Privacy Policy

IPTV Commons is the controller of the personal data described here. To contact us about privacy, including to use any of your rights, use the contact page and choose “Privacy or data request”.

“Contract” means we need it to provide the service you signed up for. “Legitimate interests” means keeping the forum safe, lawful, free of spam and working; we've weighed these against your privacy and kept the data to the minimum. We don't ask for or knowingly keep special-category data (health, religion and so on); please don't post it about yourself or anyone else.

• No IP address logs. Our web server keeps no access log. Your IP address is used briefly in memory to stop abuse (for example, limiting sign-ups and sign-in attempts per connection) and is forgotten within an hour.
• No analytics or tracking. We don't use Google Analytics, advertising pixels, fingerprinting or third-party scripts. Fonts are served from our own server.
• No message content. See below.
• No card or bank details. See Payments.

Messages are encrypted in your browser before they're sent, using a key that only you and the other member can work out. Your private key is stored on our server only after it's been sealed with a key made from your password in your browser, so we can't open it. On your device, the keys are kept in your browser's storage and wiped when you sign out.

That means nobody at IPTV Commons can read your messages, including when someone reports you: a message report contains only what the reporter writes and any screenshots they choose to attach. If the police or a court ask us about messages, the most we can give them is metadata (who talked to whom, and when). Messages are checked for adverts and shared logins in your own browser before sending; that check never sends the text to us.

Paid memberships are paid in cryptocurrency through a payment processor, which is named at checkout and handles the payment under its own privacy policy. We receive and keep the payment's reference, amount, currency, status and date, and the membership it bought. We never receive card or bank details. Remember that transactions on public blockchains are visible to anyone and can't be deleted.

We use a small number of service providers (“processors”) who act on our instructions:

• Hosting (Switzerland). The website, its database and uploaded files run on a server we rent from a hosting company in Switzerland. The UK recognises Switzerland as giving adequate protection for personal data.
• Cloudflare, Inc. (USA, global network). All traffic to the site passes through Cloudflare, which protects it from attacks and speeds it up. Cloudflare processes your IP address, browser details and the pages you request to do this. Cloudflare also routes email sent to our contact address.
• Resend (USA). Sends our emails: verification and sign-in codes, and replies to contact messages. Resend receives your email address and the email's content.
• Payment processor. Handles membership payments, as above.

Where your data goes to the United States, it's protected by safeguards recognised under UK law, such as the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) where the provider is certified, or the UK International Data Transfer Addendum.

We don't sell or share your data with advertisers. We share it with others only if the law requires it (for example, a valid request from the police or a court), to report illegal content to the authorities, or to protect someone's safety.

Images and adverts from other sites. If a post, profile or advert shows an image that's hosted on another website, your browser fetches it from that site, which can see your IP address. Clicking an advert takes you to the advertiser's site; we count the click but don't tell the advertiser who you are.

Your username, profile, posts and reactions are visible to anyone who can see the forum area they're in, and may appear in search engines. Free members and visitors see other members' names anonymised in threads. Your email address is never shown. Staff (moderators and admins) can see account details, held and removed posts, reports and the moderation history; they can't see your password or your messages.

• Account and profile: while your account exists. When you ask us to delete your account, we erase your email, password, profile, sessions, message keys, uploaded avatar, bookmarks, notifications, followed threads, ratings, blocks and copies of emails sent to you, and delete every private conversation you were in. Your posts stay on the forum under a placeholder name (like “deleted_123”) so threads still make sense, unless you ask us to remove them too.
• Posts you delete, and posts we remove: hidden from the site at once, but kept out of sight so moderators can handle appeals and reports, and as evidence where the law requires it (for example, illegal content we've reported). Ask us if you want a post you deleted erased completely.
• Signed-in devices: each session lasts 30 days unless you sign out sooner, and is deleted when it ends. One-time codes are deleted a day after they expire.
• Moderation records (reports, warnings and ended suspensions, the staff log) and contact messages: deleted 2 years after the matter is closed. A ban stays on record while it's in force.
• Email copies: deleted after 1 year.
• Uploaded images: while they're used; an image uploaded but never used in a post is deleted after a day, and a replaced avatar straight away.
• Payment records: 6 years, as UK tax law requires.

Under UK GDPR you have the right to: get a copy of your data; have it corrected; have it deleted; restrict or object to how we use it (including anything based on legitimate interests); and receive data you gave us in a portable format. You can change most of your profile yourself under Account. For everything else, use the contact page; we'll reply within one month and may need to check it's really you, usually by replying to your account's email address.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

Connections are encrypted (HTTPS). Passwords are hashed with Argon2, session and code tokens are stored only as hashes, two-step sign-in is available, authenticator secrets and report screenshots are encrypted at rest, and the server accepts administration only by key. The database isn't reachable from the internet. No system is perfectly secure; if a breach puts your data at risk, we'll tell you and the ICO as the law requires.

The site is for adults: you must be 18 or over to create an account. If you believe a child has an account, tell us through the contact page and we'll close it and delete their data.

We only use cookies that the site needs to work or that remember your settings. The cookie notice lists each one. If we change this policy in a way that matters, we'll update the date at the top and tell signed-in members.