invidious-copy-2022-08-14/src/invidious/views/privacy.ecr

<% content_for "header" do %>
<title>Privacy Policy - Invidious</title>
<% end %>

<div class="h-box">
<%= Markdown.to_html(<<-END_PRIVACY_POLICY
  ## Privacy
  
  This document concerns what data you provide to this website, the purpose of the data, how the data is stored, and how the data can be removed.
  
  ### Data you directly provide
  
  Data that you provide to the website for the purpose of the site's operation (for example: an account name, account password, or channel subscription) will be stored in the website's database until the user decides to remove it. This data will not be intentionally shared with anyone or anything.
  
  Information stored about a registered user is limited to:
  
  - a list of session tokens for remaining logged in across devices
  - the last time an account was updated (to provide accurate notifications)
  - a list of video IDs identifying notifications from a user's subscriptions
  - a list of channel UCIDs the user is subscribed to
  - a user ID (for persistent storage of subscriptions and preferences)
  - a json object containing user preferences
  - a hashed password if applicable (not present on google accounts)
  - a randomly generated token for providing an RSS feed of a user's subscriptions
  - a list of video IDs identifying watched videos
  
  The above list reflects [this code](https://github.com/omarroth/invidious/blob/master/src/invidious/users.cr#L14-L51).
  
  Users can clear their watch history using the [clear watch history](/clear_watch_history) page.
  
  If a user is logged in with a Google account, no password will ever be stored. This website uses the session token provided by Google to identify a user, but does not store the information required to make requests on a user's behalf without their knowledge or consent.
  
  ### Data you passively provide
  
  When you request any resource from this website (for example: a page, a font, an image, or an API endpoint) information about the request may be logged.
  
  Information about a request is limited to:
  
  - the time the request was made
  - the status code of the response
  - the method of the request
  - the requested URL
  - how long it took to complete the request.
  
  No identifying information is logged, such as the visitor's cookie, user-agent, or IP address. Here are a couple lines to serve as an example:
  
  ```
  2019-01-19 16:37:47 +00:00 200 GET /api/v1/comments/xrlETJYzH-c?format=html&hl=en-US 1345.88ms
  2019-01-19 16:37:53 +00:00 200 GET /vi/r5P-f5arPXE/maxres.jpg 1085.41ms
  2019-01-19 16:37:54 +00:00 200 GET /watch 7.04ms
  ```
  
  This website does not store the visitor's user-agent or IP address and does not use fingerprinting, advertisements, or tracking of any form.
  
  This website provides links to googlevideo.com to provide audio and video playback. googlevideo.com is owned by Google and is subject to their [privacy policy](https://policies.google.com/privacy).
  
  ### Data stored in your browser
  
  This website uses browser cookies to authenticate registered users. This data consists of:
  
  - An account token to keep you logged into the website between visits, which is sent when any page is loaded while you are logged in
  
  This website also provides an option to store site preferences, such as the theme or locale, without an account. Using this feature will store a cookie in the visitor's browser containing their preferences. This cookie is sent on every request and does not contain any identifying information.

  You can remove this data from your browser by logging out of this website, or by using your browser's cookie-related controls to delete the data.
  
  ### Removal of data
  
  To remove data stored in your browser, you can log out of the website, or you can use your browser's cookie-related controls to delete the data.
  
  To remove data that has been stored in the website's database, you can use the [delete my account](/delete_account) page.
  END_PRIVACY_POLICY
  )
%>
</div>