Privacy Policy

1.1. This ReplayBox Personal Data Processing Policy (the “Policy”) defines the procedures and terms for personal data processing by individual entrepreneur Pavel Nikolaevich Strukov (the “Operator”).

1.2. The Policy applies to personal data the Operator receives when the following are used:

• the ReplayBox website at https://replaybox.ru;
• the ReplayBox account;
• the ReplayBox software for personal computers;
• video and screenshot upload, storage, viewing and publishing features;
• email and other channels for communicating with the Operator. These websites, accounts, software and related features are collectively referred to as the “Service”.

1.3. The Policy has been developed in accordance with the personal data legislation of the Russian Federation.

1.4. The Policy is not consent to personal data processing. Where legislation requires consent, it is provided separately from this Policy and other documents.

1.5. Before providing personal data, the User is advised to read this Policy, the User Agreement and the Cookie Policy.

1.6. If the User does not agree to the personal data processing terms, they must refrain from providing data and using Service features that require such processing.

1.7. The Policy's key terms have the meanings established by Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

1.8. If you choose to connect a Google Account and upload videos to YouTube, the additional policy at https://replaybox.net/legal/youtube applies. It describes Google permissions, connection data, its use and protection, retention periods, access revocation and deletion.

Operator: individual entrepreneur Pavel Nikolaevich Strukov. INN 771314210244. OGRNIP 324774600166372. Address: 127591, Russian Federation, Moscow, 69 Dubninskaya Street, Building 2, Apartment 126. Email: support@replaybox.ru. Website: https://replaybox.ru

3.1. The Operator processes personal data on a lawful and fair basis.

3.2. Processing is limited to predetermined, lawful purposes. Processing incompatible with the purposes of data collection is prohibited.

3.3. The Operator collects only personal data necessary for the relevant processing purposes.

3.4. The content and volume of processed data must correspond to the stated purposes. Excessive processing is prohibited.

3.5. The Operator takes reasonable steps to ensure that personal data is accurate and up to date.

3.6. Personal data is retained no longer than required by the processing purposes, the contract or the legislation of the Russian Federation.

3.7. Once processing purposes have been achieved, personal data is deleted, destroyed or de-identified unless further retention is required by law or contract.

3.8. The Operator does not sell personal data or disclose it to third parties for their own advertising.

The Operator may process personal data of the following persons:

4.1. Visitors to the ReplayBox website.

4.2. Registered Service users.

4.3. Users of ReplayBox software.

4.4. Users who upload, publish or view videos and screenshots.

4.5. Users who submit content complaints.

4.6. Persons contacting support or submitting applications and requests to the Operator.

4.7. Persons whose information may appear in user videos, audio tracks, messages, game interfaces or other uploaded content.

5.1. Website operation and security

Processing purposes:

• providing website access;
• keeping the Service operational;
• diagnosing technical errors;
• preventing attacks, abuse and automated requests;
• limiting request frequency;
• investigating security violations;
• maintaining de-identified traffic statistics.

Data processed:

• IP address;
• request date and time;
• requested page address;
• referral source;
• browser type and version;
• device type and operating system;
• browser language and technical settings;
• User-Agent and other HTTP headers;
• technical identifiers;
• information about website activity;
• information about request results;
• cookies and browser local storage data;
• a hashed visitor identifier generated from technical data.

Legal grounds:

• necessity for performing the contract with the User;
• exercising the Operator's rights and legitimate interests relating to security and stable Service operation, provided the data subject's rights are not infringed;
• separate User consent for analytics cookies and analytics services.

Retention periods:

• rate-limiting records: within the relevant rate-limit period, but no longer than 24 hours;
• technical logs: up to 90 calendar days;
• hashed identifiers used for internal statistics: up to 90 calendar days, followed by deletion or aggregation;
• security incident records: until the investigation is completed and no longer than three years afterwards, unless a longer period is required by law.

5.2. Registration and account management

Processing purposes:

• User registration;
• creating and maintaining an account;
• identifying the User;
• providing Service features;
• managing the plan, limits and account settings;
• performing the User Agreement.

