Privacy Policy

1. Scope

This Privacy Policy applies to the N Chill Party website, accounts, invitations, payment features, browser extension, and mobile applications (together, the “Service”). It explains what we handle when you use the Service and the choices available to you.

2. Information we collect

Account and sign-in information

When you create an account, we collect your username and email address. If you use email sign-in, we store a one-way password hash, not your plain-text password. We also create account identifiers, revocable session records, email-verification status, subscription status, and account timestamps.

Social sign-in

If you choose Google, Facebook, or Instagram sign-in, that provider may give us your provider account identifier, public profile information, and email address where available. The provider also receives information about your request to sign in. Its own privacy policy applies to its processing.

Friends, invitations, and parties

We process friend requests, accepted connections, availability, party invitations, room identifiers, room names, and whether you are hosting or participating. A shared friend or party link contains a signed, expiring invitation token.

Streaming synchronization

While you actively use the extension for a party, it reads the URL of the supported streaming page you selected and the video’s play, pause, seek, playback-time, and commercial/interstitial state. It sends that state through our signaling service to synchronize invited participants and may identify which party participant is temporarily in a commercial so the room can wait. We do not use this feature to build a general browsing history or monitor unrelated pages. The extension does not read or store usernames, passwords, cookies, or session credentials belonging to Netflix, Hulu, YouTube, Apple TV+, or another streaming service.

Camera, microphone, and communications

The extension asks your browser for camera and microphone access only when you start or join a party. Audio and video are transmitted to the other party participants using encrypted WebRTC connections. If a direct connection cannot be established, an encrypted stream may pass through a TURN relay. N Chill Party does not record or intentionally store the contents of your calls.

Party text chat

Messages you send in a party are shared with its current participants through our encrypted signaling connection. The server retains only the latest 100 messages in temporary memory while the room exists, so reconnecting participants can catch up. Messages are discarded when the room ends or the server restarts. We do not save party chat in the database, local browser storage, account exports, or backups. Your local chat view is cleared when you leave or sign out.

Support requests

When you contact support, we collect your email address, category, subject, message, ticket status, and—if signed in—account identifier. We retain a one-way keyed hash of the submitting IP address and limited browser information for abuse prevention and troubleshooting; the hash is not used to recover the address.

Reports sent from the extension use your account email and may include the streaming hostname, extension version, issue type, frequency, and connection state. During companion use, observed player and synchronization failures are reported automatically using fixed error codes, hostname, and version. Repeated failures are grouped; these reports do not establish that the extension caused the failure. You can disable automatic reporting in the companion. Firefox also requires optional technical-data consent. Authorized support staff can categorize, prioritize, assign, reply, and add internal notes to requests. Customer conversations are available in the support portal; internal notes are only visible to support staff. Reply notifications are sent through our email provider, and guest reply links expire after 30 days. Reports do not include streaming credentials, full page URLs, raw console logs, or call recordings.

Local browser storage

The website keeps a short-lived access credential in tab-scoped session storage and a rotating portal refresh credential in a Secure, HttpOnly cookie. The extension service worker stores only its own rotating N Chill Party session credential in extension storage; it does not cache a streaming provider’s login. The extension also stores panel layout and side preference, video-layout choice, legal-disclosure version, volume preferences, and pending party information on your device. Pending support reports are stored locally for up to seven days, with a maximum of 20 reports, and are cleared when you sign out or change accounts. Guest support-access links are kept in tab-scoped storage. Browser and extension storage are not encrypted vaults, so protect access to your device and browser profile.

Promotional parties and recovery

We store promotional redemption records and remaining watch-time balances to enforce each gift’s limits. Playback state tells us when to pause that balance. To help recover interrupted parties, we retain the latest party name, selected supported content URL, playback position and paused state, privacy setting, and up to four previous participants for seven days. Recovery invitations remain available for 24 hours. Administrator-requested promotional emails record delivery recipients and status. These records are used to deliver and recover the service, not for advertising profiles.

Billing and technical information

Stripe processes checkout and payment-card details under its own privacy policy. We receive identifiers and subscription status needed to provide paid features, but we do not store full payment-card numbers. Our infrastructure may also process IP addresses, request times, device or browser information, and error logs for security, reliability, and troubleshooting.

Mobile compatibility and error reporting

The Android app opens supported streaming services in bundled browser engines. Each engine keeps its own provider sign-in cookies on your device. Provider profiles and preferences are stored locally. Changing engines may require signing in to that provider again; the app does not transfer provider credentials between engines.

