaint records readable only by staff. No service can promise perfect security and we do not.
Children.
SHOXA is not for under-13s and we do not knowingly collect their data. If you believe a child under 13 has given us personal data, use the privacy request form and we will delete it.
Marketing.
The newsletter is opt-in, separate from creating an account, and confirmed by a link we email you — nothing is sent until you click it. Every email carries an unsubscribe link.
Changes.
This page carries a fixed date. Material changes will be dated and notified on the site before they take effect.