Data processed:

• email address;
• public nickname;
• password hash;
• account identifier;
• registration date;
• email verification date;
• selected plan;
• individual plan limits and settings;
• limit usage information;
• account modification dates;
• administrative rights status, if granted by the Operator. The Operator does not store plaintext passwords. The database stores the result of cryptographic transformation.

Legal grounds:

• taking steps requested by the User before entering into a contract;
• concluding and performing a contract to which the User is a party;
• separate consent where required by legislation.

Retention period:

• throughout the account's lifetime;
• up to 30 calendar days after receiving an account deletion request or termination of the contract;
• individual minimum necessary records may be retained for up to three years after contract termination to resolve claims and protect the Operator's legitimate interests;
• records subject to mandatory statutory retention are kept for the period established by law.

5.3. Email verification and access recovery

Processing purposes:

• verifying ownership of an email address;
• password recovery;
• sending technical and service messages;
• preventing unauthorized account access.

Data processed:

• email address;
• nickname;
• User identifier;
• verification token hash;
• encrypted message content until delivery;
• message type;
• delivery status and time;
• number of delivery attempts;
• technical delivery error code.

Retention periods:

• an email verification link is valid for 24 hours;
• a password reset link is valid for one hour;
• invalid, used and expired tokens are deleted within 30 calendar days;
• encrypted message content is deleted after successful delivery, final failure or delivery cancellation;
• technical message delivery records are retained for no longer than one year.

5.4. Authentication and session management

Processing purposes:

• signing in to the account;
• connecting ReplayBox software;
• maintaining an authenticated session;
• ending and revoking sessions;
• protecting the account.

Data processed:

• User identifier;
• session token hash;
• session type;
• application installation identifier;
• User-Agent;
• session creation and last-use dates;
• session expiration or revocation date;
• one-time application connection code;
• connection request secret hash.

Retention periods:

• account or application session: up to 30 calendar days, or until sign-out, revocation or session replacement;
• application connection request: up to 10 minutes;
• expired or revoked session records: no longer than 30 calendar days after the session ends, unless longer retention is needed to investigate an incident.

5.5. Software operation and provision of the trial plan

Processing purposes:

• identifying a software installation;
• securely connecting the application to the account;
• providing a trial plan;
• preventing repeated or improper receipt of the trial plan;
• detecting suspicious installations and abuse.

Data processed:

• installation identifier;
• installation's public cryptographic key;
• public key fingerprint;
• installation creation and last-use dates;
• risk status;
• registration IP address hash;
• information on trial plan grants and usage;
• number and volume of trial uploads. The installation's private cryptographic key is not provided to the Operator.

Legal grounds:

• concluding and performing a contract with the User;
• the Operator's legitimate interest in preventing fraud and repeated use of limited offers.

Retention periods:

• registration IP address hash: no longer than 31 calendar days;
• installation and fingerprint records: no longer than three years after the installation's last use;
• trial plan grant records: throughout the account's lifetime and no longer than three years after deletion, to the extent needed to confirm use of the offer.

5.5.1. Automated tools may assign a risk status to an installation or temporarily restrict trial access. The User may contact support@replaybox.ru for the Operator to review such a decision.

5.5.2. The Operator does not make decisions with significant legal consequences for the User solely through automated processing without an opportunity to contact the Operator.

5.6. Video and screenshot upload, storage and publishing

Processing purposes:

• uploading and storing videos and screenshots;
• creating previews;
• playing video recordings;
• creating a viewing link;
• providing access to persons selected by the User;
• adding notes and timestamps;
• managing visibility and deleting content;
• performing the User Agreement.

Data processed:

• video and audio track content and screenshot images;
• in-game nicknames, images, voices, correspondence and other information captured in a recording;
• original filename;
• file format and size;
• recording duration;
• video preview;
• notes and timestamps;
• content type;
• author identifier;
• author's public nickname;
• unique link token;
• content availability setting;
• creation, retention expiration and deletion dates.

