What we hold

Without an account: a random viewer token (see cookies below) and coarse request logs. With an account: your email, handle, watch history and progress, comments and clips, for-fun points activity (Gold ledger, streaks, claims), device links and notification subscriptions. We hold no payment details — there is nothing to pay for.

One login, two controllers

Sign-in is shared with the Backinamo Vault: the credential record (your email + password hash) lives in the shared sign-in system. Bandit TV and the Vault are separate controllers of their own service data. Deleting your Bandit TV account erases Bandit TV data (below) but does not touch your Vault account — manage that at vault.backinamo.com. If you only ever used Bandit TV, our deletion process also routes the shared credential record for erasure.

Payout details you enter on Bandit TV are stored, encrypted, by the Vault and used only to pay you.

Cookies

No third-party analytics, no tracking cookies, no consent banner needed. The strictly-necessary set:

• btv_session — keeps you signed in (signed, http-only).
• btv_v — anonymous viewer token (ad frequency caps, view counts — no profile).
• btv_age — remembers you passed the 18+ gate.
• btv_theme — light/dark preference.

How long we keep things

• Raw watch heartbeats: 90 days, then only daily rollups remain.
• Live chat: 12 months.
• Ad impressions: 13 months, then only daily totals remain.
• IP addresses: salted and truncated at write; they age out with their parent rows.
• Deleted accounts: 30-day restore window, then permanent scrub (below).

Your rights

Export:Account → “Download my data” gives you the full bundle as JSON (once per day). Deletion:Account → “Delete my account” signs you out everywhere immediately and hides your profile; for 30 days signing back in offers a restore; after that the account is scrubbed — email and handle tombstoned, comments replaced with “[deleted]”, devices and notification subscriptions removed, and any live subscription is flagged for cancellation. Points-ledger and payment records are kept in pseudonymised form (severed from your identity) where we have a legal or fair-play obligation to keep them. A minimal audit log of staff actions (who moderated or changed what) is also retained for accountability, as the law allows. You can also complain to the ICO (ico.org.uk).

Processors

Supabase (database, EU), Netlify (hosting/CDN), Bunny (video delivery), Cloudflare (live streaming), Resend (transactional email). Each processes data only on our instructions.

Contact

Privacy questions or requests we haven’t automated: the contact form reaches the operator directly.