Last updated: June 20, 2025
Lumina Stream ("we," "us," or "our") operates the website at lumina-stream-omega.vercel.app (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Service. We respect your privacy and are committed to protecting your personal data. This policy applies to all visitors, including both authenticated and unauthenticated users.
2.1 Information You Provide. When you create an account, we collect your email address (used exclusively for authentication via Supabase), profile name, and any content you voluntarily submit such as watchlists, ratings, comments, and collection names. We do not collect payment information โ our Service is completely free.
2.2 Automatically Collected Information. When you access the Service, we automatically collect your IP address (used for rate limiting via Upstash Redis to prevent abuse), browser type and version, operating system, referring URLs, pages viewed, and visit timestamps. This data is processed at the edge through Cloudflare Workers and is not stored permanently.
2.3 Cookies and Local Storage. We use Supabase authentication cookies (sb-access-token, sb-refresh-token) to maintain your session, a profile_id cookie to remember your selected profile, and browser localStorage to store UI preferences, notification dismissal status, and viewing progress. See our Cookie Policy for details.
We use your information to: provide and maintain the Service, including authenticating your account via Supabase; personalize your experience through watchlists, collections, and viewing history stored in our Supabase database; improve and optimize the Service based on usage patterns; detect, prevent, and address technical issues, abuse, and security threats; and comply with legal obligations.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
The Movie Database (TMDB).We fetch movie and TV show metadata from TMDB's public API. TMDB has its own privacy policy at themoviedb.org. Your IP address is transmitted to TMDB when content data is fetched on your behalf.
AniList.We fetch anime metadata from AniList's public GraphQL API. Your IP is transmitted to AniList when anime data is requested. See anilist.co for their privacy policy.
Supabase. Account authentication and user data are handled by Supabase (supabase.com). Your email and profile data are stored securely in our Supabase instance.
Cloudflare. We use Cloudflare Workers for edge caching and DDoS protection. Cloudflare may collect IP addresses and request metadata. See cloudflare.com/privacypolicy.
Upstash Redis. Used exclusively for server-side rate limiting. Your IP is temporarily stored with automatic expiration and is not persisted.
Embed Streaming Providers. Third-party embed providers (such as vidsrc.fyi, vidsrc.pm, autoembed.co, and others) may set their own cookies and collect data independently. We do not control these services โ review their individual privacy policies.
Advertising Partners. To support our free service, we may work with advertising partners such as PopAds, Adsterra, PropellerAds, and related networks. These partners may collect anonymized device information, browsing patterns, and interaction data to serve relevant advertisements. Ad networks may set their own cookies and use tracking technologies subject to their respective privacy policies. You can opt out of interest-based advertising through tools provided by the Network Advertising Initiative.
We implement industry-standard security measures including: HTTPS encryption for all data in transit; secure authentication tokens managed by Supabase with automatic refresh and expiration; Content Security Policy (CSP) headers to prevent XSS and injection attacks; HTTP Strict Transport Security (HSTS); and IP-based rate limiting via Upstash Redis. While we strive to protect your data, no method of electronic storage or transmission is 100% secure.
We retain your account data for as long as your account is active. Upon account deletion, personal data is permanently removed within 30 days, except where retention is required by law. Server logs and rate-limiting data are retained for a maximum of 7 days. LocalStorage data is stored on your device only.
Depending on your jurisdiction, you may have the right to: access, correct, or delete your personal data; object to or restrict processing; request data portability; and withdraw consent at any time. Under GDPR, you may lodge a complaint with a supervisory authority. Under CCPA, California residents may request data disclosure and opt out of data sale (we do not sell personal information).
To exercise these rights, contact us through the Settings page or our social media channels. We will respond within 30 days.
Our Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If discovered, such data will be deleted promptly.
We may update this Privacy Policy periodically. Material changes will be posted on this page with a revised date. Continued use of the Service after changes constitutes acceptance.
If you have questions about this Privacy Policy, reach out through our Settings page or social media channels.