Privacy Policy

1. Scope

This Privacy Policy applies to the N Chill Party website, accounts, invitations, payment features, browser extension, and mobile applications (together, the “Service”). It explains what we handle when you use the Service and the choices available to you.

2. Information we collect

Account and sign-in information

When you create an account, we collect your username and email address. If you use email sign-in, we store a one-way password hash, not your plain-text password. We also create account identifiers, revocable session records, email-verification status, subscription status, and account timestamps.

Social sign-in

If you choose Google, Facebook, or Instagram sign-in, that provider may give us your provider account identifier, public profile information, and email address where available. The provider also receives information about your request to sign in. Its own privacy policy applies to its processing.

Friends, invitations, and parties

We process friend requests, accepted connections, availability, party invitations, room identifiers, room names, and whether you are hosting or participating. A shared friend or party link contains a signed, expiring invitation token.

Streaming synchronization

While you actively use the extension for a party, it reads the URL of the supported streaming page you selected and the video’s play, pause, seek, playback-time, and commercial/interstitial state. It sends that state through our signaling service to synchronize invited participants and may identify which party participant is temporarily in a commercial so the room can wait. We do not use this feature to build a general browsing history or monitor unrelated pages. The extension does not read or store usernames, passwords, cookies, or session credentials belonging to Netflix, Hulu, YouTube, Apple TV+, or another streaming service.

Camera, microphone, and communications

The extension asks your browser for camera and microphone access only when you start or join a party. Audio and video are transmitted to the other party participants using encrypted WebRTC connections. If a direct connection cannot be established, an encrypted stream may pass through a TURN relay. N Chill Party does not record or intentionally store the contents of your calls.

Party text chat

Messages you send in a party are shared with its current participants through our encrypted signaling connection. The server retains only the latest 100 messages in temporary memory while the room exists, so reconnecting participants can catch up. Messages are discarded when the room ends or the server restarts. We do not save party chat in the database, local browser storage, account exports, or backups. Your local chat view is cleared when you leave or sign out.

Support requests

When you contact support, we collect your email address, category, subject, message, ticket status, and—if signed in—account identifier. We retain a one-way keyed hash of the submitting IP address and limited browser information for abuse prevention and troubleshooting; the hash is not used to recover the address.

Reports sent from the extension use your account email and may include the streaming hostname, extension version, issue type, frequency, and connection state. During companion use, observed player and synchronization failures are reported automatically using fixed error codes, hostname, and version. Repeated failures are grouped; these reports do not establish that the extension caused the failure. You can disable automatic reporting in the companion. Firefox also requires optional technical-data consent. Authorized support staff can categorize, prioritize, assign, reply, and add internal notes to requests. Customer conversations are available in the support portal; internal notes are only visible to support staff. Reply notifications are sent through our email provider, and guest reply links expire after 30 days. Reports do not include streaming credentials, full page URLs, raw console logs, or call recordings.

Telephone support and voicemail

If you call our shared XOS Tech Solutions support number and select N Chill Party, Telnyx processes the phone connection and automated speech or AI assistance. With your permission, we save a short AI-written issue summary, device information, attempted steps and an optional callback contact in our support workspace. The summary can be incomplete or inaccurate; it is not identity verification or a verified diagnosis. Caller ID does not grant access to your account. Do not provide passwords, sign-in codes or full card details over the phone.

Full support calls and human conversations are not generally recorded. If you choose voicemail, recording starts only after your consent and is limited to one minute. Audio stays with Telnyx and authorized support staff can retrieve it for your request. Automatic voicemail transcription is off. Phone requests and refund-review decisions are accessible only to authorized staff; recording metadata does not provide a public audio link. A phone refund request does not itself issue a refund or cancel renewal.

Support-workspace records follow the 180-day ticket retention period. XOS gateway copies normally expire after 30 days; an undelivered request can be retained until delivery or operator resolution. Gateway voicemail indexes expire after 30 days, while Telnyx audio may remain for up to one year unless deleted. Phone-only requests are not automatically attached to an account; contact support with your case reference to request access, correction or deletion, subject to verification and applicable recordkeeping requirements.

Local browser storage

The website keeps a short-lived access credential in tab-scoped session storage and a rotating portal refresh credential in a Secure, HttpOnly cookie. The extension service worker stores only its own rotating N Chill Party session credential in extension storage; it does not cache a streaming provider’s login. The extension also stores panel layout and side preference, video-layout choice, legal-disclosure version, volume preferences, and pending party information on your device. Pending support reports are stored locally for up to seven days, with a maximum of 20 reports, and are cleared when you sign out or change accounts. Guest support-access links are kept in tab-scoped storage. Browser and extension storage are not encrypted vaults, so protect access to your device and browser profile.

