AFree Privacy Policy

[AFree legal entity name and registered address — to be confirmed] is the data controller for your AFree account and the AFree products (AFreeHub, AFreeNews, AFreeFlix, AFreeMusic, AFreeCreate, AFreeTV and AFreeNetwork). Contact us, or our data protection officer, at privacy@[to-be-confirmed].

This policy is meant to meet the Nigeria Data Protection Act 2023 and, where it applies, the EU/UK GDPR. [Controller registration details, data protection officer and the legal basis for each purpose below — counsel to confirm.]

Your account. Your email address, your name, your interface language, your roles (viewer, creator, administrator), your identity-verification status, and a record of which Terms and Privacy Policy versions you accepted, when, and that you declared you are 18 or older. We use these to run your account and sign you in to every AFree product.

Profiles. For each profile in your household: its name, whether it is Adult, Teen or Kids, and the picture chosen for it. A profile PIN is stored only as a one-way hash. We also record which profile is active in each product for each sign-in, so that parental controls hold.

Signing in. One-time email codes are stored only as hashes and expire after 10 minutes. Passkeys: we keep the passkey's public key and a counter; your fingerprint, face or device PIN never leave your device. For each place you are signed in we keep how you signed in, your browser or device description (user agent), and when the sign-in started and was last used. Session and refresh tokens are stored only as hashes.

Account activity. A log of security events on your account: account created, sign-ins and sign-outs, devices signed out, passkeys added, profile changes and wrong PIN attempts, role changes, identity verification and Sign-Off setup, and Terms acceptance. You can see recent entries on your account page. The log is append-only: entries are not edited or deleted.

Identity verification. Needed only to own an AI avatar or to act for a performer or estate. Your government ID and selfie are checked by our verification partner on its own pages; AFree keeps the result (verified, pending or rejected) and the partner's reference.

AFree Sign-Off. For avatar owners: your account ID and name, the passkeys you use to sign approvals, the approvals themselves (who may use an avatar, for what, and each release you approve or refuse) and the documents you sign. Before signing, a liveness check is run by a liveness provider; AFree receives only whether it passed. Signed approvals, revocations and signatures are written to the Rights Registry, which is append-only and kept permanently so they can be checked later.

Licensing and payments. For performers, estates and producers: organisation and team memberships, bookings, deal terms and their versions, messages between the parties, agreements and signatures, licenses, reported uses of a license, and change requests. Deposits are paid through Paystack (card or bank transfer) or Stripe: we send them your email address, the amount, the currency, a reference and a description, and you pay on their page. We never receive your card details; we keep the payment reference, amount, currency and status.

Subtitles and dubbing. When a creator or administrator asks AFree to subtitle or dub a title, the title's media is sent to our translation provider, Project Wider (Coda Hub). Live broadcasts with live captions send their audio to Project Wider as they stream. This media can include the voices and faces of people who appear in it. We keep the resulting tracks, their review state and who reviewed them. By default we tell Project Wider it has no consent to reuse reviewers' corrections (for example, for training).

AFree Connect (play on another screen). While an AFree screen is open and signed in, it is listed to your other signed-in screens with its name, the app, and what it is playing and where. This is held only in memory while the screen is connected, is visible only to screens signed in to the same account, and is not stored.

AFreeNetwork partners. The organisation details in a partner application (name, type, country, website, description), its members, channels, declared sponsors and the advertisers it invites.

AFree accounts are for adults (18 or older). Children use AFree through Kids or Teen profiles that an adult creates in their household. Children have no email address, sign-in or account of their own with us; for a child's profile we keep only what is listed under Profiles above. Kids and Teen profiles see only content rated for them.

• AFree products you sign in to receive your account ID, name, email address, roles and verification status, and your household's profiles.
• AFree administrators can see accounts (email, name, roles, number of profiles) and change roles; they review AFreeNetwork applications.
• Service providers, only for the purposes above: Paystack and Stripe (payments), Project Wider (subtitles and dubbing), an email provider (sign-in codes), an identity-verification partner and a liveness provider. [Providers still to be named, hosting, and international transfer safeguards — counsel to complete.]
• Other parties to a license you are part of see the deal, messages, agreement and signatures for that license.

We do not sell your personal data. The code today sends no data to advertising networks.

• Email sign-in codes: valid for 10 minutes. Sign-in sessions and refresh tokens: 30 days from sign-in unless you sign out sooner (Media Command Center: 12 hours, and 30 minutes unused). Access tokens: 10 minutes.
• Your account, profiles, passkeys and settings: while your account exists, and for up to 14 days after you ask us to delete it.
• The account activity log and the Rights Registry: append-only, with no automatic deletion. Log entries refer to your account by its ID; when your account is deleted, any name or email address in older entries is replaced by a one-way hash.

[Retention periods and deletion schedule — counsel to set.]

You can ask to access, correct or delete your personal data, to receive a copy of it, to restrict or object to how we use it, and to withdraw consent. You can also complain to the Nigeria Data Protection Commission or, if you are in the EU or UK, to your data protection authority.

What you can do yourself today on your account page:

• see your name, email, profiles, where you're signed in and recent activity;
• add, change and remove profiles and their PINs;
• choose your interface language (in the apps' account pages);
• sign out any device, or everywhere;
• download a copy of your account data (data export, as a JSON file);
• delete your account: after confirming it's you (an email code or your passkey), you are signed out everywhere at once, and 14 days later your email, name, passkeys and profiles are erased.

Handled by request to privacy@[to-be-confirmed]:

• correcting your name or email address;
• any other request above.

[Response times and identity checks for requests — counsel to confirm.]

Codes, tokens and PINs are stored only as hashes. Sign-in tokens live in http-only cookies that page scripts cannot read, sent only over HTTPS in production. Passkeys and one-time codes mean AFree has no passwords to leak. If a refresh token is used twice, we end that whole sign-in in case it was copied.

AFree uses only the cookies needed to sign you in and remember your language. The code today sets no advertising or third-party analytics cookies.

• afreehub_sid (AFreeHub): keeps you signed in to your AFree account on AFreeHub. http-only; 30 days.
• afree_<app>_at (each AFree web app, e.g. afree_afreeflix_at): your short-lived sign-in token for that app. http-only; about 10 minutes.
• afree_<app>_rt: renews that sign-in without asking you again. http-only; 30 days.
• afree_<app>_pt: the profile you chose ("Who's watching?"), so ratings and parental controls apply. http-only; up to 12 hours.
• afree_<app>_pkce: protects a sign-in in progress from being hijacked. http-only; 10 minutes.
• afree_locale and afree_show_machine: your interface language and whether to show machine-translated text. 1 year.

Some apps also keep small settings in your browser's local storage: articles you saved in AFreeNews, an unfinished Sign-Off step in AFreeCreate, the AFreeTV app's sign-in, and, when AFree Identity is not connected (preview), the profile you picked. Clearing your browser data removes them.

Each version has a version number (this one is 2026-09-30-draft). When we publish a new version, we ask you to review and accept it on your account page.

[AFree legal entity name and registered address — to be confirmed]. Email: privacy@[to-be-confirmed].