Privacy Policy

This policy explains which personal data web13.bozztv.com processes, why, for how long, and which rights you have. We keep data to the minimum needed to run a free streaming service and to act against abuse.

1. Data we process

Publishers (account holders)

• User name, e-mail address, password (stored only as a bcrypt hash), role.
• IP address at sign-up and at each login, time of sign-up and of the last login.
• Channel settings: stream address, title, description, thumbnail URL, flags (18+, unlisted).
• Results of the automatic stream checks (online/offline, quality, CORS).
• Viewer statistics of the channel (counts, bytes, offload), aggregated, not per viewer.
• Administrative notes and actions concerning the account (audit log).

Viewers

• The player sends anonymous statistics to the signaling server every 10 seconds: a random session id, the stream id, bytes received from the origin and from peers, bytes uploaded, number of peers, stalls, playback state, browser name and version. No cookies are set for viewing, no account is needed, and no history of what a person watched is stored.
• The signaling server sees the viewer's IP address for the duration of the connection (needed to deliver messages and to apply per-IP limits). Connection events are kept in the server log for a limited time.
• Through WebRTC, viewers of the same channel exchange video segments directly; their IP addresses are technically visible to each other, as with any peer-to-peer video service. A TURN relay, if configured, hides them at the cost of relaying traffic.

Everyone

• Server logs: request time, path, status, IP address, user agent, errors, kept in rotating log files.
• Abuse reports: channel, message, optional name and e-mail, IP address of the reporter.
• Cookies: a session cookie (only after login) and a CSRF cookie (forms). No advertising or tracking cookies are set by us. The administrator may enable Google Analytics; if so, Google's privacy policy applies to that measurement.

2. Why (legal bases)

• To provide the Service you requested (contract): account, channel page, embed, signaling, statistics.
• Legitimate interest: security, rate limiting, preventing abuse, keeping the service available, defending legal claims.
• Legal obligation: responding to lawful requests from authorities and to valid copyright notices.
• Consent: optional e-mails you request (password reset, welcome mail), analytics where enabled.

3. Retention

• Account data: as long as the account exists, plus 90 days after deletion for abuse prevention (blocked publishers may be kept longer to enforce the block).
• Login IP addresses: last sign-up and login IP for the life of the account.
• Server logs: up to 30 days (rotated by size, typically shorter).
• Player statistics: aggregated per channel; per-session data is discarded when the session ends (within 24 hours).
• Abuse reports and audit log: 2 years.
• Backups: 14 daily copies of the data files.

4. Sharing

We do not sell personal data. We share data only: with authorities and rights holders when legally required (typically the Publisher's registration data and IP addresses in cases of copyright infringement or illegal content); with service providers that host our servers or send our e-mails, bound by contract; and when the Service is transferred to a new operator.

Your stream address, user name, title, description and thumbnail are public by design (they appear on your channel page and, unless unlisted, on the home page and in the sitemap).

5. Your rights

Depending on your jurisdiction (e.g. GDPR, CCPA) you have the right to access, correct, delete or export your data, to restrict or object to processing, and to complain to a supervisory authority. You can edit your e-mail and password in Settings and your channel in the Dashboard. For deletion or export, use the contact page; we answer within 30 days. We may ask you to verify your identity (e.g. by writing from the registered e-mail address).

6. Security

Passwords are hashed with bcrypt; sessions are signed; all traffic is encrypted with TLS; access to the administration is restricted; data files are stored on the server's local disk with restricted permissions and daily backups. No system is perfectly secure; use a unique password.

7. Children

The Service is not directed at children under 16, and accounts require the age of majority. If you believe a child provided us data, contact us and we will delete it.

8. International transfers

Servers may be located in the USA or in the European Union. When data is transferred between jurisdictions we rely on standard contractual clauses or equivalent safeguards.

9. Changes

We may update this policy; the current version is published at this address. Material changes are announced on the site.

10. Contact

Data protection requests: contact page.