Privacy Policy

1. Who we are

SyncTV is a non-commercial web application developed as a university project. The data controller is:

2. What data we collect

SyncTV has no account or registration system. We do not collect names, email addresses, passwords, or any other personal information.

2.1 Session token (cookie)

When you visit the Service, a random, opaque identifier is generated and stored in an encrypted cookie in your browser. This token has no meaning outside the Service and cannot be linked to your identity. It is used solely to:

• Remember that you are the host of a room you created.
• Prevent duplicate video requests within a session.

2.2 Room and playlist data

• Room names and IDs are stored in our database.
• Video requests and playlist entries are stored per room and linked to your session token, not to any personal identity.
• Chat messages are in-memory only — they are not written to disk and are lost when the server restarts or the room closes.

2.3 Technical / log data

Standard server access logs may record IP addresses, request paths, and timestamps for security, error diagnosis, and abuse prevention. These logs are not retained for longer than 30 days.

2.4 Data we do NOT collect

• Names, email addresses, or any account credentials.
• Watch history or viewing habits.
• Browser fingerprints, advertising identifiers, or tracking pixels.
• Payment or financial information (the Service is free).

3. Legal basis for processing (GDPR Art. 6)

We process the limited data described above on the following bases:

• Legitimate interest — the session cookie is strictly necessary for the Service to function (room ownership, duplicate-request prevention).
• Legitimate interest — server logs for security and abuse prevention.

4. How we use your data

• To operate rooms, playlists, and real-time synchronisation.
• To detect and prevent abuse or violations of our Terms of Service.

We do not sell, rent, or share any data with third parties for marketing purposes.

5. Third-party services

SyncTV embeds videos using the YouTube IFrame API provided by Google LLC. When a video plays in your browser, YouTube may collect data about your viewing activity under their own Privacy Policy. We have no control over data collected by YouTube directly in your browser.

No other third-party analytics, advertising, or tracking services are used.

6. Data storage and security

Data is stored on servers located in Finland. We use encrypted HTTPS connections and encrypted session cookies. Despite these measures, no system is completely secure; we cannot guarantee absolute security.

7. Data retention

• Room and playlist data: retained until the room host deletes the room.
• Chat messages: in-memory only, never persisted to disk.
• Server logs: retained for up to 30 days, then deleted.
• Session cookie: expires when the browser session ends or the cookie reaches its expiry date.

8. Your rights (GDPR Art. 15–21)

Because we do not collect personal data tied to your identity, most GDPR data-subject rights (access, rectification, portability) cannot be meaningfully exercised — there is no profile to look up. However:

• Deletion — you can delete any room you created directly from the room page. This removes all associated playlist and request data.
• Objection / restriction — contact us if you have concerns about how server log data is processed.

To reach us: AH2768@student.jamk.fi. We will respond within one month as required by the GDPR.

9. Cookies

SyncTV sets a single, strictly necessary encrypted session cookie to maintain your guest session. This cookie does not track you across other sites and is not used for advertising. No cookie consent banner is displayed because no non-essential cookies are set.

10. Children's privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you have concerns, please contact us.

11. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the date of the latest revision. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Supervisory authority

You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) if you believe we have violated your data protection rights: