Yoreflix Privacy Policy
Effective: 6 August 2026 · Last updated: 6 August 2026
Yoreflix Limited ("we", "our", "us") values your privacy. This policy explains how we collect, use, disclose and safeguard your information when you use our streaming service (the "Service").
1. Who we are
Yoreflix Limited, 71–75 Shelton Street, London, WC2H 9JQ. We are the data controller for the personal data described in this policy. Contact: support@yoreflix.com.
We have not appointed a Data Protection Officer, and are not required to do so. Enquiries about this policy should be sent to the address above.
2. Information we collect
a. Account information — name, email address, account credentials and contact details. Billing and payment details are collected and processed by Stripe Payments UK Ltd and are not stored by us (https://stripe.com/gb/privacy).
b. Usage data — viewing history and preferences, device and browser information, approximate location derived from IP address, and playback and interaction events used to operate and improve the Service.
c. Communications — records of your contact with our support team and your marketing preferences.
d. Advertising data — we do not currently serve advertising and we do not collect advertising data. Section 7 describes what will change if and when we introduce an advertising-supported tier.
3. Cookies and similar technologies
We and our partners use cookies, device identifiers and browser storage as set out below.
a. Strictly necessary — always active, no consent required
These keep you signed in and the Service secure. All four are first-party, HttpOnly, Secure, SameSite=Lax, Path=/, and scoped to .yoreflix.com so that they work across our subdomains. They are not readable by JavaScript and are never used for advertising.
| Name | Purpose | Lifetime |
|---|---|---|
yoreflix_ik | Installation identifier — recognises this browser or device | 1 year |
yoreflix_ct | Credentials token — keeps you signed in ("remember me") | 30 days |
yoreflix_session | Session token for the current signed-in session | 8 hours |
yoreflix_rt | Request token — protects against request forgery and replay | 8 hours |
b. Preferences — browser storage, no consent required
Stored in your browser's local storage and never transmitted to us as cookies:
| Key | Purpose |
|---|---|
yf_ga_consent | Remembers your analytics choice (granted or denied) so that we do not ask again |
yf_ga_debug | Diagnostic flag, used only during development |
We also store playback preferences such as captions and resume position against your account.
c. Analytics — only with your consent
We use Google Analytics 4. Analytics storage is denied by default and nothing is set until you choose to allow it. Where you grant consent, Google sets:
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Distinguishes browsers for visit measurement | 2 years |
_ga_<id> | Retains session state | 2 years |
d. Advertising
We do not currently set advertising cookies and no advertising partner sets cookies through the Service. If we introduce an advertising-supported tier, this policy will be updated to name the cookies and identifiers involved and their lifetimes before any advertisement is served, and advertising storage will remain denied by default unless you allow it.
e. Payments
Checkout is hosted by Stripe, which sets its own cookies on its own domain under its own privacy policy (https://stripe.com/gb/privacy).
You may clear or block cookies in your browser settings. Blocking the strictly necessary cookies described in (a) will prevent sign-in.
4. How we use your information
We use your information to provide and maintain the Service; to manage subscriptions and process payments; to personalise content recommendations; to communicate with you about your account; to detect and prevent fraud; and to comply with our legal obligations.
5. Lawful bases for processing (UK GDPR)
- Contract — providing the Service and managing your subscription.
- Consent — analytics cookies and marketing email.
- Legitimate interests — security, fraud prevention and service improvement.
- Legal obligation — accounting, tax and regulatory compliance.
6. Sharing your information
We do not sell your personal data, and we do not share it with advertising partners. We do not currently serve advertising through the Service.
Under certain United States state privacy laws, including the California Consumer Privacy Act as amended (CCPA/CPRA), sharing personal information with advertising partners for targeted advertising may itself be treated as a "sale" or a "share". Should we introduce advertising, we will update this policy and provide the opt-out mechanisms those laws require before doing so.
We share data with:
- Payment processing — Stripe Payments UK Ltd.
- Infrastructure providers — Cloudflare (content delivery, hosting and edge services), GridPane and OVH (application hosting), and Mailjet (transactional email).
- Digital rights management — Axinom, for content encoding and playback licence issuing. A licence request carries device and playback identifiers.
- Analytics — Google Analytics, and Google BigQuery, where our viewing telemetry records are stored and aggregated.
- Legal authorities, where required by law or in order to protect our rights.
- A successor entity, in the event of a merger or acquisition.
7. Advertising
The Service does not currently show advertisements. Our paid subscription is advertising-free.
We are preparing an advertising-supported tier. It is not offered today and no advertising data is collected, processed or shared. Before any advertisement is served we will update this policy to describe what is shared, with whom, and how to control it, and — in the United Kingdom and the EEA — we will ask for your consent through a consent management platform before any advertising cookie is set.
Where advertising is introduced, Google's use of information from sites and apps that use its services is described at https://policies.google.com/technologies/partner-sites.
The Service is intended for adults aged 18 or over (see section 12) and our applications carry 18+ store ratings. We do not direct advertising at children.
8. Your rights
Under the UK GDPR you have the right of access, and the rights to rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent.
You also have the right to lodge a complaint with the Information Commissioner's Office if you believe your data has been mishandled — https://ico.org.uk/.
To exercise any of these rights, contact support@yoreflix.com. We respond within the statutory timeframe, which is one month under the UK GDPR.
9. Your choices and consent
- Analytics — analytics storage is denied until you allow it, and you may change that choice at any time by clearing your browser storage for this site.
- Advertising — not applicable today; see section 7. Consent and opt-out mechanisms appropriate to each territory will be in place before advertising is introduced.
- Marketing email — you may unsubscribe using the link in any marketing email, or in your account settings.
- Device controls — you may reset or limit advertising identifiers in your device or browser settings.
10. Retention
| Data | Retained for |
|---|---|
| Account and profile data | While your account is active, and thereafter as required for legal, accounting and tax purposes |
| Payment records | 6 years, to meet UK accounting and tax obligations |
| Analytics data (Google Analytics) | 14 months |
| Viewing activity | 12 months |
| Support correspondence | 5 years |
You may request deletion of your data at any time (see section 8). Some records must be kept in order to meet legal and accounting obligations even after an account is closed.
11. Security
We implement appropriate technical and organisational measures to protect your personal data, and data is stored in encrypted form. No method of transmission over the internet is completely secure.
12. Age of users
The Service is intended solely for adults aged 18 or over. Our applications are rated 18+ in the app stores and account holders must be at least 18. We do not knowingly collect personal information from anyone under 18, and if we learn that we have done so we will delete it.
13. Territories and international transfers
The Service is available in the United Kingdom, the United States, Canada, Australia and New Zealand.
Where data is transferred outside the United Kingdom we rely on adequacy decisions, standard contractual clauses or other appropriate safeguards. Personal data is processed in the United Kingdom and, in the case of our service providers, in other countries in which they operate.
14. Changes to this policy
We may update this policy from time to time. Material changes will be notified by posting the updated policy and revising the effective date shown above.
15. Contact
Yoreflix Limited, 71–75 Shelton Street, London, WC2H 9JQ support@yoreflix.com Information Commissioner's Office: https://ico.org.uk/