StreamSmart Privacy Policy

Last Modified: June 18, 2026 · Version 2 (early-build draft)

About This Privacy Policy

This Privacy Policy explains how StreamSmart (the "Company," "We," "Us," or "Our") collects, uses, shares, and protects personal information when You use the StreamSmart Service (the "Service"). The Service is currently in an invited-access, early-build phase made available to a limited number of family members and friends of the Company. As the Service evolves, this Privacy Policy will be updated to reflect changes in our data practices. The current "Last Modified" date is shown above.

Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the StreamSmart Terms and Conditions.

Service Availability

The Service is offered exclusively to residents of the United States. We do not knowingly direct the Service to, or process the personal information of, residents of the European Union, the United Kingdom, or any other non-U.S. jurisdiction. If You are located outside the United States, please do not use the Service.

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Information"). We limit the categories and amount of Personal Information we collect to what is reasonably necessary to provide and improve the Service.

Information You Provide Directly

Account information collected during sign-up through our authentication provider: Your email address and, optionally, Your first and last name. We do not collect or require Your phone number, date of birth (beyond a numeric age check used solely to confirm You are at least 13), street address, government identifier, race, ethnicity, gender, sexual orientation, or any other special-category sensitive information at sign-up.

Onboarding responses provided during the onboarding flow, including: the streaming services You report subscribing to; the subscription tier You report for each; Your reported billing window and approximate billing day; how frequently You report watching each service; Your selection of "taste" preference tags; and Your selection of a "guilt-pick" service. None of this information is fetched automatically from any bank, credit card, or third-party account during the early-build phase.

Messages and feedback that You send to us directly, including any chat transcripts, files You attach, and email or text correspondence in which You contact Us about the Service.

Information We Collect Automatically

When You use the Service, certain information is collected automatically by our hosting infrastructure and analytics tooling, including: Your IP address; the type and version of browser and operating system You use; the pages You visit on the Service and the timestamps of those visits; the actions You take on the Service (clicks, navigation events, onboarding step completion); and error or crash events generated by the Service in connection with Your visit.

We do not currently use session-replay tools that record mouse movements, keystrokes, or form-field contents. We do not use device-fingerprinting or cross-site tracking techniques.

Information We Receive From Third Parties

We receive limited information about You from the authentication provider You use to sign up for the Service (such as a confirmation that Your sign-in succeeded, and a unique stable identifier the provider assigns to Your account). We do not receive Your social-graph information, contact list, or content from other services.

We do not currently receive bank-transaction information, credit-card transaction information, or any other financial-account information from any third party. Plans to introduce automatic subscription-detection via a regulated bank-data provider have been deliberately deferred and, if and when they are introduced, this Privacy Policy will be updated and Your express consent will be sought before any such collection begins.

Information We Derive

We derive additional information about You from the information You provide and the information we collect automatically. This includes: bundle recommendations and projected savings; inferred preferences based on Your onboarding responses; Your month-by-month streaming spend history (monthly total and per-service breakdown, derived from the subscriptions You report); one-way hashes of Your email address used for internal lookup; and aggregated, de-identified analytics about Service usage. We do not knowingly use Your information to infer or assign sensitive attributes such as race, ethnicity, sexual orientation, religious belief, or political affiliation.

How We Use Personal Information

We use the Personal Information we collect for the following business purposes:

• Creating and managing Your Account, including authenticating Your identity and enabling You to sign in.
• Providing the Service to You, including generating bundle recommendations, calculating projected savings, and displaying the results.
• Communicating with You and responding to questions, support requests, or feedback about the Service.
• Maintaining the security of the Service, preventing fraud and abuse, and protecting the rights, property, and safety of the Company, our users, and others.
• Debugging and identifying errors in the Service so that we can repair them.
• Improving the Service, including measuring how features perform and identifying which features are most useful.
• Performing internal research, analytics, accounting, and other internal business functions.
• Complying with applicable law, responding to lawful requests from public authorities, and exercising or defending legal claims.
• Evaluating or conducting a corporate transaction such as a merger, acquisition, financing, dissolution, restructuring, or sale of some or all of our assets, in which Personal Information held by us may be among the assets evaluated or transferred.

We do not use Your Personal Information for cross-context behavioral advertising. We do not use Your Personal Information to train artificial-intelligence models for third parties.

How We Share Personal Information

We do not sell, rent, lease, or share Your Personal Information for monetary or other valuable consideration. We do not use Your Personal Information for targeted advertising on third-party platforms.

