Privacy policy

Who we are

Brey Archives is operated by Brey Media LLC, a limited liability company registered in Wyoming, United States, at 30 N Gould St, Ste R, Sheridan, WY 82801, United States. We decide how your personal information is used on this website (we are its “controller”). For anything in this policy, write to support@breymedia.co.

We collect as little as we need to run the membership. We do not sell personal information, we show no advertising and we use no advertising or tracking cookies. We count visits with limited analytics of our own, on our own servers, as described below.

What we collect

When you create an account

• Your e-mail address and your password — stored only in scrambled (hashed) form that no one can read back. If you sign in with Google, we receive your e-mail address and the basic profile details Google shares, such as your name.
• If you turn on two-step sign-in, the setup of your authenticator app (never the codes it shows).
• When you sign in: the time, and — for security, while each signed-in session lasts — the IP address and browser it was opened from.

When you buy a membership

• Your plan, its dates and status, and your payments, refunds and any disputes — their amounts, dates and outcome, and the country of the card as Stripe reports it. Your card details go to Stripe, never to us.
• A record of what you agreed to at checkout — the exact words you ticked (one version for the EU and EEA, another elsewhere, chosen by the country your connection comes from), the time, that country, and the IP address and browser details of the device you agreed from. We keep it as evidence of the purchase if a payment is ever disputed.
• Why you cancelled, if you cancel (you choose a reason), whether we offered you a discount to stay, and what you tell us in a refund request, with the country your connection came from when you sent it.
• If you ask for a refund or withdraw within 14 days of paying and the right to withdraw may apply (a card issued in the EU or EEA, or when we treat your request as a withdrawal): the calculation of what you would get back if you withdraw — the days you had Premium and how much of the Premium videos you watched — kept with your request.
• The link you joined through (for example the one in a particular bio) and, for a new membership, the video it was bought from.

When you use the website

• Where you stopped in each video, so it can resume there, and the videos you like.
• Each time you open a video to watch it: which video, when, how far you got and until when, and the IP address, country and kind of device (phone, tablet or computer) it was watched from. We keep this record of the membership being used as evidence if a payment is ever disputed.
• The events described under How we count visits.

When you write to us

Your e-mail and what you tell us, to answer you.

What we note ourselves

Notes about an account where we act on it — for example the reason for giving or removing access, or our answer to a refund request — and a record of what administrators changed.

How we count visits — without cookies

We count visits ourselves, on our own servers, and store nothing on your device to do it — no cookie and no other identifier. A visit is recorded as a few short events, such as a page opened, how quickly it appeared and answered your taps, a video started and how far it got (a quarter, a half and so on), a locked video, a post or the plans seen, a video cover tapped, a checkout started, a like. With each we record the kind of device (phone, tablet or computer), the country (from your IP address, which is not stored), the app you opened the site in (for example Instagram) and, when you arrive, the link you came through.

To tell visitors apart without a cookie, our server turns your IP address and browser details into a code for the day, using a secret key that changes every day and is deleted the next day. The code cannot be turned back into your IP address, and codes from different days cannot be linked to each other. So a visitor who is not signed in can be counted once a day, but the codes cannot be used to link that visitor across different days. We still treat the code as personal information for as long as we keep it. (Copies of the key can remain in our database backups, which are kept for up to 7 days.)

If you are signed in, the events are linked to your account, on every day. If you create an account, your visits earlier that day are linked to it too, so we can tell which of our links members came through. With the account we keep the link, the country, the kind of device and the app it was created from, so we can see what members from each went on to pay in total — we look at these as totals, never member by member. When a membership is bought, we note the video it was bought from, with the payment. When an account is deleted, these notes are kept only as figures that no longer point to anyone.

The events themselves are deleted after 30 to 61 days (a month’s events are deleted 30 days after the month ends). Before that they are added up into totals — visits per day, per link, per country, per kind of device and per app, views per video — that contain nothing that identifies anyone, and those totals are kept.

