Privacy

in the browser

Gems are stored in local browser storage on the device where they are marked. When a promotion plate is closed, its name and version are stored in local browser storage on that device so it stays closed; this choice is not sent to the server. A viewing session uses a random identifier held only in the tab's memory. Closing the tab removes that identifier. Pairing codes and the shared air state exist temporarily while a phone and screen are connected; the server relays them and does not save them.

traffic and playback journal

One traffic event is sent when the main page loads. The server uses the request IP address, browser user-agent and UTC date to calculate a salted daily HMAC key. The raw IP is not written to the analytics database, and the daily key cannot recognise the same visitor on a later day. The user-agent is also reduced to one of three words — mobile, tablet or desktop — and that word is stored instead of the header it came from; anything unrecognised is stored as unknown. Raw analytics rows are retained for up to 30 days. Daily aggregate counts by page, referring domain, country and device class contain no visitor key and may be retained.

A playback journal records clip identifiers and actions such as shown, skipped, failed or marked as a Gem. It also records that a pairing with a phone was opened and which side opened it, without the pairing code. When RND TV promotes something on its own air, the journal records that a promotion plate or bumper was shown, followed or closed, by the promotion's name only. It stores a short salted session key instead of the browser's session identifier, and the same device class as above — mobile, tablet or desktop — derived on the server from the request so that a failure can be told apart from a screen it did not happen on; the header it came from is not stored. The salt changes when the service restarts, so journal sessions cannot be linked across restarts. Entries older than 30 days are removed during hourly journal maintenance.

server logs

The web server writes ordinary access and error logs, including the request IP address, time, path, status, referrer and user-agent. Logs are rotated daily and 14 rotated files are retained. They are used for security and operating failures, not advertising or user profiles.

email

When a viewer requests an Air Log, the supplied address and letter are sent to Resend for delivery. Without the optional news checkbox, RND TV does not store the address in its database. With the checkbox, the address, subscription state and confirmation and unsubscribe tokens are stored so double opt-in and removal work. Unsubscribing retains the address as a suppression record so it is not subscribed again silently.

Internet Archive

Videos play directly from archive.org rather than passing through the RND TV server. The viewer's browser therefore makes requests to the Internet Archive, which receives the network information normally sent with those requests and applies its own privacy terms.

agent sessions and shared links

Remote MCP keeps temporary station settings, selected episode metadata, Gems, history and recent mutation results in bounded process memory. These metadata sessions expire after inactivity or eviction. Browser WebMCP operates the page's existing session and keeps a bounded in-memory retry cache. Closing or reloading the page clears that cache.

A public clip link contains a media identifier and may contain a playback position. The clip link carries no agent session identifier, seed or signed feed continuation. Anyone receiving the link can try to open the identified clip under the site's current availability and safety checks. Ordinary web logs may record its path and query. The playback journal records clip and station actions and sharing events using its existing temporary session treatment.

contact

Questions or requests about this notice can be sent to loto@rndtv.me. RND TV was created and is operated by Sergei Vorniches.