Privacy & Safety
This is WavePlay’s notice under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). It sets out exactly what personal data we collect, why, how long we keep it, who else sees it, and the rights you have over it. We have tried to describe what the platform actually does rather than what a privacy policy usually says — if something here does not match your experience, please tell us.
Who we are
WavePlay is an independently operated video streaming platform based in India, reachable at waveplay.in. For the purposes of the DPDP Act, WavePlay is the Data Fiduciary for the personal data described on this page — meaning we decide why and how it is processed, and we are accountable for it.
Every privacy question, request or complaint goes to one address: contact@waveplay.in. See Complaints and grievance redressal below for how that works and what to do if you are not satisfied with our response.
What personal data we collect
Section 5 of the DPDP Act requires an itemised description rather than a general one, so here is the full list.
1. What you give us when you create an account
All of the following are required to sign up — none of them are optional:
| Data | Why we need it |
|---|---|
| First and last name | To identify the account holder and support recovery and grievance handling. |
| Channel name and username | Your public identity on WavePlay. Both are visible to everyone. |
| Email address | Account verification, sign-in codes, password recovery and service notifications. |
| Mobile number | Account identification and recovery. We do not send SMS — see the note below. |
| Date of birth | To confirm you meet the 18+ requirement, and to apply protections to accounts that predate it. |
| Gender | Aggregate audience statistics shown to administrators. Never shown on your profile. |
| Password | Stored only as a bcrypt hash. We never hold your password in a readable form and cannot recover it for you. |
About your mobile number: we collect it but currently send nothing to it. SMS delivery in India requires DLT registration that WavePlay does not hold, so all codes and notices go by email only. If you would rather we did not hold your number at all, write to us and we will remove it.
2. What you create on the platform
Videos, thumbnails, subtitles and the metadata you attach to them (title, description, tags, category, schedule); playlists, collections and series; comments, replies, reactions, poll answers and Vibe Check ratings; who you Ride Along with; and your profile bio and picture. Most of this is public by design — that is the point of publishing.
3. What is recorded as you use WavePlay
localStorage on your device, never sent to us, and cleared by the Clear button on the search box.localStorage on your own device and is never sent to us. Your light/dark theme choice is saved to your account when you are signed in, so it follows you between devices.4. What we do not do
- We do not sell your personal data, and we never will.
- We run no advertising and no advertising trackers — there is no ad network on WavePlay.
- We do not build profiles for anyone other than to power your own recommendations and your own creator analytics.
- We do not ask for and do not want financial information, government identifiers, or biometric data. Please never send these to us.
Why we collect it, and on what basis
Under section 6 of the DPDP Act we process your personal data on the basis of the consent you give when you create your account, for the purposes below and no others:
- To create and authenticate your account and keep your session secure
- To publish the content you choose to publish, at the visibility you choose for it
- To power your History, Continue Watching, recommendations, trending and the Riding feed
- To show you notifications you asked for, and service emails about your own account
- To give you analytics about your own channel — views, likes and comments on videos you uploaded
- To show administrators aggregate, non-identifying audience statistics for the platform as a whole
- To detect, investigate and act on abuse, spam, fraud and breaches of our guidelines
- To meet legal obligations and to establish or defend legal claims where we must
You can withdraw your consent at any time, as easily as you gave it — see Your rights. Withdrawing consent for the core purposes above means closing your account, because we cannot run an account without processing the data that makes it work.
Age requirement — WavePlay is 18+
You must be at least 18 years old to create a WavePlay account. Section 2(f) of the DPDP Act treats everyone under eighteen as a child, and section 9(1) requires verifiable parental consent before a child’s personal data may be processed at all. A tick-box does not meet that standard, and building a genuine parental-consent system is beyond what WavePlay can do responsibly today. Rather than do it badly, we have made the service adults-only. Your date of birth is checked at signup and accounts below eighteen are refused.
A small number of accounts were created before this rule took effect and may still belong to people under eighteen. Section 9(2) prohibits tracking, behavioural monitoring and targeted advertising directed at children, so for those accounts we do not record watch history, do not use their activity for recommendations, and exclude them from age and gender statistics entirely. They also keep the content protections described below.
The kid-friendly flag is separate from all of this: it is a classification an uploader applies to their own video. Videos not marked kid-friendly are hidden from any account we can tell belongs to a minor.
If you believe a child has created an account on WavePlay, please write to contact@waveplay.in and we will remove it and erase the data.
How long we keep your data
Section 8(7) of the DPDP Act requires us to erase personal data once the purpose it was collected for is served. In practice that means we keep your data while your account is open, and erase it after you close it.
| Data | Kept for |
|---|---|
| Account details, videos, playlists, comments | As long as your account is open, then through the 30-day recovery window, then erased. |
| Watch history and sign-in history | Same as above — see the note on anonymisation below. |
| Sign-in and verification codes (OTPs) | Minutes to hours — they expire and are consumed on use. |
| Session cookie | Up to 7 days, or until you sign out. Sessions are held in memory and also end when the server restarts. |
| Hashed visit counters | Indefinitely. These are one-way hashes with no stored key, so they do not identify you. |
Deleting your account — the 30-day window
You can delete your account yourself, from your profile page. The moment you confirm, your channel, videos, playlists and profile disappear from WavePlay and you are signed out everywhere.
For 30 days, the deletion is reversible. Sign in with your usual password during that window and everything comes back exactly as it was. We keep your data intact but hidden during those 30 days for exactly one reason: so that an accidental or regretted deletion can be undone. Nothing is published, listed or recommended in the meantime.
After 30 days it is permanent. Your videos and their files are deleted from disk; your playlists, collections, series, comments, reports, downloads and notifications are removed; and your personal details — name, email, phone, date of birth, gender, password hash and sign-in history — are erased from both of our databases.
