Privacy Policy

KOS Studio (“we”) develops and runs the Dramahubs app and the website that introduces the project (dramahubs.net). This page explains what data we collect, why, who receives it, and how you can delete it. It goes together with our Terms of Service.

1. Data we collect

• Account: email, display name, the time and version of the Terms you accepted, and a password (hashed one-way with bcrypt — we cannot read it). Accounts created with Google or Facebook have no password.
• Signing in with Google or Facebook: if you choose this, we receive your name, your email address (verified by them) and your account identifier at that provider. We do not receive your password, contacts, friends or posts.
• Device identifier (mobile app only): at sign-up the app reads a device identifier (Android ID or iOS Identifier for Vendor). It is not an advertising ID. It is stored once, to detect fraud in the referral programme.
• Viewing activity: episodes you watched, where you stopped, favourites, watch later, and the in-app notification inbox.
• Membership and payments: your membership plan and expiry date; your payment orders (plan, amount, currency, status, transfer code, time). For bank transfers we receive the transaction id and the transfer text from the bank’s transaction-history feed to match the order. We do not store card numbers; if card payments are opened, they are handled by the payment processor.
• Referral programme: your referral code, who was referred by whom, commission amounts, and — if you request a payout — your bank name, account number and account holder name.
• Sign-in cookie: one cookie holding a random session id, to keep you signed in.
• Technical data: IP addresses are used briefly to limit request rates and prevent abuse.
• Website statistics (website only): we may use Google Analytics to count page views in aggregate.
• Error reports (mobile app only): when the app hits an error or closes unexpectedly it may send a technical report with the error text, the app version and the operating system (Android/iOS) and its version. The report carries no account, email, IP address or device identifier, and we also strip emails, access tokens and URL parameters from the error text. It is used only to find and fix bugs.

We do not ask for camera, contacts, location or device storage permissions. The app only needs Internet access.

2. How we use this data

• To sign you in, keep your session and protect your account.
• To remember your history, resume points, favourites and watch later.
• To confirm payments, grant membership benefits and pay commissions.
• To prevent fraud (for example self-referral, or many accounts on one device).
• To send account emails: verification codes, password resets, and confirmation that an account was deleted. We do not currently send marketing email.

3. Who receives your data

We do not sell personal data and do not share it for advertising. It is processed only by the following infrastructure providers, as far as needed:

• Google and Meta (Facebook): when you choose to sign in with them. Google Analytics (if enabled) only receives aggregate page-view figures.
• Cloudflare: traffic routing, security and image caching.
• Resend: delivers account emails (receives the email address and the message).
• Banks and VietQR: the system you use to transfer money; we read the receiving account’s transaction history to confirm orders. Google Play processes your payment data when you buy through Google Play Billing.
• Server and backup providers: our data runs on rented servers, and periodic backups are kept with a third-party service so we can recover from a failure.
• Film sources and video infrastructure: requests to fetch films carry no account information or identity.

4. Retention and deletion

You can delete your account yourself in the app: Profile → Delete account. If you cannot use the app, see the data deletion instructions. When an account is deleted:

• Deleted: email, display name, password, Google/Facebook link, device id, viewing history, favourites, watch later, notifications, any remaining membership, and the bank account used for commission payouts.
• Kept, no longer linked to you: payment order history and the commission ledger (amounts, dates, statuses) because accounting rules require it; any bank account number in them is reduced to its last 4 digits.
• Backups: deleted data may remain in periodic backups. The copy on our server is removed after 30 days; the encrypted copy kept with a third-party service may remain longer.

5. Security

Passwords are hashed one-way (bcrypt). Sessions use random identifiers checked by the server on every request. Connections to the service are encrypted with HTTPS.

6. Your rights

You may ask to see, correct or delete your data at any time, and you can withdraw your consent by deleting your account. Contact us at the address in section 9.

7. Children

The service is not aimed at children under 13 and we do not knowingly collect their data. If you are a parent and find that your child has an account, contact us and we will delete it.

8. Changes to this policy

The latest update date is always shown at the top. For important changes we will also tell you in the app.

9. Contact

For any question about personal data, contact: [email protected]