Privacy Policy
Last updated: 25 October 2026 — v1 draft pending legal review
4reelz ("4reelz", "we", "us") is a Hong Kong sole proprietorship operated by Billy Fong. This policy explains what we collect through 4reelz.co and the 4reelz beta, how we use it, and the choices you have. We've kept it short and plain.
1. What we collect
- Account email — the address you use to request a magic link and sign in.
- Discord identity — your Discord user id and guild membership, used to gate beta access and run the beta room.
- Your library — the reels/accounts you save, bookmarks and collection overrides.
- Beta messages — messages you post in the 4reelz Discord beta channels, if the feedback bot is enabled.
- Basic technical data — device/browser type, general location, pages viewed. On our public marketing pages we use Cloudflare Web Analytics, which is cookieless: it sets no cookie or local storage and reports aggregate page/visit data only, with no advertising and no cross-site tracking. We treat this as exempt from consent under our current assessment; legal review of that position is pending.
- Bot-protection signals — when you join the waitlist or sign in, Cloudflare Turnstile processes your IP address, TLS fingerprint, User-Agent and the sitekey/origin to tell humans from bots. It is strictly necessary security, not analytics, and it runs regardless of your consent choice. See §7 for the security cookie it may set.
2. Where the analyzed content comes from
4reelz analyzes public Instagram, TikTok and YouTube Shorts data obtained through third-party data providers. We do not access private accounts, DMs, or any content behind a login. All analyzed content is public.
3. How we use it
- To approve beta access, send magic links and sign you in.
- To fetch public video metadata/media, transcribe and analyze it, and build your briefs and collections.
- To operate, secure and improve the service, including cost and abuse controls.
Analysis sends the reel transcript, on-screen text, deterministic signals and five sampled frames to our AI provider (DeepSeek). Transcription sends audio or the transcript to Deepgram. We do not send private messages or private-account content. The local prototype kept media on-device; the cloud service does not.
4. How we share it
We share data only with service providers that help us run 4reelz: Apify (public metadata/media), Deepgram (transcription), DeepSeek (analysis), Supabase (auth/database), AWS (hosting/storage/CDN), Cloudflare (Web Analytics and Turnstile/bot protection) and Resend (email). PostHog EU is used for session replay only when replay is enabled and you choose Accept all. Cloudflare here is not our CDN or WAF — those are AWS CloudFront and AWS WAF. We do not sell your personal information. Some providers process data outside your country; where required we rely on appropriate safeguards.
5. Retention
We keep account and library data while your account is active. Public source video is deleted after 7 days; a 720p copy and thumbnail may be kept until takedown or last-save cleanup. Transcript/overlay artifacts are kept for up to 90 days for re-analysis; the current analysis JSON is kept while the short is live. Consent and audit records may be retained for up to 12 months. You can ask us to delete your data at any time — use the account deletion flow in the app, or contact us (see §11).
6. Your choices and rights
- Delete — use the account deletion flow in the app, or contact us below.
- Access / correction — ask us what we hold and to correct it.
- Opt out of communications — reply to any message and ask to be removed; we'll stop non-essential messages.
- If you are in the EEA or UK, you have rights of access, correction, deletion, restriction, portability and objection, and the right to lodge a complaint with your local supervisory authority.
7. Cookies and analytics
After you choose an option in the consent banner or the cookie preferences dialog, we apply it as described here. The banner offers Accept all, Analytics only and Reject. Two Cloudflare services run regardless of your choice: the exempt Cloudflare Web Analytics beacon and Cloudflare Turnstile for bot protection. Everything else that stores data waits for your choice.
| Storage / service | What it is | When it runs |
|---|---|---|
| Cloudflare Web Analytics | No cookie or local storage; aggregate page/visit data only. We treat it as exempt from consent under our current assessment; legal review is pending. | Always on our public marketing pages. |
| Cloudflare Turnstile | Bot protection; strictly necessary security, not analytics. It may set a short-lived strictly-necessary security cookie. | Always on for protected forms (waitlist and sign-in). |
4reelz:consent local storage | Your choice record: version, analytics, replay, decided_at. | Set on every choice, including Reject. |
4reelz:events:session session storage | Anonymous session identifier plus a last-activity timestamp, used to group product events within one visit. Cleared when you reject analytics or close the tab. | Only after Accept all or Analytics only. |
aid first-party cookie | Anonymous identifier used to count product events. 1 year, Path=/, SameSite=Lax, Secure outside development, not HttpOnly. | Only after Accept all or Analytics only. |
| Supabase auth/session cookies | Sign-in session; host-only. | Only when you sign in. |
| PostHog EU | Session replay and heatmaps, masked; processed in the EU. | Only when replay is enabled and you choose Accept all. |
Your choices. Accept all enables product events, the aid cookie and session replay. Analytics only enables product events and the aid cookie but disables replay and PostHog. Reject sends no product events, sets no aid cookie and loads no PostHog; only the local consent record is kept. The exempt Cloudflare analytics and Turnstile security checks still run on every choice. Note that "no cookies" is not the same as "no local storage": the consent record itself is stored locally. Your choice is stored per browser origin, while the aid cookie is shared across .4reelz.co; a different 4reelz page can therefore prompt separately, and a tab that already accepted can re-issue the shared cookie. "Reject" always means no browser product events; server-side app.* records are outside this browser control.
Changing your choice. You can change your choice at any time via the "Cookie preferences" link in the footer or in the app profile menu; we re-prompt if the consent version changes.
8. Children
The service is not intended for anyone under 18. If you believe a child has provided us personal data, contact us and we'll delete it.
9. International transfers
Our primary AWS and Supabase region is Singapore. Provider defaults to confirm in our DPA before launch: Apify (US/EU), Deepgram (US; EU endpoint available), DeepSeek (China, provider default), Resend (US) and Cloudflare (its global network). PostHog EU processes session replay in the EU, only when replay is enabled and you choose Accept all. A current subprocessor/region list is available on request and will be published before launch. Where required, we rely on appropriate safeguards.
10. Changes
We may update this policy. If we make material changes we'll update the date above and post the new version here.
11. Contact
The fastest way to reach us — including privacy and data requests — is the 4reelz beta room on Discord: discord.gg/4fHxfaupVf.
This policy is a plain-language draft for the v1 beta and is pending formal legal review.