Privacy Policy

1. Who runs Yugma

Yugma is built and operated by Yash Vijay Patil, an individual based in India. There is no company behind it.

For anything on this page, including questions, requests or complaints: hello@yugma.app. That address is also the grievance contact under India's Digital Personal Data Protection Act, 2023.

2. What the extension sends to our server

When you start or join a watch party, the extension opens a connection to our relay server and sends only what's needed to keep two players together:

• A six-character room codeSo the right two people are connected
• Your position in the video, in secondsTo detect and correct drift between you
• Play, pause, seek and playback-rate eventsSo an action on one side happens on the other
• Ad-break start and end signalsSo the person not in an ad waits rather than running ahead
• Chat messages, encrypted on your device, and reactions you sendTo deliver them to the other person — the messages in a form only they can read
• A one-time public encryption key each time you join a roomSo your device and your partner's can agree on a key to encrypt chat with. A public key reveals nothing about the messages
• Call requests and answers, and the technical details two browsers need to connect a callTo start a call you placed or accepted. Passed straight to your partner unread; never stored or logged
• A reference to what you're watching — which platform, its catalogue id and the title's name — and episode changesTo take you both to the same title and episode
• The extension's version number, once, when it connectsSo an outdated build can be told to update instead of half-working
• The streaming site you're on: only its address, such as primevideo.com, which your browser attaches to every connectionTo count rooms on each platform. Only the platform's name is kept
• Your browser's standard user-agent string, which every browser sends with every connectionTo count which browsers Yugma runs on. Only one word is kept: Chrome, Edge, Firefox, Opera or other
• When you start or join a room, two rough ranges: how many rooms this install has opened before, and how many days since its firstSo we can tell whether people come back, without any identifier. Only the range is sent; the numbers behind it stay on your device

Two things worth being direct about.

The reference travels through us. To take you both to the same episode, the platform, catalogue id and name of what you're watching pass through our server. They are relayed to the other person and held only as the room's current state while the room exists — never written to a database, never written to a log file.

Chat is end-to-end encrypted. Each time you join a room your device makes a fresh key pair. Only the public half is sent, and your device and your partner's use the two halves to agree on a key that never leaves either device. Your messages are encrypted with that key before they leave your computer. Our server receives only scrambled text and hands it on; it cannot read it, and it keeps no copy.

Video calls. A call starts only when your partner accepts it. The sound and picture travel between your two browsers, encrypted end to end, through a relay run by Cloudflare. The relay passes on encrypted packets it cannot open, so neither Cloudflare nor we can see or hear a call. Because every call goes through the relay, your partner never receives your internet address, and you never receive theirs. Like any network service, the relay does see the internet address your connection comes from while it carries the call. No call is ever recorded or stored, by us or by the relay. Your camera and microphone permission is given to the Yugma extension itself, not to Netflix, Prime Video or YouTube, and you can withdraw it at any time from your browser's settings.

What we never receive: your name, email, phone number, streaming account details, viewing history, payment information, or anything you type outside of Yugma's chat box. We assign no identifier to you or your device. Two sessions by the same person cannot be linked by us: the most we learn is a rough range, such as "two to four rooms before", which says nothing about which install it was.

3. What stays on your device

Some things are saved locally by the extension, in your browser's own storage. These never leave your computer and we cannot read them:

• Your chat transcript, so it survives a page refresh or a short absence. Each device keeps only its own copy, capped in size and stamped with the room's code. It is removed when you join a different room, when you come back and the room no longer exists, or after six hours without returning. We keep no copy at all.
• The last room code you used, so you can rejoin after a reload.
• What the two of you are watching — the title's reference and the room's code — so a refresh puts you back in the same episode. It is ignored after six hours. When you accept an invitation, a note that you did is kept for at most two minutes, so the page it opens can start the watch.
• A room you opened a join link for, for that tab only: when a yugma.app join link hands a room to the extension, or the home page asks it to start one, it keeps the room's code (for a start, only which site) in your browser's memory until the streaming site's page in that tab picks it up, once, and for at most ten minutes. Beside it the extension keeps only the time a link was last handed over, so streaming pages know when nothing is waiting.
• The emoji you used most recently (up to 24), for the picker's Recent row. Emoji are pictures packed inside the extension: showing them contacts no one.
• Whether Yugma is switched on, from the toolbar icon.
• Small reminders: that you've seen the first-run tour and the headphones tip, so they don't show again, and where you placed the call window and the call button, for that tab only.
• How you see yourself in a call — in the corner, below your partner, or hidden — kept until you change it. Only that choice is saved; your picture never is.
• A usage note: the day this install first opened a room and how many rooms it has opened. When you start or join a room only a rough range of each is sent (section 2); the two numbers themselves stay here.
• Diagnostic recordings, in developer builds only. The version on the Chrome Web Store contains no recorder. In a developer build a recording is kept in the page's memory and written only to your own computer when you export it. Nothing is uploaded. If you want to send one to us to help fix a bug, you export it as a file and send it yourself — that is the only way one ever reaches us.

