Privacy Policy

Ninjadebrid is published by Ninjadebrid, the controller of the personal data described here. We collect what the service needs, never sell it, and use no advertising. We count visits without cookies and without identifying you. Any question about your data: privacy@ninjadebrid.net.

Depending on how you use the service:

• Account: your email address and whether you confirmed it, a hash of your password (never the password itself), your notification settings, and your pass periods with the payment reference we note when we activate them.
• Signed-in devices: for each session, the IP address and the browser (user agent) it was opened from. You can see them in your account's Security page.
• Torrents: the magnet links and .torrent files you submit, the resulting file names and sizes, the IP address each was added from, and when. For a free trial, they're tied to a random token stored in a cookie rather than to an account.
• Network: your IP address, used to apply the free limits, count simultaneous connections, slow down repeated attempts (sign-in, password reset) and fight abuse.
• Usage: the volume transferred through your direct links and streams, counted per month for pass holders and per day for the free capacity.
• The free pass new accounts get (the “trial pass” of our Terms): to give each person only one, keyed fingerprints (one-way hashes made with a secret key, from which the original can't be read back) of your email address, of the networks you used to sign up and to confirm your email or start the pass (an IPv4 address, or the /64 block of an IPv6 address) and of a device cookie, with whether a trial pass was granted or refused, and when.
• Audience statistics: visit counts (pages viewed, a few actions such as starting a download, browser type and country), with no cookie and nothing that identifies you.
• Server logs: our web server records each request (IP address, time, address requested, browser) for security and troubleshooting.
• Payment and support: what we exchange with you by email to arrange payment for a pass or answer your questions.

• To provide the service and apply its limits: the performance of our contract with you.
• To secure it, show you your signed-in devices, handle abuse reports and answer the authorities: our legitimate interest and our legal obligations.
• To give each person only one trial pass: our legitimate interest in preventing abuse of a free offer.
• To send service emails: confirming your address, password resets and security notices, pass activation and reminders, the warning before an ended pass's Library is deleted and, if you turn them on, ready-torrent emails. We send no marketing emails, and no email names a torrent.

We only use the cookies the service needs to work, so they don't require your consent:

• a session cookie (better-auth.session_token, with a __Secure- prefix over HTTPS), which keeps you signed in;
• a trial cookie (seedbox_trial), which links your browser to your free trial torrent;
• a device cookie (__Host-seedbox_device), a random value set when you sign up, confirm your email or start a trial pass, kept 400 days: it lets us recognize this browser so that each person gets only one trial pass;
• a language cookie (NEXT_LOCALE), set when you pick a language or open the site in one your browser doesn't ask for, kept 365 days: it remembers your choice.

Cloudflare, which protects the site, may add its own security cookie after a bot check. Your browser also keeps a few settings locally, such as where you stopped in a video; they never leave your device.

We share only what is strictly needed with:

• Cloudflare, which provides our domain's DNS and email forwarding and, when it is turned on, the Turnstile bot check on sign-up and the free trial (see Cloudflare's Turnstile Privacy Addendum);
• NOWPayments, which processes crypto payments for passes (it receives the order reference and the amount, never your password);
• Resend, which delivers our emails;
• the company hosting our servers, where all data is stored.

Some of these providers may process data outside the European Union, under the safeguards required by the GDPR.

• Account data: as long as your account exists.
• Signed-in devices: until you sign out of that device, sign it out from your account, or delete your account.
• Library: as long as your account exists; when a paid pass ends, 90 days, unless you get a new pass before then. The end of a trial pass deletes nothing.
• Free trial torrents and IP addresses tied to submissions: as long as needed to apply the free limits and handle abuse reports.
• Trial pass records (the keyed fingerprints above, and each decision): 365 days, then deleted automatically. They stay that long even if you delete your account sooner, so that a new account can't get a second trial pass.
• Server logs: rotated by size and overwritten automatically; we don't archive them.
• Emails with us: as long as needed to answer you and, for payments, as long as accounting law requires.
• Files in the cache: shared by everyone and not linked to you, they are removed when space is needed.

You can access, correct or delete your data, object to or restrict its use, and take a copy with you:

• download your data as a file from your account's Settings;
• change your email address from Settings;
• delete your account from Security, at once;
• for anything else, write to privacy@ninjadebrid.net from your account's address. We reply within one month.

If you think your data isn't handled properly, you can complain to your data protection authority (in France, the CNIL).

The site and direct links are served over HTTPS, passwords are hashed, direct links are signed and expire, and you can see and sign out the devices signed in to your account. No system is flawless: if a breach puts your data at risk, we'll tell you.

Any update to this policy will be posted here with its date.