We share Personal Information only in the following limited circumstances, and only as reasonably necessary for the purposes described:

• With Third-Party Service Providers we engage to operate the Service (described in the next section), under contractual obligations that require those providers to use Your information only for the purposes for which we engaged them.
• With third parties to whom You expressly direct us to disclose information.
• When required by law, regulation, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect Our rights, the rights of third parties, or the safety of any person.
• In connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, in which the recipient agrees to honor the commitments made in this Privacy Policy.

Third-Party Service Providers

The Service is built on a small number of third-party platforms that process Personal Information on Our behalf. Each provider listed below has its own privacy policy governing how it handles information; we have selected these providers based on their security posture and their commitments to data protection.

• Clerk — authentication provider. Processes Your email address, name, and authentication events to enable sign-in and account management.
• Vercel — hosting and content-delivery provider. Processes Your IP address, browser identifier, and HTTP request data to deliver the Service to Your browser.
• Neon — managed PostgreSQL database provider. Stores the application data described in this Privacy Policy at rest.
• Sentry — error tracking. Receives error and crash events generated by the Service, which may incidentally include user-identifying context.
• PostHog — product analytics. Receives event-level information about how You interact with the Service, including page views, clicks, and onboarding-step completions.
• Inngest — background job orchestration. Used to run scheduled and asynchronous tasks; processes only the minimum information required for those tasks.
• The Movie Database (TMDB) — third-party catalog metadata provider. We retrieve information about television shows and movies from TMDB; we do not send TMDB any of Your Personal Information.
• Cloudflare — authoritative DNS provider, domain registrar, and edge security layer for our domain. Processes Your IP address and HTTP request metadata at the DNS-resolution and edge-protection layers; does not see request payload bodies for traffic that traverses directly to our hosting provider.
• Upstash — managed Redis provider used for per-endpoint rate limiting. Receives the actor identifier used for rate-limit accounting (Your authenticated user identifier or, for unauthenticated requests, Your source IP); does not receive request bodies.
• Better Stack — application log aggregation and uptime monitoring. Receives the audit-log mirror of administrative and authentication-related events and the health-check pings to Our service.

As the Service matures, we expect to add the following Third-Party Service Providers, and will update this Privacy Policy before they begin processing information about You: AWS Key Management Service (encryption-key management); and a regulated bank-data provider, if and when the automatic subscription-detection feature is introduced.

Cookies and Similar Technologies

We and our Third-Party Service Providers use cookies and similar technologies to operate the Service. The categories of cookies used include:

• Strictly necessary cookies, set by Our authentication provider, to keep You signed in during a session. Without these cookies the Service does not function.
• Analytics cookies, set by Our product-analytics provider, to measure how the Service is used in aggregate. We do not use third-party advertising cookies.
• Security cookies, set by Our hosting provider, to protect against abuse and fraud.

Most browsers allow You to refuse or disable cookies through Your browser settings. If You disable strictly necessary cookies, parts of the Service may not function correctly.

Data Retention

We retain Personal Information for as long as Your Account is active, plus a reasonable period thereafter for the limited purposes described below.

• Account information and onboarding responses: retained while Your Account is active. If You delete Your Account, this information is removed from our production systems within 30 days of a verified deletion request, subject to the exceptions described under "Right to Delete" below.
• Recommendation outputs and audit-log entries: retained for as long as Your Account is active, and for up to 18 months thereafter to support fraud detection, dispute resolution, and legal-compliance obligations.
• Server logs (including IP-address-level access logs): retained for up to 90 days for security and operational purposes.
• Webhook and background-job event records: retained for up to 30 days for debugging and integrity verification.
• Backups: standard encrypted backups of our production database are retained on a rolling basis and overwritten on the schedule maintained by Our database provider; Personal Information in backups is removed as backups age out.

Data Security

We implement administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, encryption at rest by Our hosting and database providers, multi-factor authentication on the administrative accounts that have access to production data, role-scoped database access, structured logging, audit trails, and rate-limited public endpoints.

No security measure is perfect, and we cannot guarantee the security of information transmitted over the internet. You play an important role in protecting Your information — in particular by using a strong, unique password (or other strong authentication credential) for the Service and by promptly notifying us of any suspected unauthorized access to Your Account.

Notification of Data Breach

If we become aware of a confirmed breach of security that compromises the confidentiality, integrity, or availability of Your Personal Information, we will notify You and the appropriate regulators in accordance with applicable law. Where notification to You is required, we will deliver the notification by email to the address associated with Your Account, generally within 72 hours of confirming the incident, unless a longer period is reasonable under the circumstances or required for law-enforcement reasons.

Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect Personal Information from children under 13. Sign-up attempts by users under 13 are rejected at registration. If we learn that we have collected Personal Information from a child under 13, we will delete that information from our records as promptly as possible. If You are a parent or guardian and believe that Your child has provided Us with Personal Information, please contact Us at the email address provided in the "Contact Information" section below.