Promotional parties and recovery

We store promotional redemption records and remaining watch-time balances to enforce each gift’s limits. Playback state tells us when to pause that balance. To help recover interrupted parties, we retain the latest party name, selected supported content URL, playback position and paused state, privacy setting, and up to four previous participants for seven days. Recovery invitations remain available for 24 hours. Administrator-requested promotional emails record delivery recipients and status. These records are used to deliver and recover the service, not for advertising profiles.

Billing and technical information

Stripe processes checkout and payment-card details under its own privacy policy. We receive identifiers and subscription status needed to provide paid features, but we do not store full payment-card numbers. Our infrastructure may also process IP addresses, request times, device or browser information, and error logs for security, reliability, and troubleshooting.

Website analytics

The N Chill Party website uses Google Analytics 4 to understand aggregate visitor traffic, pricing interest, sign-up funnel steps, and checkout completions. Google Signals and advertising personalization features are disabled, and invitation tokens, verification links, and sign-in handoff parameters are stripped from reported page paths before analytics events are sent. The browser extension does not load Google Analytics on streaming-provider pages.

Mobile compatibility and error reporting

The Android app opens supported streaming services in bundled browser engines. Each engine keeps its own provider sign-in cookies on your device. Provider profiles and preferences are stored locally. Changing engines may require signing in to that provider again; the app does not transfer provider credentials between engines.

Mobile error evidence v2 is sent only after you accept a new on-device notice. You can turn it off in Settings. Reports use your signed-in app account and include the streaming service, exact app build and revision, OS and browser information, party state, last attempted action, fixed error categories and repair results. Only when an error report is generated, the app reads a bounded structural HTML snapshot of the viewer, removes page text, scripts, forms, URLs and account information, compresses the sanitized structure and attaches it. Normal playback does not collect viewer HTML. Reports may include up to twelve recent console, JavaScript and network error classifications with bounded line numbers, native codes and HTTP statuses; message text, request URLs, headers and bodies are excluded. They do not contain program titles, full page URLs, passwords, provider cookies, raw console logs, message contents, video, audio, or call recordings.

After the current notice is accepted and reporting is enabled, the app sends observed technical failures and the results of guided compatibility attempts to the support service. Reporting can be disabled without disabling local repair. Disabling reporting or signing out clears unsent mobile reports; it does not delete reports already received. Received reports use the support-ticket access, retention, export and account-deletion rules described in this policy. The app does not declare a sign-in or playback issue fixed merely because a page loads; you confirm whether a suggested setup worked.

Separately, devices explicitly paired with a private test server send bounded testing diagnostics while enrolled. That testing enrollment can be disconnected from Diagnostics and test tools. The ordinary reporting switch does not enroll a device for remote tests.

Netflix episode selection on Android

The Netflix picker lets you sign in and browse Netflix inside the app. When you tap Play on an episode, N Chill Party inspects that selected media control’s page attributes and embedded media identifiers on your device to identify its title and episode link. It uses this information to prepare your party and open the selected content in the Netflix app instead of playing it in the picker.

This selection inspection does not read sign-in form values, passwords, cookies, session tokens, or unrelated page content. Netflix sign-in cookies remain in the browser engine’s local cookie store as described above. The selected media link is processed by our party service and shared with party participants so they can open the same content. The app remembers the last selected link locally for party recovery until it is replaced or the app’s data is cleared. The selection feature does not upload or retain the inspected page structure or create a general browsing history; it uses the media information only for content selection, launch, and party preparation.

Playback usage and account administration

When an updated player reports active playback in a party, we conservatively measure elapsed watching from pairs of playback samples. We retain account totals, daily UTC totals, sample counts, and first and latest sample dates. The usage records do not contain titles, streaming URLs, playback positions, or a detailed viewing history. Pauses, stalls, commercials, and gaps are excluded where detected; older clients and restricted players may be unmeasured. Authorized administrators can review these statistics and account sign-in records for account management and future loyalty features. Silver, Gold, Platinum, and Diamond are planned loyalty levels; thresholds, awards, and perks are not active. These levels are separate from subscription plans. Financial and account maintenance actions record the administrator, reason, outcome, and time in an audit trail. Support-only staff cannot access the account directory, financial records, or usage statistics. Measured usage is included in account exports and deleted with the account. Administrative audit records may be retained for security and financial recordkeeping.

3. How we use information

We use information to authenticate accounts; manage friends and invitations; connect, secure, and synchronize parties; provide camera and microphone features you request; administer subscriptions; troubleshoot and protect the Service; communicate about the Service; and comply with law. We do not use extension data for personalized advertising, credit decisions, or data brokerage.

