Privacy Policy

This policy explains what personal data Catalyst collects, why, who sees it, and what you can do about it. Catalyst is run by SFCO, LLC (“we” or “us”), which is the data controller for personal data we use to operate the Service. Channel operators are responsible for their own use of the audience information and inbox content they manage.

It covers the Catalyst website and apps, channel sites served at a channel’s own domain (including ones that hide Catalyst branding), the Catalyst browser extension, our API, and the emails we send. The creators who run channels see some information about their audience; section 6 says what. The terms of service are the agreement this policy sits inside.

We show no ads and sell no personal data. We use analytics and diagnostic tools to understand usage and keep the service working.

Your account

Your email address, a hash of your password (never the password itself), display name, username, avatar, bio, and your settings: whether your profile shows what you follow and what you have watched, and whether spoilers are revealed. If you sign in with Google, Discord or Patreon, we receive your account id, email address, name and avatar from that service, and we store the authorization tokens it issues. We never receive your password for those services. If you use passkeys or two-factor authentication, we store passkey public keys and credential details, and two-factor setup and recovery information.

Channels

If you run or help run a channel: its handle, name, branding, links and settings; who its members are and what they may do; invitations, including the invited person’s email; its tiers, plan and usage; and what it has connected. For YouTube, Patreon and Discord connections we store the tokens the platform issues, encrypted, plus what the connection needs: your YouTube channel id and name and the videos we import or upload for you; your Patreon campaign, its tiers, imported posts and media links, and the membership records Patreon sends us about your patrons; your Discord server, its roles and channels, and the role assignments we make.

What you do here

Posts, comments, discussion threads, polls and votes, requests and request votes, likes, bookmarks, follows and subscriptions, the titles you follow, your watch progress and watch history, spoiler flags, the people and channels you block or mute, reports you file, your notification settings, and when you last opened your feed. If you watch while signed out, watch progress is tied to a random session key rather than to you.

Messages

Direct messages, channel inbox conversations, broadcasts and attachments; who is in each conversation; read times, message requests, blocks and reports; and your messaging preferences. Channel teams can also keep inbox notes, assignments and saved replies.

Captions, chapters and title suggestions

When these features run, we send audio from uploaded videos to OpenRouter and its model providers to generate captions, caption transcripts to generate chapters, and post titles to suggest matching films or shows. We store the generated captions, chapters and processing records. OpenRouter logs request and response content for debugging and forwards AI request traces to Sentry.

Payments

Stripe processes payments and payouts and handles card details. We keep Stripe customer, account, payment and subscription ids, what was bought, amounts, currencies, taxes, dates and status, and refund and dispute records.

Technical

Each signed-in session records its IP address and browser, and your settings show both so you can recognise a session and sign it out. We also collect request diagnostics to investigate errors and security problems. A cookie gives each day of use a random analytics id (section 8). The extension sends its version, your browser’s name, and which supported sites it finds you signed in to (section 9).

We collect error reports, performance measurements, browser and device details, and page URLs to diagnose problems. Browser performance measurements follow your analytics choice. When replay is enabled under the preferences and regional defaults described in section 8, we also collect replays of page interactions, including sessions where an error occurs. Replay text and form inputs are masked, and media is blocked before the recording is sent to Sentry.

Copyright notices and support

A copyright notice or counter-notice includes the name, contact details and statements the law requires, and we keep the record. Email you send us is kept with your support history.

• Mostly from you: what you enter, post, watch and click.
• From the services you connect: Google and YouTube, Patreon and Discord send us the profile data, tokens and membership records described above, within the scopes you approve.
• From creators and other users: a creator can invite you by email, grant you complimentary access, or report your content; other users can reply to you, report you, or block you.
• From public catalog sources: titles, cast and crew, artwork and where to watch come from TMDB, Wikidata, JustWatch data, Movie of the Night, TheDiscDB and similar sources. That is data about films, shows and public figures, not about you.

