Privacy Policy

We store the minimum needed to bill you and give you access: your email, your Plex username, and a record of your subscription. We never see your card number and we never see your Plex password. We do not sell anything to anybody.

• Your email address, and a display name if you set one.
• Your password, hashed. Sign-in is handled by Supabase, our authentication provider. Your password is hashed on their servers with a modern algorithm and cannot be read back — by us, by them, or by anyone who obtained either database.
• Your Plex username, email and user id, once you link an account, so we know who to share the libraries with.
• Stripe identifiers for your customer and subscription, plus a copy of your plan, its price, and its renewal date.
• Sessions, including the IP address and browser you signed in from, so you can see and end them.
• An activity log of things that changed your access: subscribing, changing plan, cancelling, linking Plex, being granted or losing access.
• Streaming activitywhile you watch, limited to what is needed to enforce your plan's simultaneous stream limit.

• Your card details.Payment happens inside Stripe's own form. Card numbers never reach our servers. We only ever see the brand, last four digits and expiry.
• Your Plex password.Linking uses Plex's own code flow, so you type your password at plex.tv and never here.
• Your Plex token. It is read once during linking, purely to learn your username, and then discarded.

Stripe handles payments and holds your billing details under their own privacy policy.

Supabase hosts our database and handles sign-in. Your email address and hashed password sit on their servers, under their own privacy policy.

Plex receives your Plex account identifier so the libraries can be shared with you, which is how their sharing works.

Nobody else. We do not sell, rent, or share your information with advertisers or data brokers, and there is no third-party analytics or tracking on this site.

Your account details for as long as you have an account. Delete your account and the record is removed: your subscription is cancelled, your Plex access is revoked, and your row is deleted.

Two things outlive that on purpose. The activity log keeps a record that an action happened, with your email attached, because a log that disappears when an account does cannot answer questions about billing disputes. Stripe keeps its own payment records for as long as their financial and tax obligations require.

You can update your name and username, change your email or password, and delete your account entirely from your settings page. The full list of what we hold is the "What we store" section above — nothing is hidden. If you want a copy of your data or want something corrected, ask and we will do it.

A handful of cookies, all necessary for the site to work — none for advertising or tracking:

• Sign-in cookies, set by Supabase when you sign in and refreshed as you use the site. They tell the server it is you.
• A short-lived Plex-linking cookie during the few minutes it takes to link your Plex account, cleared as soon as the flow finishes.
• A theme preference if you switch between light and dark mode, so the site remembers your choice on your next visit.

Questions about your data: support@getcinevault.com