Privacy Policy

This policy explains what CineCouncil (“we”, “us”) collects when you use cinecouncil.io and the CineCouncil app, why, who it is shared with, how long it is kept, and how you can see, correct or delete it. It describes what the service actually does — nothing more.

On this page:

• What we collect
• How we use it
• Cookies
• Who we share it with
• Where it is stored and how long we keep it
• Your rights
• Deleting your data
• Children
• Contact and grievances

What we collect

Your account. Depending on how you sign up, we store:

• your display name;
• your email address, if you sign up with one — together with your password, which is never stored in plain text: it is put through scrypt, a one-way hash, and only the hash is kept;
• your mobile number, if you sign in with it. We send a one-time code to that number by SMS or WhatsApp; we keep only a hash of the code, and only until it is used or expires a few minutes later;
• if you choose Continue with Google: the name and email address Google shares with us, and the identifier Google issues for your Google account;
• if you choose Continue with Facebook: your name, your email address (only if your Facebook account has one and you allow it), and an identifier Facebook issues for CineCouncil alone (an app-scoped ID). We do not receive your Facebook password, friends, photos or posts, and we never post to Facebook;
• your account role (viewer or creator) and, if you have asked for creator access, that request and its status.

Accounts created with a mobile number, Google or Facebook have no password. If you arrive from one of our links (for example an advertisement) and create an account with Facebook, we record which campaign the link named (its utm_ tags, such as “facebook” and a campaign name) — never anything about you from the site you came from.

What you watch. We record your position in each episode you start, so Continue watching can pick up where you left off. That record is tied to your account and the episode, and nothing else. Separately, for each episode we keep an anonymous count of how many viewing sessions reached each minute of its runtime — with no user, session or time attached, so it cannot be traced back to anyone. That is how we measure completion and drop-off.

Payments. When you pay, the payment itself is taken by our payment provider (PayU or Razorpay) on their own pages; we never see or store your card, UPI or bank details. We send them your name, email address and mobile number, the amount and what it is for, and we keep a record of the transaction — its amount, status, reference numbers and what it unlocked.

Requests you send us. If you file a takedown (rights) request, we keep your name, email address and what you tell us about the claim. If you ask for creator access, we keep that request.

The app. If you allow notifications in the CineCouncil app, we store the notification token your phone gives us and whether it is Android or iOS, so we can send notifications to that device. It is replaced when someone else signs in on the same phone.

Technical data. To keep the service secure and working, our servers see your IP address and browser details with every request. We use your IP address briefly to limit abusive traffic (for example repeated sign-in attempts) and in security and error logs. Each request is given a random reference number so a problem can be traced; we do not log passwords, codes, tokens or payment details.

Our teaser site. The teaser site at cinecouncil.ai has no accounts. There we record the visit itself — which sections you scrolled to, whether and how far you played the trailer, roughly how long you stayed, your browser language, time zone and window width, and the host name of the site that linked you (never the full address). It sets no cookie; visits are grouped by a random id that lives only in your browser tab, and your IP address is never stored — only a salted hash of it, used to tell one person reloading the page from several visitors.

How we use it

• to create your account, sign you in and keep you signed in;
• to stream the series and episodes you choose, and remember where you stopped;
• to take payments and give you what you paid for;
• to send sign-in codes and, if you allow them, app notifications;
• to answer requests you send us, including takedown and creator requests;
• to keep the service secure, prevent abuse, and fix problems;
• to understand, in aggregate, which titles are watched and finished, and which of our links bring people to the service;
• to meet our legal, tax and accounting obligations.

We process your data because you asked us to provide the service, because you consented (for example to Facebook or Google sign-in, or notifications), or because the law requires it. We do not sell your data, we do not show advertising on the platform, and we do not use third-party analytics, tracking pixels or ad-tech on it.

Cookies

We set only the cookies the service needs to work:

• cc_session — keeps you signed in. It holds a random token, not your identity; it lasts until you sign out or for up to 30 days.
• cc_experience_visit — remembers, for this visit only, that you have already been through the opening experience. It is deleted when you close your browser.
• a short-lived sign-in check cookie, set only when you choose Continue with Facebook, which protects that sign-in from being forged. It lasts at most 10 minutes.

