Skip to content
Can’t decide what to watch? Ask Alvin AI (Alvin’s AI STUDIO. 3D STUDIO. VIDEO STUDIO.)

Privacy Policy

Last updated: October 4, 2026 · Controller: Alvin AI Lab · privacy@alvinailab.com

1. Data we collect

  • Account: full name, email, phone, and a bcrypt password hash (we never store plaintext passwords). For Google/GitHub sign-in we store the provider account ID, name and avatar URL.
  • Verification: one-time codes are stored only as SHA-256 hashes and expire after 10 minutes.
  • Service use: trailers you played and your list (signed-in users only; visitors can watch without an account).
  • Past payments: for supporter passes bought before AlvinFlix became free: plan, amount, status, the email you paid with, UddoktaPay invoice ID and payment method. Card and wallet credentials were handled by UddoktaPay and never reached our servers.
  • Technical: IP address, user-agent and rate-limit counters for security and abuse prevention.

2. Why we use it

  • To provide trailers, personalised lists and support (contract).
  • To secure the service and prevent fraud (legitimate interest).
  • To keep tax and payment records (legal obligation).

3. Sharing

We use processors only: hosting, email delivery, UddoktaPay (past payments only), and YouTube (via privacy-enhanced youtube-nocookie.com embeds), which receives standard request data when you press play on a trailer. Clicking a “where to watch” link takes you to that third-party service and its own privacy policy. We do not sell personal data and run no advertising trackers.

4. Retention

  • Account, list and history: until you delete your account.
  • Payment records: up to 7 years where the law requires, including after account deletion (the record is detached from your profile and keeps only the payment email).
  • Logs: 90 days rolling.

5. Your rights

You can access, correct or delete your data from Account settings or by emailing privacy@alvinailab.com. We respond within 30 days. Depending on where you live (GDPR, CCPA), you may also object, restrict processing or complain to a regulator.

6. Security

TLS in transit, bcrypt password hashing, signed session tokens in HttpOnly SameSite=Strict cookies, same-origin checks on account APIs, rate limiting, and server-side payment verification.

7. Children

AlvinFlix is not directed to children under 13.