Uninstalling the extension removes all of it.

When you uninstall it, your browser opens yugma.app/bye, with the extension's version number in the address. We count that visit, and nothing else about it. The form on that page is optional.

When you install it, the extension opens yugma.app/welcome once, with its version number in the address. We count that visit as one install, and nothing else about it.

4. What we store, and for how long

Rooms. A room lives in our server's memory while it's in use. Once two people have been in it, it is deleted roughly thirty seconds after the last person disconnects (a little longer if their connection dropped rather than left, to let them come back). A room nobody has joined yet waits up to six hours for the person you sent its code or link to, then is deleted. A room is never written to a disk or a database.

Server logs. Our server writes technical logs — connection and disconnection events, error conditions, the hourly totals described in section 5 — to help us keep it running. They are kept on a short rolling window: each log is capped in size and cleared every week, so nothing in them outlives about a week. They do not contain your chat messages, the references to what you watch, or the codes of rooms that exist. We do not record your IP address in them. It is held only in memory, to limit how fast one address can create rooms or try room codes, and beside a room you created until someone joins it or it ends, to limit how many empty rooms one address can keep open.

Hourly totals. The counts described in section 5 are also kept as numbers in a small table on our own server, one row per hour, so we can see whether Yugma is getting better or worse over weeks and months. A row holds only that hour's totals. Nothing in it can point to a person.

Referral links. If you make one, its code, when it was made and a one-way scrambled form (a salted hash) of the agent id you made up are kept with its counts (visits, install clicks, installs) until you ask us to delete them at hello@yugma.app. No name is asked for. See section 6.

Nothing else. We operate no user database, because we have no users to put in one.

5. Analytics

We need to know whether Yugma is actually working — whether people can create rooms, whether joins are failing, whether people are pairing up. We do this without identifying anyone.

Our server keeps running totals, written to its own log once an hour and then reset, and kept as numbers in a small table on the same server so we can see trends over weeks (section 4). For example: forty rooms created; thirty-one joins succeeded; six failed because the code didn't match a room; two rooms paired; how many watch suggestions were made on each platform; how many calls were started.

Alongside those it counts the following, in rough ranges rather than exact values. A session's numbers are added to the totals when its room closes, and the room is then deleted as usual.

• Which streaming site a room is on, from the web address the extension connects from.
• How long a paired session lasted: under 2 minutes, 2 to 10, 10 to 30, 30 to 90, or more than 90.
• How long it took a partner to join, and whether playback started once you were both there.
• How many sync corrections, reconnects and dropped connections a session had.
• How many chat messages and reactions were sent. They are counted, never read: chat stays end-to-end encrypted.
• How calls ended (hung up, failed or timed out) and how long they lasted.
• Which browser a room was started from, as one word from a fixed list (Chrome, Edge, Firefox, Opera or other) read from your browser's standard user-agent string, and which version of the extension.
• The two rough ranges the extension sends when you start or join a room: how many rooms this install has opened before (none, one, two to four, five or more) and days since its first (the same day, 1 to 6, 7 to 29, 30 or more). The extension keeps the two numbers behind them on your device; only the range is sent.

The important part: these are counts, not records. There is no row for you. Every value is a number from a small fixed list — never free text, never a link, never a message, never an identifier. They go nowhere else: no analytics service receives them. The website's visit counts (section 6) are kept the same way.

Failed joins. When a join fails because the code doesn't match any room, the server notes that code in its log so we can find out whether people are mistyping codes, using expired ones, or hitting a bug. A code that matches no room is not a secret — it identifies nothing and nobody. The code of a room that exists is never written to the log.

We do not use any of this for advertising and do not send any user identifier anywhere.

6. The website

yugma.app is the page you're reading. It is separate from the extension.

The suggestions form. If you send us a suggestion or a concern, we receive the message you type and, only if you give one, your email address, with the time it arrived. Nothing else is stored with it — not your IP address, not your browser. It is kept in a small database on our own server (Google Cloud, Mumbai, India) that only the operator can read. We use your email only to reply to what you wrote. We never sell it, never send marketing you didn't ask for, and never pass it to anyone. Ask us at hello@yugma.app and we'll delete your entry.

Site analytics. The site counts visits itself, with no third party and no cookies, and stores nothing in your browser unless you arrive through a referral link, or open a join link or pick a site on the home page before Yugma is installed (all below). When a page loads, when a button that opens the extension's store page is pressed, and when a phone sends itself the link with the "send it to my laptop" button, the page tells our server which page it was and where you came from: the campaign tag in the link you followed (utm_source) or the name of the site that linked you. The server turns that into one word from a fixed list, adds one to a count and keeps nothing else. It also counts whether the visit came from a desktop or a mobile browser, from the user-agent string your browser sends. On yugma.app/bye, the page you see after uninstalling, the page also sends the extension's version number. Your IP address is used only in memory, to limit abuse, and is never stored or logged.

