Yoreflix Privacy Policy
Effective: 15 October 2026 · Last updated: 15 October 2026
Yoreflix Limited ("we", "our", "us") values your privacy. This policy explains how we collect, use, disclose and safeguard your information when you use our streaming service (the "Service").
1. Who we are
Yoreflix Limited, 71–75 Shelton Street, London, WC2H 9JQ. We are the data controller for the personal data described in this policy. Contact: support@yoreflix.com.
We have not appointed a Data Protection Officer, and are not required to do so. Enquiries about this policy should be sent to the address above.
2. Information we collect
a. Account information — name, email address, account credentials and contact details. Card payments made on our website are collected and processed by Stripe Payments UK Ltd (https://stripe.com/gb/privacy). If you subscribe through the Apple App Store, Google Play, the Amazon Appstore or Roku, that store takes the payment under its own terms and privacy policy and sends us a record of the purchase: what was bought, when, and the date it is paid until. We never receive or store your card details.
b. Usage data — viewing history and preferences, device and browser information, approximate location derived from IP address, and playback and interaction events used to operate and improve the Service.
c. Communications — records of your contact with our support team and your marketing preferences.
d. Advertising data — we do not currently serve advertising and we do not collect advertising data. Section 7 describes what will change if and when we introduce an advertising-supported tier.
3. Cookies and similar technologies
We and our partners use cookies, device identifiers and browser storage as set out below.
a. Strictly necessary — always active, no consent required
These keep you signed in and the Service secure. All four are first-party, HttpOnly, Secure, Path=/, and scoped to .yoreflix.com so that they work across our subdomains. They are SameSite=Lax, except in our Samsung TV app, where the television's built-in browser needs SameSite=None to keep you signed in. They are not readable by JavaScript and are never used for advertising.
| Name | Purpose | Lifetime |
|---|---|---|
yoreflix_ik | Installation identifier — recognises this browser or device | 1 year |
yoreflix_ct | Credentials token — keeps you signed in ("remember me") | 30 days |
yoreflix_session | Session token for the current signed-in session | 8 hours |
yoreflix_rt | Request token — protects against request forgery and replay | 8 hours |
b. Preferences — browser storage, no consent required
Stored in your browser's local storage and never transmitted to us as cookies:
| Key | Purpose |
|---|---|
yf_ga_consent | Remembers your analytics choice (granted or denied) so that we do not ask again |
yf_ga_debug | Diagnostic flag, used only during development |
We also store playback preferences such as captions and resume position against your account.
c. Analytics — only with your consent
We use Google Analytics 4. Analytics storage is denied by default and nothing is set until you choose to allow it. Where you grant consent, Google sets:
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Distinguishes browsers for visit measurement | 2 years |
_ga_<id> | Retains session state | 2 years |
d. Advertising
We do not currently set advertising cookies and no advertising partner sets cookies through the Service. If we introduce an advertising-supported tier, this policy will be updated to name the cookies and identifiers involved and their lifetimes before any advertisement is served, and advertising storage will remain denied by default unless you allow it.
e. Payments
Checkout is hosted by Stripe, which sets its own cookies on its own domain under its own privacy policy (https://stripe.com/gb/privacy).
You may clear or block cookies in your browser settings. Blocking the strictly necessary cookies described in (a) will prevent sign-in.
4. How we use your information
We use your information to provide and maintain the Service; to manage subscriptions and process payments; to personalise content recommendations; to calculate the royalties we pay to film-makers; to communicate with you about your account; to detect and prevent fraud; and to comply with our legal obligations.
5. Lawful bases for processing (UK GDPR)
- Contract — providing the Service and managing your subscription.
- Consent — analytics cookies and marketing email.
- Legitimate interests — security, fraud prevention, service improvement, and calculating the royalties we pay to film-makers.
- Legal obligation — accounting, tax and regulatory compliance.
6. Sharing your information
We do not sell your personal data, and we do not share it with advertising partners. We do not currently serve advertising through the Service.
Under certain United States state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA), sharing personal information with advertising partners for targeted advertising may itself be treated as a "sale" or a "share". Should we introduce advertising, we will update this policy and provide the opt-out mechanisms those laws require before doing so.
We share data with:
- Payment processing — Stripe Payments UK Ltd, for card payments on our website.
- App stores — Apple, Google, Amazon and Roku, when you subscribe through their store: we send them the purchase reference to confirm the purchase is genuine and still current.
- Infrastructure providers — Cloudflare (content delivery, hosting and edge services), GridPane and OVH (application hosting), and Mailjet (transactional email).
- Digital rights management — Axinom, for content encoding and playback licence issuing. A licence request carries device and playback identifiers.
- Analytics — Google Analytics (website statistics, not linked to your account), and Google BigQuery, which receives app-usage events — such as signing up, starting playback, viewing the subscription page and starting a subscription — and deletes them automatically within 60 days. The record of what you watch, which we use to calculate royalties, is kept in our own database.
