Privacy policy

Last updated 8 November 2026

This is the privacy policy of watch.sixaroo.com, the site where Sixaroo shows its series. It says what we collect, why, who handles it, how long we keep it and how to delete it. We try to collect as little as the site needs.

Who is responsible

The controller of your data is [controller name], [postal address]. You can reach us at [contact email].

What we collect, and why

• Your email address, when you make an account. We use it to send you the sign-in code, and the emails you asked for: the moment the next part is yours, and Sixaroo news if you ticked the box.
• Your consent to those emails, when you ticked it, and which wording you saw. We keep that so we can show you agreed, and so we only write to people who did.
• Your sign-in sessions. Each browser you sign in on gets a random session id. We note when it was made, when it was last used, and which app it was made in (Instagram, Facebook, TikTok or another browser). That is how you stay signed in, and how Sign out everywhere works.
• The id Apple or Google gives us for you, if you sign in with them, so that your next sign-in finds your account.
• A short tag of your account. Over a part that members get first, the picture carries a small tag of your account ("m-" and 4 characters), so that a recording of it can be traced to the account that made it. The site's owner can look an account up by that tag.
• Your progress and your choices. The parts you watched and where you stopped, so Continue watching and Resume work, and the choices you made in interactive mode, so the next part can play out your pick. Without an account these stay in your own browser and never reach us.
• Hashed copies of your network address and of an email address typed into the sign-in form. When someone asks for sign-in codes we count the requests per network address and per email address to stop abuse (these are the rate limits). We keep only a scrambled copy, a hash, never the address itself: of the network address for at most 24 hours, and of a typed email address (a salted hash) for at most 60 minutes. A hash is pseudonymous: it is not your address, but it is still about you, so we treat it as personal data.
• Counts of what happens on the site. How many people visited, which pages, which part was opened, how far it was played. These counts have no name, no email and no id in them. See "Counting visits" below.

We do not sell your data. We do not use it for advertising, and nothing on this site follows you to other sites.

Who handles it

• Cloudflare is our hosting. It serves the pages and the videos, stores the site's data, runs the Turnstile check on the sign-in form (it tells people from bots), and provides the cookie-free Web Analytics and the Analytics Engine where our own counts are kept. The site runs at the Cloudflare location nearest to you, so a visitor outside Europe is served from there, while the data itself stays in the EU.
• Amazon Web Services sends our emails: we use Amazon SES in Frankfurt. It sees your address and the email it delivers.
• Apple and Google, only if you choose Continue with Apple or Continue with Google. We take only your verified email address from them, and keep nothing else they may send, such as a name. What they know about you is in their own policies.

All member data is stored in the EU. The videos and pictures are kept in an EU bucket as well. We share your data with no one else.

Counting visits

Cloudflare Web Analytics counts visits, pages and loading speed without cookies and without fingerprinting you. Our own counts are sent by the page to the site as it is used (a part opened, a part played to 25, 50 or 75 percent, a button tapped). They hold the event and the part or button it was about, and nothing that says who you are. We keep our own counts for 3 months, and report only totals.

Cookies

You will see no cookie banner here, because the cookies this site sets are strictly necessary for it to work, and there are no analytics cookies and nothing that tracks you across sites. They are:

• A sign-in cookie, when you sign in. It lasts 180 days and is renewed as you keep using the site.
• A random id, for someone who plays a part without an account. It ties the video's address to your browser, so the address cannot be passed on, and it lasts 365 days. It is not linked to your name or your email.
• A short cookie of 10 minutes while you sign in with Apple or Google, to finish the sign-in safely.

Our counts are sent with a browser feature called sendBeacon. Your browser sends its own cookies along with every request to this site, this one included; for counting they are never read. The site also keeps small notes in your browser's own storage: your progress and choices (without an account), and whether interactive mode is on.

How long we keep it

• Your account, with your email, consent, progress and choices, and any Apple or Google id: until you delete it. An account we close keeps its record until you ask us at [contact email] to delete it.
• Sign-in codes: 10 minutes, and gone when used.
• Sign-in sessions: they end after 180 days without use, and are cleared every night.
• The queue of emails waiting to go out: the address in a row is blanked the moment the email is sent. The row, with an unsalted hash of the address, is kept for 30 days so we can count what went out.
• The hashed network address for rate limits: 24 hours at most. The salted hash of a typed email address: 60 minutes at most.
• Our own counts of what happens on the site: 3 months. The totals we report from them hold no personal data.
• The suppression list: when your account is deleted, or closed by us, or an email to you bounces or is marked as spam, we keep a hash of your address so we never email it again. It is pseudonymous too, and we keep it for as long as the site runs. If you make a new account with an address you deleted before, it is taken off.
• A log of what the site's owner does in the private admin page (a part posted or moved, news sent, an account closed): 30 days. It names the owner's sign-in email and, for an account, only its tag, never a member's email address.
• Nightly backups of the member records (each one's email, consent, progress and choices, the id Apple or Google gave us for you, and the unsubscribe token) and of the suppression list: 30 days. They are kept in the EU, and they are unreadable by any page or route of the site.

Deleting your data, and your rights

You can delete your account yourself, any time, on your account page: choose Delete my account. Your email, your progress, your choices and any Apple or Google id go at once. Only the hash on the suppression list stays, for the reason above. The backups age out within 30 days.

You can also untick the news box on that page, or use the unsubscribe link in any email, to stop the emails; withdrawing your consent never costs you anything. You may ask us for a copy of what we hold about you, to correct it, or to object to how we use it, by writing to [contact email]. You may also complain to your country's data protection authority.

Children

The site is for people who are 13 or older. If you think a younger child has made an account, tell us and we will delete it.

Changes

If this policy changes we will change the date at the top. If the change matters to what you agreed to, we will email the members.