• To run the Service: sign you in, show your feed, resume where you stopped watching, deliver the content you are entitled to, keep tiers in step with Patreon and Discord, and publish where a channel asks us to.
• To send you the notifications you have chosen, and the few we must send: security, account and legal notices. Every notification email has an unsubscribe link. Account emails cannot be switched off while you have an account.
• To help people find things: your public profile, your comments, and, if you switch them on, the channels you follow and the reactions you have watched.
• To promote Catalyst: a channel’s public name, branding and public content may appear in our marketing, as the terms describe. A channel can ask to be left out.
• To keep the Service safe: handle reports, enforce the terms, limit abuse and spam, process copyright notices, and investigate security incidents.
• To process payments, subscriptions, payouts and refunds, and to keep the records tax and accounting law require.
• To understand how the Service is used, through our analytics and PostHog (section 8). Creators see their channel’s analytics in aggregate; those dashboards never name individual viewers.
• To find and fix errors and performance problems, using diagnostic data and replays.
• To generate captions, chapters and title suggestions for creator content.
• To meet legal obligations and to establish or defend legal claims.

We do not use your data to show you ads, and we do not sell it.

If you are in the European Economic Area, the United Kingdom or another place with a similar law, these are the grounds we rely on:

• Contract: most of what we do is needed to provide the Service you signed up for.
• Legitimate interests: keeping the Service safe and working, understanding how it is used, and improving it, balanced against your interests.
• Consent: the optional parts. Connecting a platform, each extension capability, the public sections of your profile, and non-essential notifications. You can withdraw consent at any time where you gave it.
• Legal obligation: copyright records, tax and accounting records, and responding to lawful requests.

Everyone

Your public profile shows your avatar, display name, bio, join date, and channel team memberships marked for display. Your comments, discussion posts and requests appear under your name. The channels you follow or subscribe to and the reactions you have watched are shown only if you switch those sections on, and your tier is never shown.

The channels you follow or subscribe to

A channel’s staff can see that you follow or subscribe, which tier you hold and since when, under your display name and username. They do not see your email address. They see your comments and reports on their channel, and whether your access came from a Patreon membership. Their analytics are aggregate. A channel export includes its subscriber list as usernames and tiers, community content, and conversations with the channel, including messages, attachments and inbox notes.

People you message

Messages and attachments are visible to the other participants. Messages sent to a channel inbox are shared with channel team members who have inbox access. In direct conversations, read receipts and typing indicators are shown when both people have those settings enabled.

Platforms you connect

When a channel publishes to YouTube or Patreon through us, that content goes to the platform. When you join a channel’s Discord server or a role is synced, your Discord id is used to add you to the server and set your roles there.

Service providers

The companies in section 7, each for the job named there.

When the law requires

We disclose data when the law requires it, to respond to a valid legal request, to enforce our terms, or to protect someone’s safety. If Catalyst is ever sold or merged, your data goes with it under this policy, and we will tell you.

These services receive or process data for the purposes described below. Connected platforms and external content providers also have their own privacy policies.

• DigitalOcean runs our servers and database.
• Cloudflare sits in front of the Service, handles DNS and certificates for channel domains, stores images and export archives, and applies rate limits by IP address.
• Bunny.net stores, encodes and delivers video. Each channel has its own library, and playback uses signed, expiring URLs.
• Stripe processes payments and payouts.
• Postmark delivers our email.
• Sentry processes error reports, performance measurements and masked session replays, along with AI request traces, so we can diagnose and fix problems.
• PostHog processes optional usage analytics in its US Cloud: page categories, selected product actions, browser and device details, and traffic sources. Signed-in activity uses your internal account id, without your name or email. PostHog receives your IP address when your browser sends events. We do not enable PostHog session recording.
• OpenRouter and its model providers process uploaded audio, caption transcripts and post titles for captions, chapters and title suggestions.
• Google Fonts serves the fonts on every page, so your browser sends its IP address to Google when a page loads.
• YouTube and Vimeo serve embedded videos. Loading and using their players sends your IP address, browser information and playback interactions to the provider, which processes them under its own privacy policy.
• TMDB serves title artwork and Movie of the Night serves streaming-service logos straight to your browser. Loading these images sends your IP address to the image provider. Avatars from Google, Discord, Patreon and YouTube load from those services in the same way.

We use our own cookies for sign-in, preferences and analytics. Embedded video providers may also use browser storage when their players load or play.

• Session cookie: keeps you signed in. It is HttpOnly, lasts up to 30 days, and is renewed as you use the Service.
• Analytics cookie (catalyst_analytics): when analytics are enabled, a random id that expires after 24 hours, so that a day’s views count once. We store only a hash of it. The events it labels, such as views, watch progress and likes, are kept for 400 days, then only as totals.
• Privacy preference cookie (catalyst_privacy): remembers your analytics and replay choices for 180 days. Each site domain keeps its own preference.
• Watch-region cookies (catalyst_watch_region and catalyst_watch_region_confirmed): remember your region and whether you explicitly selected it. They expire after one year and let streaming availability load with the page.
• Channel-domain cookies: a channel site at its own domain sets its own session cookie there, plus a sign-in cookie that lasts ten minutes while you sign in through Catalyst.

