srt·flow

Privacy Policy

Last updated: 18 July 2026

srt-flow (“we”, “us”, “the Service”) is operated as a sole proprietorship by Zhibin Huang, located in Quebec, Canada. This policy explains what personal information we collect, why, who we share it with, and your rights. For any privacy question or request, contact [email protected]. This is also our designated privacy contact under Quebec’s Law 25.

1. What we collect

  • Email address and Google subject ID (via Google sign-in).
  • IP address (security, rate-limiting, abuse prevention).
  • Uploaded subtitle (.srt) files, their text, and the translation output.
  • Payment records and credit balance (via Stripe).
  • First-party analytics identifiers (anon_id, session_id) and usage events.

We do not collect passwords (sign-in is Google OAuth only). With your consent, we use Google Ads conversion tracking to measure the effectiveness of our advertising. These cookies load only after you accept them in the consent banner and are never set if you decline. We use no other third-party advertising or analytics trackers.

2. Card payments

Card details are collected and processed by Stripe. We never see or store your full card number.

3. How your subtitle text is processed — please read

To translate your file, the subtitle text you upload is sent to our LLM provider, DeepSeek (api.deepseek.com, operated from China).

  • DeepSeek may use submitted text to train and improve its models.
  • Your subtitle text therefore leaves our systems, is transferred to a provider in China, and may be retained and used by that provider.
  • Do not upload subtitle files containing sensitive, confidential, or personal information you are not comfortable sharing under these terms.
  • China has no data-protection adequacy decision under the GDPR or Quebec Law 25. By uploading, you consent to this cross-border transfer as necessary to provide the Service you request. If you are an EU/UK/EEA user and do not consent, do not upload files.

4. Sub-processors

  • Google — sign-in / identity (USA).
  • Stripe — payments (USA / global).
  • DeepSeek — LLM translation (China).
  • Cloudflare — network / email routing (global).

5. Retention

Uploaded files and translation output are deleted automatically 30 days after the job is created; you may request earlier deletion at any time. Analytics event identity fields are scrubbed at 365 days. Account and billing records are retained while your account exists and as required by tax/accounting law.

6. Your rights

Depending on where you live (PIPEDA, Quebec Law 25, GDPR, CCPA) you may access, correct, delete, or port your personal information, and withdraw consent. To delete your account and associated data, or exercise any other right, email [email protected]. We respond within the timeframe required by applicable law.

7. Cookies & local storage

We use first-party local storage for an anon_id and session_id to measure product usage; when you sign in, the anon_id is associated with your account server-side. We use no third-party or advertising cookies. Sign-in uses a secure, HttpOnly session cookie required for the Service to function.

8. Security

Sign-in via Google OAuth (no passwords). Session cookies are HttpOnly, Secure, SameSite=lax. Uploads are size- and type-restricted with path-traversal guards.

9. Changes

We may update this policy; the “last updated” date will change and material changes will be surfaced in-app.

10. Contact

[email protected] — Quebec, Canada.