Why we use it

• To provide your account and membership — to sign you in, give you the access you paid for, take payments, resume videos, send the e-mails the membership needs and answer you. (This is necessary for our contract with you.)
• To keep the website and its members safe — to prevent fraud, abuse and shared accounts, and to keep evidence of purchases — and of the membership being used — for disputes. (Our legitimate interests.)
• To decide refund requests fairly — we look at the request, the payment and how the membership has been used since it. (Our legitimate interests.) If you withdraw under the 14-day right in the EU or EEA, the amount kept is worked out from how many days you had Premium and how far you watched each Premium video since paying — from where you stopped and from what the player reports — and a person checks it before anything is refunded. (Our legal obligations.)
• To understand and improve the website — which pages, links and videos work, counted as described above. (Our legitimate interests.)
• To tell members about new videos and offers — see The e-mails we send. (Our legitimate interests, or your consent where the law requires it.)
• To meet our legal obligations — such as tax and accounting records.

Refund requests are read and decided by a person. One thing happens automatically, to protect members and us from stolen cards: if a card’s bank warns that a payment may be fraudulent, the payment is refunded at once, the membership ends, and the card may be blocked from paying us again. If you think this happened to you by mistake, write to us.

The e-mails we send

We send the e-mails your account and membership need: confirming your address, resetting your password, and telling you when your password or e-mail address changes; confirming a membership, a plan change or a cancellation; a reminder before each renewal of a longer plan; one reminder if you start a checkout and do not finish it; our answers to refund requests; and messages about deleting your account. Stripe also e-mails receipts and notices about failed payments or an expiring card. You cannot turn these off while you have an account, because they are part of the service.

We may also e-mail members about new videos and offers. Every such e-mail will have an unsubscribe link, and you can also write to us to stop them at any time.

Who we share it with

Only with the companies that run parts of the website for us, each for its own part and under contract, and never to sell it:

• Supabase — our database and sign-in (servers in the United States) — privacy policy.
• Vercel — hosting of the website — privacy notice.
• Bunny.net — storing the videos and streaming them to you, which needs your IP address — privacy policy.
• Stripe — payments. Stripe also uses your payment information for its own purposes, such as fraud prevention and its legal obligations, under its own privacy policy.
• Resend — sending our e-mails — privacy policy.
• Google — sign-in with Google if you choose it, and the mailbox where e-mails you send us arrive — privacy policy.
• Cloudflare — our domain, and forwarding the e-mails you send us to that mailbox — privacy policy.
• Sentry — reports of errors and of how fast pages load, from your browser and our servers: the page address (without anything after a “?”), the kind of browser and device, and what went wrong. Never your name, e-mail address, password, sign-in cookie or what you type into a form. Like any service a browser sends something to, it sees the IP address the report comes from — privacy policy.

We may also share information when the law requires it, to protect our rights or others’ (for example with a bank or card network in a payment dispute), or with a buyer if the business is ever sold — who would then be bound by this policy.

Where it is kept

Our database is in the United States, and our providers may process information in other countries too. Where the law of your country requires it (for example in the UK or the European Union), transfers are made under safeguards such as the standard contractual clauses our providers offer.

Cookies

We use only the cookies the website needs to work, so we do not ask for consent to them:

• Your sign-in (named sb-…-auth-token) — keeps you signed in. It lasts up to 400 days, renewed while you use the site, or until you sign out. While you sign in with Google, a short-lived companion cookie (sb-…-code-verifier) completes the sign-in and is then removed.
• bm-checkout — remembers the plan you chose while you create an account or sign in to pay, for up to 30 minutes.
• bm-join — after you pay as a new member, signs you in on the device you paid from, once, within 2 hours.
• bm-oauth-return-to — while you sign in with Google, remembers the page to bring you back to, for up to 10 minutes.