Referral links. Anyone can make a link of the form yugma.app/?r=code from the bottom of the home page, to share with friends. You make up an agent id, and that is all you type: no name. We store the link's random code, the time it was made, and a salted hash of your agent id: we cannot read it back, only check a guess against it, which is how you prove the link is yours when you claim a treat. (A link we make by hand for a friend carries the name they gave us instead.) We store all this in the same database as the suggestions form, and count the visits, install clicks and installs that arrive through it. Those are counts only: the person who shared the link is not told who you are, and neither are we.

If you arrive through someone's link, this browser remembers that code in its local storage for up to 30 days, together with which of three steps (a visit, an install click, an install) it has already been counted for, so that one browser counts once however often it reloads the page. When the extension opens yugma.app/welcome after it is installed, that page sends the code once so the install is credited to the link. Nothing else is stored, and nothing at all if you came without a referral link. You can clear it any time by clearing this site's data in your browser.

Join links. A link like yugma.app/j#prime-K7P2QX carries your room code after the #. Browsers keep that part to themselves: it never reaches our server, our logs or our counts. The page reads it in your browser and hands it to the Yugma extension, which takes you into the room.

The extension talks to yugma.app pages, and only those, to say that it is installed (its version number and whether it is switched on), to receive a room you chose to join, and to start a room on youtube, prime video or netflix when you pick one on the home page. No other website can talk to it this way.

If you open a join link before Yugma is installed and press the button to add it, this browser keeps the link's room code in yugma.app's own storage for up to an hour, so the join can carry on once Yugma is installed. Once it is used the code is deleted, and only the time it was used stays, so a second yugma.app tab knows not to join again. After the hour, the next yugma.app page you open deletes either.

In the same way, if you pick youtube, prime video or netflix on the home page before Yugma is installed, this browser keeps which site you picked, and the time, in the same place for up to an hour, so the room can start once Yugma is installed. It holds nothing else, and it is deleted the same way.

We count how many join links are opened and where they lead: handed to the extension, sent to a store, or shown the page for phones. Each count carries only the streaming site's name, never which room.

When you pick one of the choices behind "try now" on the home page, the page counts which one you picked (youtube, prime video, netflix, any site or offline), and nothing else.

If we ever add anything else that stores something in your browser, we will update this page first and, for visitors in the EU or UK, ask for your consent before anything is set.

7. Who else is involved

We keep this list as short as we can. In full, it is:

• Google Cloud — hosts our server, in Mumbai, India.
• Cloudflare — provides DNS for yugma.app, and relays video calls. The call relay carries only encrypted call data it cannot read, and sees the internet address of each browser on the call while the call lasts (see section 2).
• The Chrome Web Store — distributes the extension and reports installation counts to us, in aggregate. Google's own privacy policy governs the store.

Netflix, Amazon Prime Video and YouTube are not our partners and receive nothing from us. Your relationship with them is entirely your own, governed by their terms and their privacy policies. Yugma does not log you in, does not touch your account, and does not change what they can see about your viewing.

8. Your rights

Because we hold almost nothing, most rights are simple to satisfy — often because there is nothing to act on.

If you are in India, under the Digital Personal Data Protection Act, 2023, you may ask what personal data we hold about you, ask us to correct or erase it, nominate someone to act for you, and raise a grievance. Write to hello@yugma.app and we will reply within a reasonable period. In practice, unless you have sent us a message through the suggestions form, our honest answer will be that we hold no personal data about you at all. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If you are in the EU, the UK or the EEA, under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your national supervisory authority. Our lawful basis for relaying your session data is the performance of the service you asked for; for our aggregate counts it is our legitimate interest in keeping the service working, which involves no personal data. A message and email you send through the suggestions form are processed with your consent, withdrawable at any time. Data held by Google on our behalf is transferred outside the EEA under Google's standard contractual clauses.

Everyone, wherever you are, can stop everything at once by leaving the room or uninstalling the extension. There is no account to close.

9. Children

Yugma is not intended for children under 13, and we do not knowingly collect anything from them. The streaming services Yugma works with require their own accounts with their own age requirements.

10. Security

Connections between your browser and our server are encrypted with TLS. The server holds no database of users and no stored session content, which means there is very little for a breach to expose. Our infrastructure is restricted to the ports needed to serve the site and the relay, with administrative access limited to the operator.

We are one person, not a security team. We have designed Yugma so that the worst case is small: there is no archive of who watched what with whom, because we never built one.

11. Changes to this policy

If we change how Yugma handles data, we will update this page and change the effective date at the top. Significant changes — particularly anything that widens what we receive — will also be announced in the extension itself. Continuing to use Yugma after a change means you accept the updated policy.

12. Contact

hello@yugma.app — for questions, requests, complaints, or anything on this page. The extension is on the Chrome Web Store; the rest of Yugma is on the home page.