Retention periods:

• incomplete upload session: no longer than seven calendar days;
• trial plan videos and screenshots: throughout the seven-day trial starting with the first successful cloud upload and for 30 calendar days after it ends;
• videos and screenshots on the paid Starter, Core, Advanced and individual plans: throughout paid access and for 30 calendar days after it ends;
• screenshots on the free Basic plan: seven calendar days from publication; storage terms are updated accordingly when switching to a paid plan;
• until earlier deletion by the User or Operator on grounds provided by the contract or law. When the deletion date arrives, the Operator stops providing access and removes the content from active storage. Deletion must be completed within 30 calendar days if immediate destruction is impossible for technical or legal reasons.

5.7. Complaints and content moderation

Processing purposes:

• receiving and reviewing complaints;
• checking compliance with Service rules;
• stopping unlawful or prohibited use;
• protecting Users' and third parties' rights.

Data processed:

• complainant's identifier;
• video identifier;
• complaint text;
• review status and outcome;
• complaint creation and modification dates.

Legal grounds:

• performing the contract;
• the Operator's and other users' legitimate interests in safe Service operation;
• fulfilling statutory obligations. Retention period: until the relevant content or complainant's account is deleted, but no longer than three years after the complaint review ends, unless a longer period is required by law.

5.8. Handling enquiries and providing User support

Processing purposes:

• reviewing questions, applications, claims and requests;
• technical support;
• restoring access;
• fulfilling data subjects' requests;
• protecting the Operator's and User's rights.

Data processed:

• email address;
• nickname;
• account identifier;
• enquiry content;
• attached materials;
• technical information needed to resolve the issue;
• correspondence date and history. Retention period: no longer than three years after the enquiry is resolved, unless longer retention is required by legislation or a dispute.

5.9. Payments, automatic renewal and refunds

Processing purposes:

• creating and fulfilling an order;
• processing payments and refunds;
• enabling and disabling automatic renewal;
• sending fiscal receipts and upcoming charge notices;
• preventing duplicate and unauthorized transactions;
• maintaining accounting and tax records;
• reviewing payment claims.

Data processed:

• User identifier and email address;
• selected plan, amount, currency and paid period;
• order and payment identifiers, status, transaction date and time;
• JSC TBank customer and payment identifiers, stored encrypted;
• automatic renewal status;
• date, time, document version and parameters of separate consent to recurring payments;
• information about notices, disabling renewal, refunds and payment errors. The Operator neither receives nor stores full card numbers, expiration dates or security codes.

Legal grounds: concluding and performing a contract, separate consent to recurring payments, compliance with payment, accounting and tax legislation, and legitimate interests in preventing fraud and protecting the parties' rights. Retention period: throughout the contract; payment, receipt and refund records are kept for the mandatory retention period; consent and cancellation records are kept no longer than the limitation period after automatic renewal ends, unless longer retention is required by law.

5.10. Traffic analytics

Processing purposes:

• measuring website traffic;
• analyzing use of pages and features;
• identifying technical problems;
• improving the interface and Service quality.

Data processed:

• IP address;
• browser identifiers;
• cookies and local storage records;
• browser, device and operating system information;
• referral source;
• visited pages;
• actions and interactions with pages;
• visit duration;
• technical error information;
• recordings of page interactions made by web analytics features. Legal ground: separate User consent to analytics technologies. Analytics cookies, Yandex Metrica and Webvisor must not be activated before that consent is obtained. Retention period: until consent is withdrawn or the relevant analytics identifiers expire, but no longer than 24 months after the last interaction, unless a shorter period is set by the analytics provider's settings or documents. Analytics use is further governed by the Cookie Policy: https://replaybox.ru/legal/cookies.

6.1. The User independently determines the content they upload and must ensure, before uploading, that lawful grounds exist for processing and publishing the information it contains.

6.2. The User must not upload content that infringes privacy, confidentiality of correspondence, rights to a person's image, personal data, copyright or other third-party rights.

6.3. The User must not upload special categories of personal data, biometric personal data or legally protected secrets without appropriate legal grounds.

6.4. The Operator does not use images or voices from video recordings to identify individuals and does not create biometric databases.

6.5. Enabling public access, including leaving the default publishing setting enabled, makes a video available to anyone who obtains the unique link. Viewing through the link may not require authentication.

6.6. Link recipients may share it with others. After a link is shared, the Operator cannot fully control recipients' subsequent use of information they view or save.