Your browser’s local storage holds preferences such as your watch region, the sync view you chose, recent searches, theatre mode, and the state of an upload in progress. They stay on your device.

When analytics are enabled, PostHog also stores browser and session identifiers in local and session storage to measure returning visits and product adoption. Signing in connects that browser’s activity to your account id. Signing out resets those identifiers. Turning analytics off clears PostHog’s stored analytics identifiers; otherwise they remain until you clear the site’s storage. Each channel domain has separate browser storage.

When replay is enabled, Sentry uses browser session storage to keep a recording associated with the same session across page reloads. Replay excludes account, messaging, admin and Studio pages, and URLs containing query or fragment values.

Usage analytics and masked session replay default to on for visitors identified as being in the United States, with an opt-out. Elsewhere, or when we cannot determine a location, both wait for your choice. Signing in does not change these defaults. Do Not Track and Global Privacy Control signals keep optional analytics and replay off. Use “Privacy choices” in the footer to change your preferences. Turning a purpose off stops further optional collection; it does not erase data already received. Essential security, error reporting, transaction records and signed-in watch history remain active. We do not use your data for cross-site advertising.

The Catalyst browser extension pairs a browser with your account. It is built to act only inside your own signed-in sessions on the sites it supports, and to know as little as it can.

What it stores on your device

A device token for the pairing, your user id, display name and username, your settings for each capability, when it last checked in, and, for creators, a journal of Patreon publishing work in progress, pending publishing tasks and recent publishing results. It also stores your Auto Sync layout preferences. Uninstalling the extension removes this browser's extension storage.

What it sends to us

• A heartbeat with its version, your browser’s name, and which supported sites it finds you signed in to, so the product can tell you what is ready.
• For Auto Sync: which reaction you are syncing and what title the streaming service has open, as the service’s own title id, the title and episode names, the running time, and the title’s canonical URL. Live playback controls run in your browser. Playback snapshots, including position, timing and playback state, can also be sent when saving playback metadata or confirming a sync alignment.
• For creators publishing to Patreon or YouTube: task progress, the resulting post's id or URL, and error details, so the studio can show what happened. Publishing uses your signed-in session on the platform; YouTube access is granted separately.

What it never does

It never sees, stores or sends your passwords or two-factor codes for any site. It never records or decrypts the streaming service's video or audio, and it never captures your screen. It can load and play a Catalyst reaction alongside the streaming player. On the streaming service it reads title and playback information and controls playback. Each streaming service needs your permission separately.

Your control

You can turn each capability off in the extension, revoke the pairing from your account settings, or uninstall the extension. We can also disable a capability remotely if a site changes or asks us to. The extension’s use of data is limited to the features described here. We do not sell it or use it for advertising.

Catalyst uses YouTube API Services. Signing in with Google gives us your Google account id, email, name and avatar. Signing in with YouTube adds read-only access that tells us your YouTube channel id. A channel that connects YouTube can import its videos as drafts. Publishing grants access to upload and manage videos and receive new-upload notifications. The extension can also publish public text posts through your signed-in YouTube session when you enable that capability. We use this access for the features you ask us to provide.

Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can see and revoke our access at any time on Google’s security settings page, as well as in your Catalyst settings. Disconnecting a channel removes its stored authorization tokens and cached import catalogue, and stops future imports and publishing through that connection. Removing Google sign-in, disconnecting YouTube, or requesting account deletion also queues revocation of Catalyst’s permissions with Google. Google applies this to the Google account’s connection to Catalyst as a whole, so other linked channels may need reconnecting. We retry if Google cannot be reached. The credentials needed for withdrawal remain encrypted until Google confirms revocation or reports the supplied tokens are already invalid. Requesting account deletion also disconnects YouTube connections authorized by that account. We also check connected channels for revoked access and apply the same local cleanup when we detect it. For new YouTube-first imports, untouched imported text and video details refresh weekly. Editing a field here stops those updates. If source data cannot be refreshed for 29 days, or six days after disconnecting, cleanup removes unchanged imported text and playback details. Generated post URLs can change, and old imported URL aliases are removed. Content and video links you edit or confirm here, your chapters, and post records remain. Other import and publishing records follow the same refresh and expiry rules when they came from the YouTube API; links you supplied independently and browser publishing receipts remain. Disconnect also removes the stored YouTube channel identity and permissions. To request deletion of retained Google or YouTube data, contact us using the details in section 17. The YouTube Terms of Service and the Google Privacy Policy also apply.

