Privacy Policy

This page explains what data we collect, why, where it lives, and what your rights are. If anything is unclear, reach us via our contact page.

1. What we collect

We collect only the minimum needed to provide the service:

• Account info - email address and a hashed password (see section 2). Required to save your processed videos and vocabulary.
• Content you process - the YouTube URLs you submit, the resulting study documents (PDF, Word, flashcards, Anki CSV), and the vocabulary added to your library.
• Usage info - basic logs of your activity (which routes you hit, processing job timestamps) to help us debug and prevent abuse.
• Cookies - a single session cookie used to keep you logged in. No third-party tracking, no analytics cookies.
• Feedback you submit - ratings, free-text messages, and the email you optionally provide so we can reply.

2. Passwords

We never store your password in readable form. We use industry-standard bcrypt hashing with a unique random salt per user. This means:

• Even our team cannot retrieve your password - only reset it.
• If our database were ever exposed, your password could not be recovered from the stored hash by any practical means.
• Forgot your password? Use the reset link on the sign-in page. We email you a one-time link valid for 1 hour. Once you set a new password, the old hash is overwritten.

Your password is never logged, never sent in email, and never shared with any third party.

3. Where data is processed

To deliver the service we send some of your content to third-party providers. Each has its own privacy policy and terms - we use them under their data-processing agreements.

• AI language-model provider (USA) - receives the YouTube transcript text to generate vocabulary, summaries, and definitions. Under our agreement, prompts and responses are not used to train their models.
• Transcript provider (UK/EU) - fetches the YouTube transcript on our behalf using your submitted URL.
• File-storage provider - stores the generated PDFs, Word docs, flashcards, and CSV files so you can re-download from anywhere.
• Email provider (USA/EU) - sends transactional emails (welcome, password reset, vocabulary-share notifications). Email content is not retained beyond delivery.
• Hosting provider - hosts the application servers and the PostgreSQL database holding your account.
• Payment provider (USA/EU) - processes aftertape+ subscription payments. We never see or store your full card details; payment is handled on the provider's hosted checkout. We store only a customer reference and your subscription status.

We do not sell or share your data with anyone outside of the providers above. The specific providers we use may change as the service evolves; we will keep this list current. You may request the names of our current sub-processors at any time via our contact page.

3a. Where your data is stored

Aftertape is operated from Switzerland, but no user data is stored there. Specifically:

• Your account, video history and vocabulary library are held in a PostgreSQL database hosted in the United States.
• The documents we generate (PDF, Word, flashcards, Anki CSV) are held in object storage operated by a provider with data centres in the United States and the European Union.
• Video transcripts are never stored anywhere. A transcript exists only in memory while your job runs and is discarded when it finishes. It is sent to our AI provider to produce your vocabulary, summary and questions, and is not retained by us afterwards.

This means your personal data is transferred outside Switzerland and the EEA. These transfers are made under the European Commission's Standard Contractual Clauses and the equivalent recognition under Swiss data protection law, as provided for in our agreements with each provider. You may ask us for details of the safeguards for any specific transfer via our contact page.

4. How long we keep your data

• Account data - kept while your account is active.
• Processed videos and vocabulary - kept while your account is active. Deleted entries are removed immediately from the database; backup copies may persist for up to 30 days.
• Generated documents - the PDF, Word, flashcard and CSV files stay in storage so you can re-download them. They are deleted when you delete your account (see below).
• Transcripts - never stored. Discarded as soon as your job finishes (see section 3a).
• Usage logs - automatically rotated and discarded within 30 days.
• If you delete your account, your account row and everything linked to it - history, vocabulary library, followed channels, shared packs - is deleted from the database immediately. The documents generated for your videos are deleted from storage at the same time. Encrypted backups held by our hosting provider are rotated out within 30 days, after which no copy remains.

5. Your rights

If you live in the EU, EEA, UK, or Switzerland, GDPR (and equivalents) gives you the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your vocabulary library and video history. Every study document we generate - PDF, Word and flashcards - is downloadable at the moment it is created and re-downloadable from your history, on any plan. If you would also like your library as a plain CSV file, ask us via the contact page and we will send it free of charge.
• Object to certain types of processing.
• Withdraw consent at any time. We send transactional email (password resets, subscription notices, and - if you follow channels on a paid plan - your new-video digest). If you redeem an access code we may also write to you about that code and the access it gives, as set out in our terms; tell us via the contact page and we will stop.

To exercise any of these rights, reach us via our contact page. We respond within 30 days.

6. Cookies

We use a single essential cookie called session to keep you logged in across page loads (90-day duration). This cookie is required for the service to work and is exempt from cookie-consent requirements under EU law. We do not use third-party analytics, advertising, or tracking cookies.

7. Children

Aftertape is not intended for users under 16 in the EU, or under 13 elsewhere. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove the account.

8. Security

We take reasonable steps to protect your data, including:

• HTTPS everywhere - all traffic between your browser and our servers is encrypted.
• Bcrypt-hashed passwords with per-user salts (see section 2).
• Rate limiting to prevent brute-force login attempts.
• Standard security headers (CSP, HSTS, X-Frame-Options) on every response.
• Database backups encrypted at rest by our hosting provider.

No system is 100% secure. If you suspect a breach affecting your account, change your password immediately and email us.

9. Changes to this policy

If we make material changes to how we handle your data, we'll update this page and notify registered users by email at least 14 days before the changes take effect. The "Last updated" date at the top of the page always reflects the most recent revision.

10. Contact

Questions, complaints, or data requests: reach us via our contact page.

See also our Terms of Service.