6.7. The author's public nickname may appear alongside published content.

6.8. Where public access constitutes dissemination of the User's personal data, the Operator obtains separate consent to dissemination in the form required by law before publication.

6.9. The User may restrict access or delete content through the Service. Restricting access does not delete copies that link recipients may previously have lawfully saved.

6.10. The Operator processes data in user content to the extent necessary to upload, store, convert, play, provide access to, moderate and delete that content.

7.1. Processing uses automated tools and, in some cases, direct involvement by the Operator's authorized personnel.

7.2. The Operator may perform the following actions:

• collection;
• recording;
• organization;
• accumulation;
• storage;
• correction and updating;
• retrieval;
• use;
• transfer by providing access to persons processing data on the Operator's instructions;
• providing access to recipients of a user link;
• de-identification;
• blocking;
• deletion;
• destruction.

7.3. Dissemination of personal data is permitted only with grounds provided by law, separate consent or an appropriate action by the User where that action is legally sufficient.

7.4. Access to personal data is granted only to persons who need it to perform their duties and support the Service.

8.1. To operate the Service, the Operator may entrust personal data processing to the following

providers:

8.1.1. Timeweb Cloud

Purpose:

• hosting the website and server application;
• operating server infrastructure and the database;
• storing videos, previews and technical objects;
• ensuring network availability. Provider documentation: https://timeweb.cloud/docs.

8.1.2. Yandex.Cloud LLC

Services used:

• Yandex Cloud Postbox: sending service emails. An email address, nickname, service message text, a link with a one-time token and technical delivery information may be transferred for email delivery. Provider documentation: https://yandex.cloud/ru/docs.

8.1.3. Cloudflare (Turnstile): protecting forms from automated requests. IP addresses, browser and device information, technical request parameters, website addresses and verification tokens may be processed. Form field contents are not sent to the service. Provider documentation: https://developers.cloudflare.com/turnstile/.

8.1.4. YANDEX LLC. After separate consent is obtained, visit data may be transferred to Yandex Metrica for statistics, traffic analysis, click maps and page interaction recordings. Yandex Metrica documentation: https://yandex.ru/legal/confidential/.

8.1.5. JSC TBank: a payment provider and online acquiring operator. Payment amounts and purposes, order, User and plan identifiers, email addresses for receipts and technical transaction information may be transferred to create and perform payments. The User enters card details on the bank's side. For automatic renewal, the bank provides the Operator with a technical payment identifier. Online acquiring documentation: https://www.tbank.ru/business/online-payments/internet-acquiring/.

8.2. Persons processing data on the Operator's instructions undertake to maintain confidentiality and ensure personal data security in accordance with the contract and legislation.

8.3. The Operator may disclose personal data to government authorities, courts or law enforcement where required by legislation and supported by a proper request or other lawful grounds.

8.4. Providers may change. If recipients change materially, the Operator updates the Policy before the relevant processing begins.

9.1. When collecting Russian citizens' personal data online, the Operator ensures that recording, organization, accumulation, storage, correction and retrieval use databases located in the Russian Federation.

9.2. ReplayBox's primary database and object storage are located in the Russian Federation. Application instances operate in Russia and the Netherlands, so Service requests may be processed in either country.

9.3. Technical information necessary for Cloudflare Turnstile protection against automated requests may be transferred to a foreign service provider. The relevant data categories are specified in clause 8.1.3 of this Policy.

9.4. A public link to user content may be opened by a recipient outside the Russian Federation. The User must consider this when enabling public access and sharing links.

9.5. Before cross-border transfers begin, the Operator follows legally required procedures, assesses transfer conditions, submits necessary notices and updates this Policy.

10.1. The Service uses essential cookies for authentication, security and storing technical preferences.

10.2. Essential cookies are used only to the extent without which the requested feature cannot be provided.

10.3. Analytics cookies, Yandex Metrica and Webvisor are activated only after separate User consent.

10.4. The User may change their analytics cookie decision through the consent panel: https://replaybox.ru/legal/cookies#section-7.

10.5. The User may also delete or block cookies in their browser settings. Restricting essential cookies may make some Service features unavailable.

