privacy policy

Last updated: 2026-10-16

what we collect

Account data — handle, hashed password, email address (hashed verification tokens, not plaintext). For creators: identity-verification outcome from our third-party verifier (name, date of birth, document-type), stored only as a yes/no pass flag plus the verifier's reference ID.

Browser identity — a random id stored in an HttpOnly cookie (gid) so your uploads, likes, comments, playlists, history, and watch-later follow this browser even without an account. If you sign up, this id becomes your account's id.

Usage analytics — page views, counted video views, watch time, device/browser/OS, approximate country (from IP, not stored). Visitors are a one-way hash of the gid; raw IPs are discarded after country lookup.

Content you upload — the video file, title, description, tags, categories, captions, and any performer-consent documentation you submit.

what we do with it

Operate the Service: serve videos, personalise feeds, let you resume history, count views, prevent abuse. Perform legal obligations: 2257 recordkeeping, DMCA responses, law-enforcement requests. We do not sell personal data.

cookies

gid — HttpOnly browser identity (12 months). gsess — HttpOnly sign-in session token (12 months). gch — your channel handle (12 months). age_ok — age-gate acknowledgment (12 months). No third-party tracking cookies.

third parties

Identity verification is performed by Didit (their privacy policy). We send them your submitted ID + liveness capture; they return a pass/fail decision + session ID. Hosting + CDN runs on our own servers; no third-party CDN is in the path by default.

your rights (GDPR / UK GDPR / CCPA)

You may request: access to your data, correction, deletion, export, or restriction of processing. Email legal@grape.hot. Deletion of 2257 documentation is restricted by law — see our 2257 statement.

retention

Account data: until you delete the account, plus 90 days for abuse-recovery. 2257 records: 7 years after the content is removed, per US law. Analytics: raw hits for 90 days, aggregates indefinitely. Reports: indefinitely (audit trail).

security

Passwords stored as scrypt hashes; session tokens stored as hashes (not plaintext); all traffic over HTTPS. Breach notification per applicable law.

contact

Email legal@grape.hot for any privacy inquiry.