Skip to content

Search dramas

Privacy policy

Version 1 · Effective 29 October 2026

This policy explains the personal data SinReels processes when you watch, sign in, follow dramas and get notifications: why, for how long, who else takes part, and your rights under Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.

Controller and contact

The operator of SinReels (“we”) is the controller and processor of the personal data described here. Please send any question or request about your personal data by email.

A contact email will be listed here soon.

Data we process

You can watch without an account. Depending on how you use the site, we process:

  • Your Google profile when you sign in: name, email address, profile picture and Google account identifier, plus the tokens Google issues at sign-in (used only for signing in; access and refresh tokens are stored encrypted; the ID token is not kept).
  • The display name you choose and your email digest choice.
  • Watch activity: progress per episode (position, length, finished or not), the episode you are on for each drama, likes and saved dramas.
  • Dramas you follow and the new-episode notifications we send you (with their read state).
  • Push subscriptions: the delivery address issued by your browser and its encryption keys, tied to your signed-in session on that device.
  • Consent records: what you agreed to (privacy policy and terms, being 16 or older, email digest, push notifications), the version, the time and your browser details.
  • Sessions: IP address, browser details (user agent), creation and expiry times.
  • IP addresses in rate-limit counters used against abuse.
  • Server access logs: truncated IP address (IPv4 without its last number, IPv6 only its first 48 bits), browser details, the page requested (without query parameters) and the time, used to run the site and investigate incidents. When the server fails to handle a request, its error log records the full IP address and the requested path with its parameters for that request only, to fix the problem.
  • The identifier cookies listed under Cookies.

Purposes and legal basis

We do not sell personal data, do not use your data to build advertising profiles, and never turn any consent on by default.

  • Providing your account and syncing watch progress, library, follows and in-app notifications: based on the consent you give at sign-up and to deliver the service you ask for.
  • Sending push notifications and the daily email digest: only when you turn them on, based on a separate consent for each channel.
  • Remembering progress and library before you sign in (guest cookie): to provide the feature you are using.
  • Security, abuse prevention, rate limiting and keeping proof of consent: to protect the service and comply with the law.

How long we keep data

  • Your account and the data tied to it (profile, watch progress, likes, saved dramas, follows, consent records): until you delete your account.
  • Sessions (with IP and browser details): expire 30 days after last use; the session record is deleted when you sign out, sign out other devices or delete your account, and at the latest 7 days after the session expires.
  • Notifications: read ones are deleted 90 days after being read; all are deleted 180 days after their last update.
  • Push subscriptions: deleted when you turn push off, sign out on that device, the push service reports the address as gone, or after 180 days without a successful delivery.
  • Guest data (before sign-in): deleted after 180 days of inactivity. When you sign in, it is merged into your account and the guest copy is deleted.
  • Rate-limit counters (containing IP addresses): expire within 24 hours at most.
  • Server access and error logs: rotated and overwritten automatically by size.

Processors and transfers abroad

We use the providers below. Some run servers outside Vietnam, so the related data may be transferred abroad:

  • Hosting provider: runs the servers holding the site, database and logs, i.e. all the data above.
  • Google: handles signing in with Google and returns your profile.
  • Cloudflare: delivery network and protection for the site; every request, including your IP address, passes through Cloudflare.
  • Browser push services (Google Firebase Cloud Messaging, Apple, Mozilla, Microsoft): deliver new-episode notifications (drama title, episode number) to your device when push is on.
  • Email relay service (when the email digest feature is enabled): receives your email address and the digest content.
  • Video source platforms: videos may load directly from their servers, which then receive your IP address and browser details.

Cookies and on-device storage

We only use cookies the features need — no analytics or advertising cookies of our own:

  • Session cookie (not readable by JavaScript): keeps you signed in and expires 30 days after last use; plus a session cache (refreshed every 5 minutes) and a short-lived cookie holding the Google sign-in state.
  • has_session: tells the page you are signed in without loading the sign-in code; 30 days.
  • gid (signed, not readable by JavaScript): an anonymous guest identifier that remembers progress, library and likes before you sign in. Created only once you start watching or interacting; up to 400 days; deleted after its data is merged into your account.
  • has_gid: tells the page the device has guest data; same lifetime as gid.
  • Browser local storage: volume, autoplay-next preference, ad frequency counters, episode unlock state and the temporary state of account actions. These stay on your device and are never sent to our servers.
  • When you turn push notifications on, your browser installs the site’s service worker to receive and show them.

Advertising

Third-party ad networks may set their own cookies under their own privacy policies. You can block third-party cookies in your browser settings.

Your rights

You have the right to be informed, to give or withdraw consent, to access, view and get a copy of, correct, delete, restrict or object to the processing of your personal data.

  • Self-service, effective immediately, on the Account page: download a copy of your data (JSON file), edit your display name, turn the email digest on or off, sign out other devices, delete your account.
  • By email: we acknowledge your request within 2 working days; provide data or a copy within 10 days (extendable by 10 days); handle withdrawal or restriction within 15 days; delete data within 20 days (extendable by 20 days), as set out in Article 5 of Decree 356/2025/ND-CP.
Open the Account page

Withdrawing consent

Withdrawing consent does not affect processing lawfully carried out before.

  • Email digest: turn the switch off on the Account page.
  • Push notifications: turn push off on the site, or block the site’s notification permission in your browser settings.
  • Privacy policy, terms and all your data: delete your account.

Children

SinReels accounts are only for people aged 16 or older. You confirm your age yourself at sign-up; we do not collect your date of birth. When we learn that an account belongs to someone under 16, we delete it together with all related data. Parents or guardians can contact us to request deletion.

Security and breach notification

Connections to the site are encrypted (HTTPS); the session cookie is not readable by JavaScript; Google access and refresh tokens are encrypted at rest and the Google ID token is not kept; data exports contain no session tokens or push keys.

If a personal data breach happens, we notify the personal data protection authority (Department of Cybersecurity and High-Tech Crime Prevention — A05, Ministry of Public Security) within 72 hours of discovering it, and notify you when the breach may affect your rights.

Complaints

If you believe your rights have been violated, contact us by email so we can resolve it. You may also complain to the personal data protection authority (A05, Ministry of Public Security) or take legal action as the law provides.

Changes to this policy

When we change this policy in a material way, we update this page with a new version number and effective date. If a change needs new consent, we ask you before it applies.

  • 29 October 2026 — Version 1: Google accounts, following dramas, notifications (in-app, push, email digest), self-service data export and deletion; updated for Law 91/2025/QH15 and Decree 356/2025/ND-CP.