10.6. Details of cookie types, purposes and retention periods are provided in the Cookie Policy: https://replaybox.ru/legal/cookies.

11.1. The Operator takes necessary legal, organizational and technical measures to protect personal data against unauthorized or accidental access, alteration, disclosure, copying, blocking, deletion, destruction and other unlawful actions.

11.2. In particular, the Operator uses:

• access controls;
• user identification and authentication;
• secure data transmission;
• storing passwords as cryptographic hashes;
• storing session and verification tokens as hashes;
• encrypting temporary email queue content;
• private object storage for video recordings;
• administrative access controls;
• technical event logging;
• limiting request frequency;
• protecting forms from automated requests;
• infrastructure redundancy and health monitoring;
• threat and incident analysis;
• deleting data after established retention periods;
• regular software updates.

11.3. Persons granted access to personal data must maintain its confidentiality.

11.4. Despite these measures, no transmission or storage method guarantees absolute security. The User must keep passwords and content links confidential and notify the Operator of suspected unauthorized access.

12.1. A data subject may:

• obtain confirmation that their personal data is being processed;
• obtain information about processing purposes, grounds, methods and periods;
• obtain information about the data processed and its sources;
• learn who has been entrusted with processing;
• request correction of incomplete, outdated or inaccurate data;
• request blocking or destruction of unlawfully obtained or excessive data;
• withdraw previously given consent;
• request that processing cease where no other lawful grounds exist;
• challenge the Operator's actions before Roskomnadzor or a court;
• use other remedies provided by law.

12.2. To exercise these rights, a data subject may send a request:

• by email to support@replaybox.ru;
• by post to 127591, Russian Federation, Moscow, 69 Dubninskaya Street, Building 2, Apartment 126.

12.3. The request should preferably include:

• surname, first name and patronymic;
• account email address or nickname;
• a description of the relationship with ReplayBox;
• the substance of the request;
• information confirming that the request concerns the relevant data subject;
• preferred response method.

12.4. The Operator may request additional information only to the extent needed to verify the applicant's identity and prevent disclosure to another person.

12.5. The Operator considers a request within 10 working days. This may be extended by no more than five working days upon sending a notice explaining the reasons.

12.6. Inaccurate data is corrected within seven working days after supporting information is received.

12.7. When consent is withdrawn, data is deleted within 30 calendar days unless other lawful grounds for continued processing exist.

12.8. A request to cease processing is fulfilled within 10 working days. This may be extended by no more than five working days upon sending a notice explaining the reasons.

12.9. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal was received.

12.10. After consent is withdrawn, the Operator may continue processing where legislation permits, including performance of an existing contract, mandatory legal requirements or protection of rights and legitimate interests.

13.1. The Service is not intended for independent use by persons who, under Russian law, cannot independently enter into the User Agreement or give the required consent.

13.2. A minor's legal representative may contact the Operator to obtain information about, correct, block or delete the minor's personal data.

13.3. If the Operator learns that a minor's data was unlawfully provided, it will be blocked and deleted unless other lawful grounds for processing exist.

14.1. Processing ceases upon:

• achievement of the processing purpose;
• expiration of the established period;
• account deletion;
• contract termination;
• withdrawal of consent where no other legal grounds exist;
• receipt of a lawful data subject request;
• discovery of unlawful processing;
• cessation of the Operator's activities.

14.2. If immediate destruction is impossible, data is blocked and destroyed within six months, unless a different period is established by law.

14.3. Destruction is documented in a manner that confirms completion where required by law.

15.1. Version 1.3 of the Policy applies from 29 October 2026 until replaced by a new version.

15.2. The Operator may change the Policy following changes in legislation, Service features, data categories or providers.

15.3. A new version applies to processing performed after its effective date.

15.4. For material changes, the Operator publishes a website notice or informs the User through an available channel.

15.5. The current Policy is available at https://replaybox.ru/legal/privacy.

15.6. Previous versions are archived at https://replaybox.ru/legal/privacy#versions.

15.7. The User Agreement is available at https://replaybox.ru/legal/user-agreement.

15.8. The Cookie Policy is available at https://replaybox.ru/legal/cookies.