Privacy and data handling
This page describes the current application behavior reflected in the TrackUp repository. It is an implementation summary, not a substitute for a formal legal notice or advice.
TrackUp uses sovereign server-side credentials and sessions for sign-in. The server validates the user's argon2id password hash, issues an HTTP-only signed session cookie, and validates the session, user active status, and RBAC role from the database on protected requests.
When a video is added, TrackUp stores the video metadata needed for its scoped library and internal viewer. Authorized viewing can create a watch session and persisted playback events. Detailed position, duration, watch time, completion, and ranges are shown only when the provider supplies reliable telemetry.
Organization, Space, video, Watch Link, session, event, and analytics access is checked server-side. Service-role database access stays on the server. Raw provider tokens, session secrets, cookies, and opaque Watch Link tokens are not returned in analytics responses.
TrackUp does not treat a page open as proof of playback. Google Drive and Telegram currently provide session-only measurement in the provider registry; YouTube, Vimeo, and native direct media can provide detailed telemetry only when their callbacks are available and persisted.
Historical records are retained by the current application and may include legacy compatibility fields. Legacy guest-viewer and Organization-container artifacts are not reintroduced as an active authorization path.
For a security issue, use the project support path and do not publish secrets, cookies, tokens, or private viewer data in a public issue.