Users between the ages of 13 and 18 may use the Service only with the permission of a parent or legal guardian, as described in the Terms and Conditions.

Your Privacy Rights

Depending on Your state of residence, You may have specific rights regarding Your Personal Information. We make every reasonable effort to honor the most comprehensive federal or state privacy rights We are aware of, regardless of Your specific location within the United States. The rights described below are available to all U.S. users of the Service.

Right to Know and Access

You have the right to request that We disclose to You: the categories of Personal Information We have collected about You; the sources from which the Personal Information was collected; the business or commercial purpose for which the Personal Information was collected; the categories of third parties with whom we share the Personal Information; and the specific pieces of Personal Information We have collected about You.

Right to Correct

You have the right to request that We correct inaccurate Personal Information We hold about You. Once we receive and confirm a verifiable consumer request to correct Personal Information, We will correct the information in our systems and direct Our Third-Party Service Providers to do the same where applicable.

Right to Delete

You have the right to request that We delete the Personal Information We have collected from You, subject to certain exceptions. After we receive and confirm a verifiable consumer request to delete Personal Information, We will delete (and instruct Our Third-Party Service Providers to delete) the Personal Information from Our records, except where We may retain it to:

• Complete the transaction for which the Personal Information was collected, provide a good or service requested by You, or otherwise perform Our contract with You.
• Detect security incidents, protect against malicious or fraudulent activity, or prosecute those responsible for such activity.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free-speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act and similar state laws.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when You have previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on Your relationship with Us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which You provided it.

Right to Data Portability

You have the right to request that We provide You with a copy of the specific pieces of Personal Information We have collected about You in a portable, readable format. We will use commercially reasonable formats (such as JSON or CSV) that should enable You to transmit the information from one entity to another without hindrance.

Right to Opt Out of Sale or Sharing

We do not sell, rent, lease, or share Your Personal Information for monetary or other valuable consideration, and we do not use Your Personal Information for cross-context behavioral advertising. Accordingly, no opt-out is required to prevent the sale or sharing of Your information. If We ever change this practice in a material way, We will update this Privacy Policy and obtain Your consent before any such sale or sharing occurs.

Right to Non-Discrimination

We will not discriminate against You for exercising any of Your privacy rights. Unless permitted by applicable law, We will not deny You access to the Service, charge You a different price, or provide You a different level or quality of the Service because You exercised any of the rights described in this Privacy Policy.

How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable consumer request to Us by email at [to be completed before publishing]. Only You, or a person authorized to act on Your behalf (such as a person registered with the California Secretary of State or otherwise authorized under applicable state law) may make a verifiable consumer request related to Your Personal Information. You may also make a verifiable consumer request on behalf of a minor child of which You are the parent or legal guardian.

You may make a verifiable consumer request for access or data portability up to twice within a 12-month period. The verifiable consumer request must: provide sufficient information that allows Us to reasonably verify You are the person about whom We collected Personal Information or an authorized representative; and describe Your request with sufficient detail to allow Us to properly understand, evaluate, and respond to it.

We cannot respond to Your request or provide You with Personal Information if We cannot verify Your identity or authority to make the request and confirm that the Personal Information relates to You. Making a verifiable consumer request does not require You to create an account with Us if You do not already have one. We will only use Personal Information provided in a verifiable consumer request to verify the requester's identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of receipt. If We require more time (up to a total of 90 days), We will inform You of the reason and extension period in writing. If You have an Account with Us, We will deliver Our written response to the email registered with the Account. If You do not have an Account, We will deliver Our written response by mail or electronically, at Your option. Any disclosures We provide will only cover the 12-month period preceding the verifiable consumer request's receipt unless a longer period is required by applicable law. The response will also explain the reasons We cannot comply with a request, if applicable.

We do not charge a fee to process or respond to Your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If We determine that the request warrants a fee, We will tell You why We made that decision and provide You with a cost estimate before completing Your request.

Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at Our discretion and at any time. The date this Privacy Policy was last updated is identified at the top of this page. When We make a material change, We will notify You by email at the address associated with Your Account, and post a notice on the Service, at least 30 days before the change takes effect, except where a shorter period is required by law or by an urgent security or legal matter. Your continued use of the Service after the effective date of any change constitutes Your acceptance of the updated Privacy Policy.

Contact Information

If You have any questions or comments about this Privacy Policy, the ways in which We collect and use Your Personal Information, Your choices and rights regarding such use, or wish to exercise Your rights under applicable U.S. state law, You may contact Us by email at [to be completed before publishing].