Privacy across the viewer and founder paths.

When the released-film player component loads, it creates or reuses a random browser value and keeps the raw value in browser storage. The SHA-256 hash is sent only when the player records a playback event or the viewer submits feedback. Loading the player alone does not send the hash.

Playback events can identify the release and release version, the event type, a playback position, and an idempotency key. Current event types cover start, progress points, completion, replay, next episode, and abandonment.

A viewer can submit a reaction or written feedback from the player. The record can include the hashed browser value, release and version identifiers, reaction, message body, and the playback position at which it was sent.

Feedback is an intentional submission to the Throughline API. The player does not ask for a public viewer email, and the feedback control belongs to the released-film interface rather than the public contact page.

Supabase handles founder sign-in, and Throughline uses session cookies so browser and server routes can read the current session. The Studio reads the account identifier and email, then checks workspace membership and role before protected work is shown.

Founders create production records such as series, episodes, shot briefs, assets, workflow choices, jobs, timeline revisions, comments, renders, and releases. Those records include the account or workspace identifiers needed to scope and attribute the work.

Invitation and account-recovery flows can receive tokens in a link query or fragment while the flow is completed. The interface captures the needed value in memory and removes authentication fragments from the displayed URL; server records use token hashes for completion checks.

An unlisted preview link carries its token in the URL path, and the API hashes the submitted token. A successful lookup atomically consumes the matching token from a published unlisted release.

Each unlisted link can be opened once. Publishing an unlisted release again issues a new token; unpublishing clears any unused token.

A viewer can clear site data to remove the raw random browser value and saved interface theme. A founder can use the sign-out action to end the current browser session and will need a valid account and workspace membership to return to protected routes.

This product notice does not add commitments beyond the behavior described here. A direct privacy contact appears on the Contact page only when a public address has been configured for the application.

The service policy for young viewers and family privacy is under legal review. Until counsel approves one, this page states no age rule, no verification process, and no regulatory commitment.

Today the product has no age check at sign-in or playback, collects no guardianship information, and offers no dedicated queue for guardian requests.

Questions about family privacy go through the Contact page, which shows a direct address only when one is configured for the application.

When Supabase authentication is configured and a founder signs in, the application uses cookies to make that session available to browser and server code. Public browsing does not require a founder account or create a founder session.

The public player creates or reuses a random value under the throughline-viewer key in browser storage; the raw value stays in the browser and only its SHA-256 hash travels with playback events and feedback. The theme control can save the chosen light or dark theme the same way.

Browser controls can clear Throughline cookies and browser storage. Clearing site data can sign a founder out, remove the saved theme, and cause the player to create a new random viewer value on a later visit. The site has no separate cookie-preference panel.