Privacy Policy

Five (“Five,” “we,” “us”) is operated by Hope Works LLC, an Oregon limited liability company. This policy explains what information we collect, why we collect it, and what we do with it.

We built Five because we think the attention economy extracts too much from people. That principle applies to your data too. We collect the minimum needed to make the product work, we don't sell it, and we don't use it to advertise to you.

Information We Collect

Information you give us

• Account information. When you create an account, we collect your email address. If you set a display name, we store that too.
• Your Five. The creators you select, any additional Fives you create, and the names you give them.
• Preferences. Your daily viewing length, theme choice, feed settings, and similar configuration.
• Shelves. Videos you save to your Shelves, and the names of those Shelves.
• Payment information. If you subscribe, payment is processed by Stripe. We never see or store your card number. We store your subscription status and Stripe customer identifier.
• Support correspondence. If you email us, we keep that correspondence.

Information from Google and YouTube

If you connect your Google account, we request the youtube.readonly permission. This is read-only access — Five cannot modify, delete, or post anything to your YouTube account.

We use it to:

• Retrieve your existing YouTube subscriptions once, during creator selection, so we can suggest channels you might want in your Five. We do not continuously sync or monitor your subscriptions.
• Retrieve public information about the creators you select — channel name, avatar, and their uploaded videos.
• Retrieve public metadata about videos we display — title, duration, thumbnail, publish date.

We store an OAuth refresh token so we can keep your feeds current without asking you to sign in repeatedly. You can revoke this at any time (see Your Choices below).

Information collected automatically

• Usage data. We use PostHog to understand how people use Five — which features get used, where people get stuck, whether the product works. This includes device type, browser, approximate location derived from IP address, and in-app actions.
• Error data. We use Sentry to capture technical errors so we can fix them. Error reports may include your user ID and details about what you were doing when something broke.
• Watch progress. We store how far you've watched in a video so Continue Watching works, and a record of videos you've watched so we don't resurface them.
• Daily history. We keep a record of which videos appeared in your Daily and on which day, so a new Daily can avoid repeating what you've already been shown. We use it only for that — never to rank, recommend, or advertise — and delete each entry after 30 days.
• Abuse prevention. To stop abuse, we briefly count some requests — by account, or by IP address for some requests made while signed out, such as sending feedback or loading a shared Five's images. We use these counts only to limit abuse and delete them within 2 days.

What We Do Not Do

We want to be specific, because vague privacy policies are how companies hide things.

• We do not sell your personal information. Not to advertisers, not to data brokers, not to anyone.
• We do not use your data for advertising. Five has no ads and no advertising partners.
• We do not track you across other websites. No third-party advertising pixels, no cross-site tracking.
• We do not build profiles to recommend content. Five never ranks videos by what keeps you watching. That's the entire point of the product.
• We do not write to your YouTube account. Our access is read-only.
• We do not share your data with third parties except the infrastructure providers listed below, and only to the extent needed to operate Five.

Google User Data — Limited Use

Five's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide and improve the features described in this policy.
• We do not transfer Google user data to third parties except as necessary to provide or improve Five, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for advertising purposes.
• We do not allow humans to read Google user data unless we have your explicit consent for specific data, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymized for internal operations.

Service Providers

We use the following providers to operate Five. Each receives only the data needed for its function.

Embedded YouTube Player

Videos play through YouTube's official embedded player. When you watch a video in Five, YouTube receives information directly from your browser — including your IP address and, if you're signed into Google in that browser, your Google account activity. YouTube may serve advertising and may set cookies.

This activity is governed by Google's Privacy Policy, not this one.

We configure the player to minimize suggestion surfaces: autoplay into suggested content is off, and when a video ends Five replaces the player with its own completion screen rather than leaving YouTube's suggested-video grid on screen. Five only ever shows videos from the creators you chose. Features like Daily pick from those creators using simple rules: how recent a video is, what you haven't watched, and how much time you've set aside. Five never decides what to show you based on what keeps you watching.

Some surfaces are outside our control. Creators can place promotional cards in the final seconds of their own videos, linking to their other work — YouTube's player renders these, and no embedding option disables them. We don't interfere with them, and we don't think we should: they're the creator's editorial choice about their own content, not an algorithmic suggestion. We also don't control what data YouTube collects during playback.

Data Retention

We keep your account data as long as your account is active.

• Watch progress for partially watched videos is automatically deleted after 21 days of inactivity.
• Daily history is deleted after 30 days.
• Abuse-prevention counts are deleted within 2 days.
• Analytics data is linked to your account ID, never your email address. PostHog keeps it for up to 1 year, and when you delete your account we have PostHog delete it. PostHog removes it within a week of our request.
• Error reports are kept by Sentry for 30 days.
• Email records (addresses and content of emails sent through Resend) are kept by Resend for 30 days.
• Account deletion removes your account data, including everything we stored from YouTube for you, right away. If any part of the deletion fails, we're alerted and finish it by hand within 7 days. Our database backups expire after 7 days, so deleted data is gone from them within 7 days too.

Your Choices

• Access and export. You can request a copy of your data from Settings, or by emailing us.
• Deletion. You can delete your account from Settings. This immediately removes your profile, your Fives, your Shelves, your watch history, and your Google connection, and revokes Five's access to your Google account. Deleting data stored by Five doesn't affect any data stored by YouTube.
• Disconnect Google. You can disconnect your Google account from Settings at any time. You can also revoke Five's access directly at myaccount.google.com/permissions.
• Analytics opt-out. Contact us if you'd prefer we exclude your usage from analytics.
• Email preferences. Transactional emails (password resets, receipts) are required for the service. You can unsubscribe from any non-essential email.

If You're in the EU or UK

Under GDPR, you have rights to access, correct, delete, restrict processing of, and port your personal data, and to object to processing. You may also lodge a complaint with your local data protection authority.

Our legal bases for processing: contract (to provide the service you signed up for), legitimate interests (security, fraud prevention, product improvement), and consent (for Google account connection, which you can withdraw at any time).

Data is processed in the United States. Where required, we rely on Standard Contractual Clauses with our providers.

If You're in California

Under the CCPA/CPRA, you have rights to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing.

We do not sell or share personal information as those terms are defined under California law, and we have not done so in the preceding twelve months.

We will not discriminate against you for exercising these rights.

Children

Five is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we'll delete it.

If you're between 13 and 18, please review this policy with a parent or guardian.

Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), encryption at rest, row-level security in our database, and bot protection on authentication endpoints. Access to production data is limited to personnel who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we'll notify you as required by law.

Changes to This Policy

If we make material changes, we'll notify you by email or through the app before the changes take effect. The “last updated” date at the top always reflects the current version.

Contact

Questions about this policy, or requests regarding your data:

Hope Works LLC
Email: support@whatsyourfive.com
Website: whatsyourfive.com