These cookies are not readable by page scripts and are not used for analytics or advertising. There are no third-party cookies.

Who we share it with

We share data only with the companies that run parts of the service for us, and only what each one needs:

• Microsoft Azure — hosts our servers and database, in India.
• Cloudflare (Cloudflare Stream) — stores and delivers the video. Your device connects to Cloudflare to play it.
• PayU and Razorpay — take payments, as described above, under their own privacy policies.
• Twilio — delivers sign-in codes to your mobile number by SMS or WhatsApp.
• Google and Meta (Facebook) — only if you choose to sign in with them, to confirm who you are.
• Google Fonts — our pages load their typefaces from Google’s servers, so your browser’s IP address reaches Google when a page loads.

We may also disclose information where the law requires it, for example to comply with a valid legal order.

Where it is stored and how long we keep it

Our servers and database are in India. Video is delivered through Cloudflare’s worldwide network, and our payment and messaging providers may process data in other countries under their own safeguards.

• Your account and watch history — until you delete your account.
• Sign-in sessions — until you sign out, or 30 days.
• One-time sign-in codes — minutes, until used or expired (only a hash).
• IP addresses used to limit abuse — deleted within 24 hours.
• Payment records — kept as long as tax and accounting law requires, even after you delete your account; they are then no longer linked to you.
• Backups — encrypted database backups are deleted automatically after about 35 days, so deleted data leaves them within that time.

We protect your data with encryption in transit (HTTPS), one-way hashing of passwords and codes, access limited to the people who run the service, and regular security review. No system is perfectly secure, and we will tell you and the authorities if a breach affects you, as the law requires.

Your rights

Under India’s Digital Personal Data Protection Act, 2023 and other applicable law, you can:

• ask what personal data we hold about you and how we use it;
• correct it — you can change your display name yourself on your Account page;
• have it deleted (see below);
• withdraw consent — for example, disconnect Facebook or Google from your Account page, or turn off notifications on your phone;
• raise a grievance with us, and if you are not satisfied, with the Data Protection Board of India;
• nominate someone to exercise these rights for you if you cannot.

To exercise any of these, write to privacy@cinecouncil.io. We will confirm the request is yours before acting on it.

Deleting your data

You can delete your account, and the personal data tied to it, at any time. Nobody needs to approve it and we do not ask why.

In the CineCouncil app: open Account → Delete account. To make sure it is really you, the app asks you to confirm with your password, a new code sent to your mobile number, or your Google account — whichever you signed up with. Deletion happens immediately.

On the website, or if you signed in with Facebook: write to privacy@cinecouncil.io with the subject “Delete my account”. Send it from the email address on your account; if your account has no email (for example you signed in with Facebook or a mobile number), tell us the name on the account and how you signed in, and we will confirm it is you through that sign-in method. We act on confirmed requests within 30 days and reply when it is done.

Deleting your account permanently removes:

• your profile — name, email address, mobile number and password hash;
• your sign-in sessions and app notification tokens;
• your watch history and saved positions;
• everything we received from Facebook or Google sign-in — your name, email address and the Facebook or Google identifier.

What survives is the record of money: payment, purchase and subscription records are kept because tax and accounting law requires it, with your identity detached so they are no longer linked to you. The anonymous per-minute viewing counts were never linked to you.

To stop using Facebook to sign in without deleting your account, choose Disconnect next to Facebook under Sign-in methods on your Account page. That deletes the link, including the stored Facebook identifier. You can also remove CineCouncil in Facebook under Settings & privacy → Settings → Apps and websites; if you do, email us as above and we will delete the data we received from Facebook.

Children

CineCouncil is not directed at children under 18, and you should not create an account if you are under 18 without the consent of a parent or lawful guardian. If you believe a child has given us personal data without that consent, write to privacy@cinecouncil.io and we will delete it.

Changes to this policy

If we change how we handle your data, we will update this page and the date at the top. If a change is significant, we will also tell you in the service before it takes effect.

Contact and grievances

For any privacy question, request or complaint, contact our Grievance Officer at privacy@cinecouncil.io. We acknowledge grievances promptly and aim to resolve them within 30 days.

If you believe content on the platform infringes your rights, file a takedown request.