ASHOT (“we”, “our”, “the app”) respects and is committed to protecting your privacy. This policy explains how we collect, use, share, and protect your personal information, and the rights you have. This policy is drafted in accordance with the General Data Protection Regulation (GDPR, EU), the California Consumer Privacy Act (CCPA), and other applicable laws.
1. Information We Collect
- Account information: When you create an account, we collect your email address, display name, and sign-in method (email / Google / Apple).
- Third-party sign-in: When you sign in with Google or Apple, we receive only the minimum information you authorize (email, display name).
- Device & log information: Device model, OS version, app version, push token, crash logs, IP address (for security auditing and rate-limiting).
- Usage data: Watch history, favorites, unlocked content, coin balance, daily check-in records, comments, and engagement events (used to provide the service and improve recommendations).
- Subscription & payment metadata: Subscription tier (free / VIP / Pro), Stripe customer reference, order history, and refund status. We do not store your full card number — those are tokenized by Stripe, Apple, or Google.
- Support correspondence: When you contact us (email, in-app), we keep the conversation to resolve your issue and improve our service.
- Creator-side data (if you sign up as a creator): portfolio assets, payout details (Stripe / PayPal / bank email only — never raw account numbers in the clear after submission), audit logs of admin actions on your account.
2. How We Use Your Information
- To provide, maintain, and improve the service
- To verify your identity and protect account security
- To process in-app purchases and confirm orders
- To send push notifications (you can turn this off at any time)
- To analyze usage and improve the product (not used for advertising tracking)
- To comply with legal obligations and prevent fraud
3. Information Sharing & Third-Party Service Providers
We do not sell your personal information. We share information only with sub-processors strictly necessary to operate the service:
- Identity & auth: Google Firebase (auth, push), Google Sign-In, Apple Sign In.
- Payments: Stripe, Inc. (web checkout & subscriptions), Apple Inc. (App Store IAP), Google LLC (Google Play Billing).
- Media hosting & CDN: Amazon Web Services (S3 storage, CloudFront video delivery), Cloudflare (edge CDN, DNS, DDoS protection).
- Advertising partners: See § 11 below (HilltopAds for VAST pre-roll, Google AdSense, ad networks configured via
/admin/ad-config). - AI service providers (creator workspace only): Anthropic, OpenAI, Runway, Flux, Lingmao Seedance and similar generative model APIs. Inputs are content you submit voluntarily; no end-viewer data is sent.
- Social distribution partners (used by ASHOT’s OFFICIAL accounts to promote published works): Meta (Facebook, Threads, Instagram), LinkedIn, Pinterest, X / Twitter, TikTok, YouTube, Kwai. See § 12 below.
- Email & transactional: SMTP / transactional email provider for verification codes and account notifications.
- Legal disclosure: Where required by law or to protect users or public safety, we may disclose information to authorities.
4. Your Rights (GDPR / CCPA)
- Right of access: View the personal information we hold about you.
- Right to rectification: Correct inaccurate information (via “Edit Profile” or by contacting support).
- Right to erasure (“right to be forgotten”): Delete your account to remove all data — Delete my account.
- Right to data portability: Contact support to request an export of your data.
- Right to object / withdraw consent: You can withdraw any consent previously given at any time.
- CCPA “Do Not Sell My Personal Information”: We never sell user data.
To exercise the rights above, contact [email protected]. We will respond within 30 days.
5. Children’s Privacy
This service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover such information has been collected inadvertently, we will delete it immediately. If you are a parent or guardian and find that your child has provided us with information, please contact us.
6. Data Retention
Account information is retained while your account is active. After you delete your account, we will delete your personal information within 30 days, except where retention is required by law (such as transaction records).
7. Data Security
We take reasonable technical and organizational measures to protect your information, including HTTPS encrypted transmission, hashed password storage, and least-privilege access. Please understand that no internet transmission can be guaranteed 100% secure.
8. International Data Transfers
ASHOT is a service available to users globally. Your information may be transferred to and stored on servers outside your country or region, including the United States and the European Union. We use appropriate safeguards (such as GDPR Standard Contractual Clauses) to ensure lawful transfer.
9. Cookies & Similar Technologies
On our web platform (ashot.live and its sub-domains), we use the following cookies and local-storage entries:
ashot_session — strictly necessary; keeps you signed in across pages and sub-domains. Encrypted JWT, 30-day lifetime.ashot_share_code — preserves share-attribution when you arrive via a creator’s referral link. 30-day lifetime, can be cleared at any time.social_oauth_state_* — short-lived (10-minute) CSRF tokens used only during admin OAuth flows when connecting our official social accounts. Not used for end viewers.- Local storage: playback preferences (volume, subtitle language), “remember dismiss” flags for in-app banners.
We do not set advertising / cross-site tracking cookies on first load. Some advertising partners may set their own cookies when an ad renders inside the player (see § 11).
10. Advertising & Ad Partners
Our service may show advertising in two places:
- Pre-roll VAST ads on the H5 share page and the in-app player. Sourced from third-party ad networks (currently including HilltopAds) configured by ASHOT admin. The ad provider may set its own cookies and collect aggregate impression data under its own privacy policy.
- Rewarded ads when a user opts in to watch an ad in exchange for coins. The reward only credits after the ad signals completion. Provider varies by region.
- App-store house ads (Google AdSense slots, where enabled) — subject to Google’s privacy policy.
VIP / Pro subscribers do not see pre-roll ads. We do not run cross-site behavioral advertising or build advertising profiles of identifiable users from our service.
11. ASHOT’s Official Social Media Presence
ASHOT operates official accounts on Facebook, Threads, Instagram, LinkedIn, Pinterest, TikTok, YouTube, X / Twitter, and Kwai. From these accounts, ASHOT may post:
- Promotional posts about published works, including the work’s title, synopsis, cover image, and a link back to
ashot.live. - Trailer clips or short excerpts (for video-first platforms such as TikTok, YouTube, Reels, Kwai).
- Brand and product announcements from ASHOT itself.
These posts are published from ASHOT’s own accounts using the respective platform’s official API. End-viewer personal information is not shared with the social platforms via this process — only public-facing content authored by the creator and approved by ASHOT.
When you interact with one of ASHOT’s social posts (like, share, comment), the social platform’s own privacy policy applies to that interaction. To opt out of seeing such posts, unfollow the relevant ASHOT account on that platform.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via in-app notifications. Continued use of the service constitutes acceptance of the updated policy.
13. Contact Us
For any privacy-related questions, data-subject-access requests (DSAR), or to report a privacy incident, please contact:
We aim to respond to DSAR requests within 30 days as required by GDPR / CCPA.
