Privacy Policy

1. Controller

The controller responsible for processing personal data through Videoflix is:

2. Purpose of Videoflix

Videoflix is a non-commercial educational and portfolio project. It demonstrates the technical implementation of an authenticated video-streaming platform.

Registered users can create an account, activate it through email, log in and access the videos made available through the application.

Videoflix is not a commercial streaming service and is not affiliated with Netflix or any other commercial streaming provider.

3. Hosting and server log files

Videoflix is hosted on a Google Cloud virtual machine. When the application, API or video resources are accessed, technical information may be processed by the server.

This information may include:

• IP address
• Date and time of the request
• Requested page, API endpoint or video resource
• Browser type and browser version
• Operating system
• Referrer URL
• HTTP status code
• Technical error and security information

This processing is necessary to deliver the application and its video content, maintain technical stability, identify errors and protect the server against misuse and unauthorized access.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure, stable and reliable operation of Videoflix.

4. Registration and user accounts

The following information is processed when a user registers:

• Email address
• Password
• Password confirmation
• Internal user ID
• Account activation status
• Technical account and login information

The email address is also used internally as the username for authentication.

Passwords are not stored in plain text. They are processed and stored as password hashes through Django's authentication system.

New accounts are initially inactive. The account becomes usable only after successful activation through the activation link sent to the registered email address.

The processing is necessary to create, activate and manage the requested user account. The legal basis is Article 6(1)(b) GDPR.

5. Account activation

After registration, Videoflix sends an account activation email to the submitted email address.

The activation link contains:

• An encoded internal user identifier
• A temporary activation token

These values are required to verify the activation request and enable the corresponding user account.

The activation token becomes invalid after the account has been successfully activated or when it is otherwise no longer valid.

The legal basis is Article 6(1)(b) GDPR because account activation is required to provide the requested Videoflix account.

6. Login and authentication cookies

Videoflix uses technically necessary cookies to authenticate registered users and protect private API and video endpoints.

The following authentication cookies are used:

• access_token: Short-lived access token used to authenticate protected requests
• refresh_token: Token used to create a new access token after the previous access token has expired

The access-token cookie normally expires after approximately 15 minutes.

The refresh-token cookie normally expires after approximately 7 days.

Both authentication cookies are configured as HttpOnly. This means that they cannot be read directly through frontend JavaScript.

Refresh tokens are rotated when they are refreshed. During logout, the refresh token is blacklisted where possible and the authentication cookies are deleted.

These cookies are not used for advertising, analytics or cross-site tracking.

The legal basis for processing the authentication information is Article 6(1)(b) GDPR.

The storage of the cookies on the user's device is necessary to provide the login and authentication functions expressly requested by the user. It is therefore based on Section 25(2)(2) TDDDG.

7. Password reset

Users can request a password-reset email by submitting their email address.

For security reasons, Videoflix may provide the same general response regardless of whether an account exists for the submitted email address.

Where an active account exists, the password-reset email contains:

• An encoded internal user identifier
• A temporary password-reset token
• A link to the password-reset page

The password-reset token normally expires after 24 hours.

When a valid reset request is completed, the new password is stored as a password hash. The plain-text password is not stored.

The legal basis is Article 6(1)(b) GDPR because the processing is necessary to provide the requested account-recovery functionality.

8. Email delivery

Videoflix sends emails for the following purposes:

• Account activation
• Password reset

When real email delivery is enabled, the configured email or SMTP service provider may process:

• The recipient email address
• The sender email address
• The email subject
• The activation or password-reset message
• Technical delivery and connection information

The email is sent only to provide the authentication or account recovery function requested by the user.

The legal basis is Article 6(1)(b) GDPR.

9. Video delivery and media processing

Videos made available through Videoflix are stored and processed on the application server.

Source videos may be converted into different streaming resolutions, including:

• 480p
• 720p
• 1080p

Videoflix uses server-side FFmpeg processing to generate thumbnails, HLS manifests and individual streaming segments.

The video-processing function does not require the source video to be sent to an external artificial-intelligence service.

Access to the video list, HLS manifests and video segments is restricted to authenticated users.

When a video is streamed, the server necessarily processes the authentication cookies and technical request information needed to deliver the requested manifest and video segments.

The legal basis is Article 6(1)(b) GDPR for the requested streaming service and Article 6(1)(f) GDPR for secure technical operation.

10. Internal infrastructure

Videoflix uses technical infrastructure components including:

• PostgreSQL for account and application data
• Redis for caching and background-processing tasks
• Django RQ for queued video-processing tasks
• FFmpeg for thumbnail and HLS generation
• Nginx and Gunicorn for application delivery

These components are used to operate the application and are not used for advertising or user profiling.

11. Recipients of personal data

Personal data may be processed by the following recipient categories where necessary:

• Google Cloud as hosting and infrastructure provider
• The configured email or SMTP provider for account activation and password-reset emails
• Technical service providers used for server administration and maintenance

Personal data is not sold to third parties and is not used by Videoflix for advertising purposes.

Depending on the provider's organizational structure and service configuration, data may also be processed by affiliated companies or subprocessors outside the European Union or the European Economic Area.

Where legally required, such transfers are based on appropriate contractual or statutory safeguards.

12. Data retention

Activated user accounts are generally stored until deletion is requested, the account is otherwise removed, the project database is reset or operation of Videoflix is discontinued.

Inactive accounts may remain stored until they are activated, manually deleted, removed during a project reset or no longer required.

Authentication cookies expire according to their configured lifetime or are removed during logout:

• Access-token cookie: approximately 15 minutes
• Refresh-token cookie: approximately 7 days

Password-reset tokens normally expire after 24 hours.

Server log files are retained only for as long as they are required for security, troubleshooting and technical operation. The exact retention period may depend on the current server configuration.

Email-related technical data may be retained according to the operational and legal retention rules of the configured email provider.

13. Data security

Videoflix uses HTTPS encryption for communication between the browser and the production server.

Passwords are stored as password hashes. Authentication tokens are stored in HttpOnly cookies, and protected API and video endpoints require successful authentication.

Refresh tokens may be rotated and blacklisted to reduce the risk of continued use after logout or token replacement.

Despite these security measures, no internet-based application can guarantee absolute security.

14. Rights of data subjects

Subject to the applicable legal requirements, users have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent where processing is based on consent

Requests concerning personal data, account deletion or other data-protection rights can be sent to:

ebubekir.elicora@gmx.de

15. Right to lodge a complaint

Users have the right to lodge a complaint with a competent data protection supervisory authority if they believe that the processing of their personal data violates applicable data-protection law.

16. Automated decision-making

Videoflix does not use automated decision-making or profiling that produces legal effects or similarly significant effects for users.

17. Changes to this Privacy Policy

This Privacy Policy may be updated when the functions of Videoflix, the hosting configuration, external service providers or legal requirements change.

Last updated: August 2026