The one thing that survives is your watch-history rows, with the account identifier on them replaced by a fresh random token that is never recorded anywhere. That keeps the fact that “these videos were watched by the same someone”, which is what makes recommendations work for everyone else, while permanently destroying the link back to you. Because no key is retained, those rows are no longer personal data. If you would rather they were destroyed too, tell us and we will delete them.
While your account is open, your history stays fully linked to you — that is the ordinary, consented processing you signed up for and it powers your own History page and recommendations. The anonymisation described above happens only when the 30-day window lapses.
Who else sees your data
We do not sell or rent personal data, and we share none of it for advertising or marketing. We do rely on a small number of service providers (Data Processors under the DPDP Act) to run the platform:
| Provider | What it receives | Why |
|---|---|---|
| Railway | Everything, as our hosting provider — the servers, database and uploaded files sit on their infrastructure. | Hosting and storage. |
| Brevo | Your email address and the content of the email being sent. | Delivering verification codes, password recovery and notification emails. |
| ip-api.com | Your IP address. | Looking up the country a visit came from, for aggregate administrator statistics and for the region-level trending list on the home page. We send the address and keep only the country it returns. |
| Google Fonts | Your IP address and browser details, sent directly by your browser when it fetches our fonts. | Page typography. |
We may also disclose personal data where we are legally required to — to comply with a valid order of a court or a lawful request from an authorised government agency, or where necessary to establish or defend a legal claim.
Where your data is processed: WavePlay is operated from India, but the providers above may store or process data on servers outside India. Section 16 of the DPDP Act permits such transfers except to territories the Central Government restricts by notification, and we will comply with any such notification.
Cookies & local storage
WavePlay sets one cookie, and it exists only to keep you signed in for up to 7 days. It is marked HttpOnly (so page scripts cannot read it) and Secure in production (so it only travels over HTTPS). There are no third-party cookies, no advertising cookies and no analytics trackers on WavePlay — which is also why you are not being asked to dismiss a cookie banner.
Your video queue is stored in your browser’s localStorage. That stays on your device and is never sent to our servers — clearing your browser storage clears it. Your light/dark theme choice is stored in localStorage too, and additionally saved against your account when you are signed in, so that the site opens the way you left it on any device.
How we protect it
Section 8(5) of the DPDP Act requires reasonable security safeguards. The measures currently in place include:
- Passwords are hashed with bcrypt — we never store, log or transmit them in readable form
- Personal data is held in a separate store from ordinary platform data, so it is not touched by routine reads
- IP addresses are never stored as addresses anywhere — visit counting and sign-in history both keep only a keyed one-way hash
- The session cookie is
HttpOnlyandSecure, and your session identifier is regenerated on every sign-in to prevent session fixation - Sign-in, signup, password-reset and OTP endpoints are rate-limited per account and per address against brute-force and credential-stuffing attacks
- Sign-in failures never reveal whether an email, username or number is registered, so the platform cannot be used to enumerate accounts
- Uploads are validated by inspecting the file’s actual contents, not its name or claimed type, and are stored with server-generated filenames
- Security headers — Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy — are applied to every response
- All user-supplied text is escaped before it is rendered, to prevent injected scripts running in another person’s browser
No system is perfectly secure, and we would rather say so than imply otherwise. We keep improving these measures as the platform grows.
If a breach happens
Section 8(6) of the DPDP Act requires us to report a personal data breach to the Data Protection Board of India and to every affected user. If your data is involved in a breach we will notify you, describe what happened and what data was affected, tell you what we are doing about it, and tell you what you should do — without waiting to be asked.
Your rights under the DPDP Act
As a Data Principal you hold the following rights. Where you can exercise one yourself, we have said where; otherwise email contact@waveplay.in and we will act on it within 30 days.
Your duties matter too. Section 15 of the DPDP Act asks that you give authentic information, do not impersonate anyone else when registering, and do not file false or frivolous complaints. We ask the same.
Complaints and grievance redressal
WavePlay is operated by a small team, and privacy questions are handled directly rather than through a call centre. Write to our Grievance Officer at contact@waveplay.in, or use the Contact Us page — both reach the same place.
We will acknowledge your message and respond substantively within 30 days. Please tell us your username and, if you can, what specifically you want done — it makes a real answer much faster.
If you are not satisfied with our response, or we do not respond in time, you have the right to complain to the Data Protection Board of India under section 13(3) of the DPDP Act. We would much rather you came to us first, but the route past us exists and we are not going to hide it.
Safety on WavePlay
We are committed to keeping WavePlay a safe, respectful community. The following content is strictly prohibited:
- Content that harasses, threatens, or targets individuals
- Content depicting or glorifying violence, self-harm, or illegal activity
- Misinformation intended to mislead or cause harm
- Spam, scams, or coordinated inauthentic behaviour
- Any content involving the exploitation of minors
If you see something that breaks these rules, use the Report button on any video, or contact us via the Contact Us page.
How automatic hiding works
A video with enough unresolved reports against it is hidden automatically, pending human review. Reports do not all count equally: a report from a brand-new account carries a quarter of the weight of one from an established account, and a video is never hidden unless several reports come from accounts more than a week old. This is deliberate — it stops a handful of throwaway accounts being used to silence a creator.
Creators are always told. If one of your videos is hidden this way you receive a notification explaining it, and you can appeal it for review. Hiding someone’s work silently, with no way to find out or contest it, turns a moderation tool into a harassment tool, so we do not do it.
Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top. For changes that materially affect your rights or introduce a new purpose, we will notify you directly — by email or in the app — rather than relying on you to re-read this page.
This notice is available in English. If you would prefer it in another language listed in the Eighth Schedule to the Constitution, as contemplated by section 5(3) of the DPDP Act, please ask and we will provide one.