- Legal authorities, where required by law or in order to protect our rights.
- A successor entity, in the event of a merger or acquisition.
7. Advertising
The Service does not currently show advertisements. Our paid subscription is advertising-free.
We are preparing an advertising-supported tier. It is not offered today and no advertising data is collected, processed or shared. Before any advertisement is served we will update this policy to describe what is shared, with whom, and how to control it, and — in the United Kingdom and the EEA — we will ask for your consent through a consent management platform before any advertising cookie is set.
Where advertising is introduced, Google's use of information from sites and apps that use its services is described at https://policies.google.com/technologies/partner-sites.
The Service is intended for adults aged 18 or over (see section 12) and our applications carry 18+ store ratings. We do not direct advertising at children.
8. Your rights
Under the UK GDPR you have the right of access, and the rights to rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent.
You also have the right to lodge a complaint with the Information Commissioner's Office if you believe your data has been mishandled — https://ico.org.uk/.
To exercise any of these rights, contact support@yoreflix.com. We respond within the statutory timeframe, which is one month under the UK GDPR.
You can also delete your account yourself, in a web browser at app.yoreflix.com: choose Account from the menu, then Delete account. If you cannot reach that page, email us instead. Our page at https://yoreflix.com/delete-account explains how, and what is deleted and what is kept; section 10 summarises it.
9. Your choices and consent
- Analytics — analytics storage is denied until you allow it, and you may change that choice at any time by clearing your browser storage for this site.
- Advertising — not applicable today; see section 7. Consent and opt-out mechanisms appropriate to each territory will be in place before advertising is introduced.
- Marketing email — you may unsubscribe using the link in any marketing email, or in your account settings.
- Device controls — you may reset or limit advertising identifiers in your device or browser settings.
10. Retention
| Data | Retained for |
|---|---|
| Account and profile data | While your account is active. When you delete your account, a record of the closed account (your name, email address and the account's dates) is kept alongside the payment records, for as long as we keep those |
| Payment records | At least 6 years, to meet UK accounting and tax obligations |
| Analytics data (Google Analytics) | 14 months. Website statistics are not linked to your account |
| App-usage events (Google BigQuery) | Deleted automatically within 60 days |
| Viewing activity | While your account is active. When you delete your account, it is de-identified and kept (see below) |
| Support correspondence | 5 years |
You may request deletion of your data at any time (see section 8). Some records must be kept in order to meet legal and accounting obligations even after an account is closed.
When you delete your account. You can delete your account yourself, or ask us to by emailing support@yoreflix.com (see https://yoreflix.com/delete-account). Deletion is final: once your account has been deleted there is no way to restore it.
We delete your watch progress, your watchlist, your preferences and caption settings, your reviews and comments on Yoreflix, and the app-usage events recorded against your account, and we sign out every device signed in to your account on our website and in our current apps.
We keep:
- Viewing records, de-identified. We replace your account details on the record of what was watched and when with a coded reference. We keep these records because the royalties we pay to film-makers are calculated from them. While we keep the record of your closed account, we are able to link the two.
- A record of the closed account — your name, email address and the account's dates — kept alongside the payment records, so that a later question from a bank, a store or an accountant can be answered.
- Payment records (each subscription and store purchase, and the payment notifications the stores send us) for at least 6 years. Stripe, our card payment processor, keeps its own customer record as a payment record.
- Support correspondence for 5 years.
- An internal audit log of the actions our staff have taken on accounts.
- If you were one of our creators, your creator code record and the commission paid on it.
- Our record of each device signed in to your account (its name and a description of the browser or app). It identifies the device, not you, and is shared by anyone who signs in on it.
Our previous system. If your account began on our previous system, or you have signed in to one of our older TV apps, that system also holds a record of your account (your name, email address and password), what you watched, any reviews you wrote there, and payment and mailing-list records. Deleting your account stops it being used to sign in to those older apps, but does not erase those records, and a television already signed in to one of them may keep working until it signs out. Email support@yoreflix.com and we will erase them for you.
11. Security
We implement appropriate technical and organisational measures to protect your personal data, and data is stored in encrypted form. No method of transmission over the internet is completely secure.
12. Age of users
The Service is intended solely for adults aged 18 or over. Our applications are rated 18+ in the app stores and account holders must be at least 18. We do not knowingly collect personal information from anyone under 18, and if we learn that we have done so we will delete it.
13. Territories and international transfers
The Service is available in the United Kingdom, the United States, Canada, Australia and New Zealand.
Where data is transferred outside the United Kingdom we rely on adequacy decisions, standard contractual clauses or other appropriate safeguards. Personal data is processed in the United Kingdom and, in the case of our service providers, in other countries in which they operate.
14. Changes to this policy
We may update this policy from time to time. Material changes will be notified by posting the updated policy and revising the effective date shown above.
15. Contact
Yoreflix Limited, 71–75 Shelton Street, London, WC2H 9JQ support@yoreflix.com Information Commissioner's Office: https://ico.org.uk/