Cooking Videos

Privacy Policy

Effective date: April 22, 2026

1. About this notice

This Personal Information Collection (PIC) statement is published by Cooking Videos ("we", "our", "the service") in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and tells you what data we collect, why, and your rights.

2. Data we collect

  • Account data: your email address, and (if you sign in with Google) the name and profile picture Google shares with us.
  • Submissions: the video URLs you paste, the source platform's public metadata for those URLs (title, description, author, thumbnail, captions), and content we generate from them (English subtitles, recipes, English narration audio).
  • Activity: which videos you save, your credit balance and transaction log, and your preferences (subtitle position/size, playback speed, language).
  • Payment: when you buy a top-up pack, payment is handled by Stripe. We never see or store your card details — Stripe sends us only an anonymous customer ID and the result of the transaction.
  • Technical: server logs (IP address, request path, user-agent, timestamp) for diagnostics; one HTTP-only session cookie to keep you signed in.

3. Why we collect it (purposes of use)

  • Operate the service: process the videos you submit and serve them back to you.
  • Authenticate you and keep your sign-in session.
  • Track your credit balance, grant the signup bonus, charge spends, refund failures.
  • Process payments via Stripe.
  • Send transactional emails (sign-in codes, payment receipts).
  • Investigate abuse, debug failures, comply with law.

We do not use your data for direct marketing. If we ever wanted to (for example to email you product updates), we would ask you to opt in first, as required by the PDPO.

4. Who we share data with

  • Volcengine (火山引擎, ByteDance, mainland China) — runs the AI models that transcribe, translate, generate narration and extract recipes from your submitted videos. Also hosts the video and subtitle files (TOS object storage). Submitted video metadata + audio + generated subtitles are sent there.
  • Resend (United States) — sends our transactional emails (sign-in codes, receipts). Receives your email address and the email body.
  • Stripe (United States / Ireland) — processes payments. Receives your email and payment instrument details (entered on Stripe-hosted pages we do not see).
  • Google (only if you sign in with Google SSO) — authenticates you and shares your name, email and profile picture with us.

We do not sell your data and do not share it with anyone else for their own purposes.

5. Cross-border data transfer (PDPO s. 33)

By using the service you acknowledge and consent that the data described above is transferred outside Hong Kong — primarily to mainland China (Volcengine), the United States(Resend, Stripe, Google) and any other country where these vendors process data. We rely on each vendor's own data-protection commitments and contractual safeguards.

6. How long we keep it

  • Videos and generated content: kept indefinitely while your account is active. You can delete a video at any time from the video page.
  • Account data: kept while your account exists. Deleting your account erases your videos, list, credits, transaction log and login records within 30 days (allow time for backup rotation).
  • Payment records: kept for at least 7 years for tax / accounting compliance.
  • Server logs: rotated after about 30 days.

7. Security

We use HTTPS, hashed sign-in tokens, signed JWT sessions, server-side rate limiting on login, and encrypted storage at our cloud vendor. No system is 100% secure — please use a strong, unique password on the email account you sign in with.

8. Your rights under the PDPO

You have the right to:

  • ask whether we hold any of your personal data;
  • be given a copy of that data;
  • ask us to correct it if it's wrong;
  • ask us to erase it (subject to legal retention obligations).

To exercise any of these rights, email [email protected] from the address on your account. We will respond within 40 days as required by the PDPO. There is no charge for a reasonable request.

9. Cookies and local storage

  • One HTTP-only session cookie (Auth.js) — required to stay signed in.
  • A few items in browser localStorage for your preferences (last email, language, subtitle settings). These never leave your browser.

10. Children

The service is intended for users aged 13 and above.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page. The "effective date" at the top is always the latest version.

12. Contact

Questions, complaints or requests: [email protected]. For more on PDPO see the Hong Kong Privacy Commissioner's website.