• Your account: until you delete it. Deletion has a 30-day grace period during which you can ask us to cancel it. After it we replace your name and email, clear your avatar, bio and username, end your sessions, remove your linked sign-ins, and strip your id from our own analytics. We also remove your passkey and two-factor credentials. Your comments and discussion posts stay with an anonymous author unless you delete them first, and channel content stays with the channel.
• Messages: messages deleted for everyone have a 30-day recovery period before their content is erased. Message-only attachments are removed once no message or retained report needs them. Hiding a message only for yourself leaves the other party's copy. Reported message evidence is held while the report is unresolved and for 90 days after resolution. Abandoned message uploads are removed after one day. After account anonymization, we clear personal read timestamps and inbox preferences while retaining the routing records needed for shared messages. Channel inbox notes remain until the channel deletes them; removed authors are anonymized.
• Sessions: up to 30 days without use, or until you sign out.
• Request logs: up to 90 days.
• Support email: routine correspondence is kept for up to 12 months after the request is resolved. Billing, legal and security records are kept for as long as needed for those purposes.
• Sentry diagnostics: error events, performance traces and session replays are retained for 30 days under our current plan.
• AI debugging logs: OpenRouter retains request and response content for at least three months and may keep it longer unless we request deletion. You can request deletion through the contact details in section 17.
• Catalyst analytics events: 400 days as individual events, then as totals only.
• PostHog usage analytics: retained under our PostHog project’s retention settings. You can request deletion through the contact details in section 17.
• Video: for as long as the post exists. Replaced versions follow the channel's video-library retention settings; the default is 30 days, with limits on the number of retained versions. Content removed under a copyright notice is kept, unplayable, through the counter-notice window.
• Copyright records: notices, counter-notices, actions and strikes are kept as a legal record for as long as the law may need them.
• Payment records: as long as tax and accounting law requires.
• Channel exports: archives are available for up to seven days and expire earlier when connected data in them is changed or withdrawn. Signed download links cannot outlive that window. Expired archives are removed by a cleanup job, which retries if storage is temporarily unavailable.
• Backups: database backup files expire after 30 days. Data removed from the live database may remain in an older backup until it expires.

Wherever you live, you can:

• See and change your account data in your settings, including your email, username, profile, privacy sections and notification preferences.
• Revoke any connected platform from your settings, or from that platform.
• Sign out of any session and revoke any paired browser.
• Delete your account from your settings. A channel’s owner can export the channel’s content from the studio before deleting the channel.
• Ask us for a copy of the personal data we hold about you, to correct it, or to delete it, by emailing [email protected]. We may ask you to confirm you own the account first, and we answer within a month.

If you are in the EEA, the UK or Switzerland, you also have the right to restrict or object to processing, to data portability, to withdraw consent, and to complain to your data protection authority. If you are in California, you have the rights to know, to delete, to correct, and to equal service. We do not sell personal information or share it for advertising across other sites. You can turn off optional analytics and replay through “Privacy choices”. Other states and countries give similar rights, and we honour them the same way: email us.

Catalyst is not for children under 13, and we do not knowingly collect their data. If a child under that age has an account, tell us at [email protected] and we will delete it.

Our servers and database are in United States. Video and images are delivered from Bunny.net’s and Cloudflare’s networks around the world, from the location nearest you. If you are in the EEA, the UK or Switzerland and your data is moved outside, we rely on the European Commission’s standard contractual clauses, the UK addendum, or an adequacy decision, as the law requires.

Everything travels over HTTPS. Passwords are stored as hashes. Social-login access and refresh tokens, channel integration tokens and video-hosting credentials are encrypted at rest with keys held outside the database. Access to production data is limited to the people who need it. You can see your active sessions and paired browsers and end any of them. No system is perfectly secure. If you find a weakness, email [email protected] and give us time to fix it before telling others. If a breach affects you, we will tell you, and any authority the law requires.

We will update this policy as the Service changes. The date at the top shows when it last changed. For a material change we give at least 14 days’ notice by email or in the app before it takes effect.

Privacy questions and requests: [email protected]. Security: [email protected]. Everything else: [email protected].

By post: SFCO, LLC, 1500 N Grant St #12185, Denver, CO 80203, United States.