4. When information is shared

We share only what is needed with:

• Party participants: your username, party presence, synchronization state and selected content URL, and any camera or microphone stream you enable.
• Service providers: providers such as hosting, email, TURN relay, and database infrastructure providers plus Stripe for billing and Google Analytics for aggregate website measurement, acting to provide their services to us.
• Sign-in providers: Google, Facebook, or Instagram when you choose the corresponding sign-in method.
• Legal and safety recipients: when reasonably necessary to comply with law, protect users, investigate abuse, or secure the Service.
• A successor: as part of a merger, financing, reorganization, or sale, subject to appropriate notice and protections.

We do not sell or rent personal information.

5. Chrome Web Store Limited Use

N Chill Party’s use and transfer of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide or improve the extension’s single purpose: synchronizing playback and providing an in-page watch-party experience with invited friends.

6. Retention and deletion

We keep account, friendship, and subscription records while your account is active and as needed for legitimate business, security, tax, and legal obligations. Support tickets are automatically removed after 180 days. Live presence, room membership, and playback signals are generally transient. Friend invitation links normally expire after 30 days, party links after 12 hours, access credentials after approximately 15 minutes, refresh sessions after 30 days, password-reset and email-change links after 30 minutes, and sign-in handoff codes after five minutes. Backup, billing, fraud-prevention, and security records may persist for a limited additional period where law permits or requires it.

Signed-in users can download an account-data copy, verify a new email address, and permanently delete their account from Account Settings. Deletion signs out every device, cancels an active Stripe subscription, and removes the account, friendships, social sign-in bindings, and associated support tickets from the live application database. You may also use the support form for assistance. We verify control of the account or new email before completing sensitive changes.

Account security checks

When enabled, Cloudflare Turnstile processes browser and device signals to distinguish people from automated traffic. We submit the email address used to create an account to IPQualityScore to check deliverability, disposable-address status, recent abuse and fraud risk. These checks supplement email verification and may prevent account creation. We do not send your password to either provider or store their full responses in our account database. Contact support if you believe an address was incorrectly rejected.

7. Security

We use measures designed to protect information, including HTTPS/WSS transport, password hashing, signed tokens, access controls, and encrypted WebRTC media transport. No system is perfectly secure, and we cannot guarantee absolute security.

Profile pictures and party notifications

You may upload an optional profile picture, including a photo or character image, or choose to use your Google profile photo from Account → Profile. Google sign-in does not ask you to select or automatically import a picture. After a verified Google sign-in we retain the Google-provided photo URL with your linked account so this option is available later; it is not exposed to friends, and is included in your own account export and removed when your N Chill Party account is deleted. Image bytes are fetched and imported only after you select and confirm that Profile action, which may replace your existing picture. A failed import preserves the current picture. We resize and re-encode pictures, remove image metadata, and store the resulting picture with your account until you replace it, remove it, or delete your account. Accepted friends can see it in supported friend and party views, including when your camera is off. Choosing a picture does not enable your camera or change your streaming-service account.

For supported mobile notifications, we store device delivery tokens, notification preferences, invitation and reminder events, and delivery attempts. Android notifications use Google Firebase Cloud Messaging. Push payloads contain an event identifier and an account-matching value; invitation details are fetched through your authenticated account. Lock-screen alerts use generic wording and do not include the program title, streaming link, or credentials. Device or browser permission is required. You can mute notifications or individual categories in Settings, and review invitations in the app when system alerts are unavailable.

Expired notification events are removed from the live database after seven days. Device registrations that have not been refreshed for 90 days are removed. Signing out removes this device’s registration where a connection is available and invalidates its local messaging token. Notification preferences, events, device registration identifiers, and your profile picture are included in your account export; raw delivery tokens are excluded from the export. Account deletion removes these records. Private parties remain absent from public friend-party discovery.

Scheduled watch parties

When you schedule a movie night, we store its title, streaming link, start time, host, invited friends and their responses. These details are visible to the host and invited friends. The extension uses account-scoped reminder records on your device for browser notifications; signing out clears them. Scheduled-party records are deleted from the live database seven days after their start time and are included in your account export. Account deletion removes the schedules you host and your invitations.

8. Your choices

• Use browser controls to allow, block, or revoke camera and microphone access.
• Leave a party or disable an audio or video track at any time.
• Change extension layout and connection preferences or clear extension storage.
• Choose not to use social sign-in.
• Use Account Settings to verify a new email, download your data, manage Stripe billing, reset your password, or delete your account.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. You must also satisfy the minimum age and parental-consent requirements that apply where you live and for each streaming service you use.

10. International use

Information may be processed in the United States and other countries where our service providers operate. Those countries may have different data-protection laws from your location.

11. Changes

We may update this policy as the Service changes. We will revise the effective date and provide additional notice when a change materially affects how previously collected information is used.

12. Contact

For help or privacy requests, use the support form or email support@nchillparty.com.