Privacy Policy

Last updated: 23 September, 2026

This policy explains how Upstream Media Co-operative Inc. ("Upstream", "we", "us") handles personal information when you use our streaming service, websites, and applications. We follow PIPEDA and applicable provincial privacy law, including Quebec's private-sector privacy law.

1. Information We Collect

  • Account information, including your email address and account settings. Sign-in is passwordless, so Upstream does not store a password.
  • Billing information, including subscription tier, purchases, rentals, billing status, and transaction references. Stripe processes payment cards; Upstream does not receive your full card number.
  • Viewing information, including titles watched, playback position, session duration, and completion.
  • Advertising events if an ad-supported model is offered, including ads served and playback events.
  • Approximate country or region used to enforce territorial availability.
  • Device and technical data, including browser type, generated anonymous and per-session identifiers, IP address, and diagnostic or error logs.
  • Communications you send to support and your email preferences.

2. How We Use Information

We use personal information to authenticate accounts; deliver playback and resume features; enforce entitlements and territorial rights; process transactions; secure, operate, and improve the Service; and communicate about accounts and service changes.

For subscription accounting, each paid service-period slice is associated with that subscriber's qualifying viewing during the same service window. The complete net slice after tax and payment-processing fees is attributed among qualifying titles by an automated completion-and-category score. The applicable title licence percentage is then applied once to calculate rights-holder earnings. If no title qualifies, the slice is recorded as retained by Upstream. Rights holders receive aggregate title and payment statements; they do not receive a viewer's identity or individual viewing history.

3. Consent

We collect, use, and disclose personal information with consent or as otherwise permitted or required by law. You may withdraw consent, subject to legal or contractual restrictions, although that may limit our ability to provide the Service.

4. How We Share Information

We do not sell personal information. We use service providers including Supabase (database and authentication), Stripe (payments), Bunny Stream (video delivery), Sentry (error monitoring), Upstash (rate limiting), and Resend (transactional email). We may also disclose information where law requires it, to protect rights or safety, or in a lawful reorganization of the Service.

5. International Processing

Some providers process information outside Canada, including in the United States and European Union. Information there may be subject to local laws and lawful access by authorities. We use contractual and technical safeguards designed to provide comparable protection.

6. Retention

We keep personal information only as long as needed for these purposes or legal obligations. Viewing and allocation records used for rights-holder accounting are financial records: they may be retained long enough to calculate, audit, correct, and substantiate payments and meet tax and accounting obligations. Account-deletion requests are handled subject to those obligations. Settled finance records are not promised to be deleted or de-identified until Upstream has implemented and verified a procedure that preserves their audit and reconciliation value. Rights-holder reports remain aggregated.

7. Your Rights

Subject to applicable law, you may request access to or correction of your personal information, withdraw consent, or request deletion of your account. Quebec residents may also request information about automated processing and data portability. Contact legal@upstream.movie. You may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

8. Cookies and Similar Technologies

We use necessary cookies and browser storage for authentication and playback, plus generated identifiers for session continuity and operational analytics. Where non-essential technologies are used, we provide notice and choice as required by law. Private-browsing modes may receive degraded functionality where storage is unavailable.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information.

10. Security

Safeguards include encryption in transit, database row-level access controls, server-side entitlement checks, and least-privilege staff access. No system is perfectly secure. We will provide legally required breach notices.

11. Changes and Contact

We may update this policy and will post a revised date, with additional notice for material changes where required. Questions and rights requests may be sent to: Privacy Officer, Upstream Media Co-operative Inc., Toronto, Ontario, legal@upstream.movie.