Automatic mobile error reporting is on by default. Before its first upload, the app explains reporting and offers a way to turn it off. You can also turn it off in Advanced settings. Reports use your signed-in app account and contain the streaming service hostname, app version, Android API level, browser engine and profile, fixed issue and error codes, and the outcome of a repair attempt. They do not contain program titles, full page URLs, passwords, provider cookies, raw console logs, message contents, video, audio, or call recordings.

If reporting is enabled, the app sends observed technical failures and the results of guided compatibility attempts to the support service. Reporting can be disabled without disabling local repair. Disabling reporting or signing out clears unsent mobile reports; it does not delete reports already received. Received reports use the support-ticket access, retention, export and account-deletion rules described in this policy. The app does not declare a sign-in or playback issue fixed merely because a page loads; you confirm whether a suggested setup worked.

Separately, devices explicitly paired with a private test server send bounded testing diagnostics while enrolled. That testing enrollment can be disconnected from Diagnostics and test tools. The ordinary reporting switch does not enroll a device for remote tests.

3. How we use information

We use information to authenticate accounts; manage friends and invitations; connect, secure, and synchronize parties; provide camera and microphone features you request; administer subscriptions; troubleshoot and protect the Service; communicate about the Service; and comply with law. We do not use extension data for personalized advertising, credit decisions, or data brokerage.

4. When information is shared

We share only what is needed with:

• Party participants: your username, party presence, synchronization state and selected content URL, and any camera or microphone stream you enable.
• Service providers: providers such as hosting, email, TURN relay, and database infrastructure providers plus Stripe for billing, acting to provide their services to us.
• Sign-in providers: Google, Facebook, or Instagram when you choose the corresponding sign-in method.
• Legal and safety recipients: when reasonably necessary to comply with law, protect users, investigate abuse, or secure the Service.
• A successor: as part of a merger, financing, reorganization, or sale, subject to appropriate notice and protections.

We do not sell or rent personal information.

5. Chrome Web Store Limited Use

N Chill Party’s use and transfer of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide or improve the extension’s single purpose: synchronizing playback and providing an in-page watch-party experience with invited friends.

6. Retention and deletion

We keep account, friendship, and subscription records while your account is active and as needed for legitimate business, security, tax, and legal obligations. Support tickets are automatically removed after 180 days. Live presence, room membership, and playback signals are generally transient. Friend invitation links normally expire after 30 days, party links after 12 hours, access credentials after approximately 15 minutes, refresh sessions after 30 days, password-reset and email-change links after 30 minutes, and sign-in handoff codes after five minutes. Backup, billing, fraud-prevention, and security records may persist for a limited additional period where law permits or requires it.

Signed-in users can download an account-data copy, verify a new email address, and permanently delete their account from Account Settings. Deletion signs out every device, cancels an active Stripe subscription, and removes the account, friendships, social sign-in bindings, and associated support tickets from the live application database. You may also use the support form for assistance. We verify control of the account or new email before completing sensitive changes.

7. Security

We use measures designed to protect information, including HTTPS/WSS transport, password hashing, signed tokens, access controls, and encrypted WebRTC media transport. No system is perfectly secure, and we cannot guarantee absolute security.

Scheduled watch parties

When you schedule a movie night, we store its title, streaming link, start time, host, invited friends and their responses. These details are visible to the host and invited friends. The extension uses account-scoped reminder records on your device for browser notifications; signing out clears them. Scheduled-party records are deleted from the live database seven days after their start time and are included in your account export. Account deletion removes the schedules you host and your invitations.

8. Your choices

• Use browser controls to allow, block, or revoke camera and microphone access.
• Leave a party or disable an audio or video track at any time.
• Change extension layout and connection preferences or clear extension storage.
• Choose not to use social sign-in.
• Use Account Settings to verify a new email, download your data, manage Stripe billing, reset your password, or delete your account.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. You must also satisfy the minimum age and parental-consent requirements that apply where you live and for each streaming service you use.

10. International use

Information may be processed in the United States and other countries where our service providers operate. Those countries may have different data-protection laws from your location.

11. Changes

We may update this policy as the Service changes. We will revise the effective date and provide additional notice when a change materially affects how previously collected information is used.

12. Contact

For help or privacy requests, use the support form or email support@nchillparty.com.