The administrators’ own pages use one more, for their time zone. Nothing is stored on your device to count visits. The payment pages are Stripe’s, and Stripe may use its own cookies there to prevent fraud; the video player is Bunny.net’s.

How long we keep it

• Your account, your likes and where you stopped in each video — until you delete your account.
• The record of the videos you opened — 18 months from each time you opened one; after your account is deleted, as the next section sets out.
• An account whose e-mail address is never confirmed — deleted after a week, with anything recorded with it (such as an unfinished checkout) no longer linked to it.
• The events described under How we count visits — 30 to 61 days; the totals made from them, which identify no one, are kept.
• The full messages Stripe sends our server about payments — deleted after 30 days; the summary of each payment is kept with the payment records.
• Payment records and what you agreed to at checkout — kept for as long as accounting, disputes, fraud prevention and the law require, even after your account is deleted (then no longer linked to an account). The link an account joined through and the video a membership was bought from are kept with them in the same way.
• E-mails in our support mailbox — including the copy of a refund request that arrives there — are kept for as long as reasonably necessary to handle your request and keep a record of the conversation, then deleted; ask us and we will delete yours sooner.
• Backups of our database are kept for up to 7 days.

The next section sets out exactly what deleting your account removes and keeps.

Deleting your account

You can delete your account at any time from Account → Delete your account. If you have a membership, deleting your account cancels it — there are no further payments — and does not by itself refund anything you have paid. You can keep Premium until the end of the time you have paid for and have your account deleted then, or delete it straight away.

What deleting removes

Your account and the personal data that goes with it are deleted or anonymised: your sign-in details and e-mail address, your profile, where you stopped in each video and your likes. The records we keep (below) are no longer linked to an account. If you sign up again with the same e-mail address, you start a new account — nothing from the deleted one is restored.

What we keep, and for how long

• Payment and transaction records — your payments, refunds, disputes and fees, your membership and plan, their dates and amounts, and the terms you agreed to when you paid. Some of these records may need to be kept after your account is deleted, for accounting, payment processing, handling refunds and disputes, preventing fraud, meeting legal obligations and other legitimate purposes. They are kept for as long as those purposes require, no longer linked to an account.
• The IP address recorded when you agreed to a purchase is deleted 12 months after your account is deleted.
• The record of the videos you opened — which video, when, how far, and the IP address, country and kind of device — is kept with the payment records, as evidence if a payment is disputed, and deleted 12 months after your account is deleted (or 18 months after each view, if that comes first).
• The device and browser details recorded with it are deleted 12 months after your account is deleted.
• Messages you sent us through the site, such as the words of a refund request, are deleted 12 months after your account is deleted.

These deletions happen automatically.

Payments and Stripe

Payments are processed by Stripe. Stripe may keep certain information about you and your payments independently, under its own privacy policy and its own legal and regulatory obligations. Deleting your account on our website does not automatically delete Stripe’s separate records.

Your rights

Wherever you live, you can ask us for a copy of your personal information, to correct it, to delete it (see Deleting your account), or to stop using it for a purpose — including e-mails about new videos and offers. Depending on where you live (for example in the UK or the European Union) you also have the right to restrict how we use it, to object to uses based on our legitimate interests, to receive it in a portable form, and to withdraw any consent you gave.

Write to support@breymedia.co from the address on your account; we may ask you to confirm it is you. We answer within one month. If you are not happy with our answer, you can complain to your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

Keeping it safe

The website is served only over encrypted connections. Passwords are stored hashed, videos are delivered through links that expire, access to members’ information is limited to what each part of the website needs, and administrators must sign in with a second step. You can turn on two-step sign-in for your own account in Account → Sign-in & security. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

Children

The website is for adults: you must be 18 or older to create an account, as the terms of service say. If we learn that an account belongs to someone younger, we delete it.

Changes to this policy

We will update this policy when what we do changes, show the date of the latest version at the top, and tell members by e-mail about important changes.

Contact

Brey Media LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. E-mail: support@breymedia.co.