Privacy at sync.video

Last updated: 7 November 2026

In brief

The videos, recordings, songs, photos and subtitle files you open on sync.video stay on your device. Every tool reads them, analyses them and writes new files inside your browser tab; there is no upload and no account. The sync player is the one tool that talks to a server while you use it: a small relay introduces the devices in a room and passes on play, pause and clock messages, but never the video. We count visits to learn which tools and guides are useful, and the one counter that sets cookies can be turned off from any page.

Your files

When you open a file, your browser decodes it on your device. Finding an offset means comparing outlines of the sound and tiny, low-resolution copies of the picture; finding a beat means measuring the song’s loudness from moment to moment; syncing subtitles means detecting when people speak. All of that happens in your browser and is thrown away when you leave. Exports are written by your browser and handed to you as a download or through your phone’s share sheet. No frames, sound, file names, subtitles or results tied to your files are sent to us or to anyone else.

The sync player

To play one video in step on several devices, each device opens its own copy of the file, so the video itself never travels. The devices still need to find each other, and that goes through a relay we run on Cloudflare (a Worker with a Durable Object per room):

• What it sees: the six-character room code; a random id for each connected device; a short device name if you give one (such as “Living room TV”); the connection details the browsers exchange to link up directly, which include their local and public IP addresses; and, when a direct link can’t be made, the play, pause, seek and clock messages and each device’s sync report (timing figures and a fingerprint of the file: its size, length and a hash of three small slices, used to warn when devices have different files).
• What it keeps: only the room’s code, its creation and expiry times and a hashed host key, deleted when the host closes the room, 10 minutes after the last device leaves, or 12 hours after it was made, whichever comes first. Messages are passed on and not stored.
• Your IP address is used, hashed, only to limit how many rooms and connections one address can open, so the relay can’t be flooded. Our logs record event names and counts, never room codes, names, messages or addresses.
• STUN servers. To link devices directly, browsers ask public STUN servers run by Google (stun.l.google.com) and Cloudflare (stun.cloudflare.com) for their public address. Those servers see your IP address, as any server you contact does. We run no relay for media.

The room code travels in the link’s fragment (the part after #), which browsers don’t send to servers, so it doesn’t appear in our page statistics. Our basis for running the relay is that you asked to start or join a room (UK GDPR Article 6(1)(b)), and our legitimate interest in keeping it from being abused (Article 6(1)(f)).

The microphone

The audio delay test can time a short chirp with your device’s microphone, but only after you press Allow the microphone and your browser asks you. The sound is analysed in memory while the measurement runs, then discarded; it is never recorded to a file or sent anywhere. Stopping the test, or leaving the page, switches the microphone off.

What stays in your browser

• Saved projects. So a reload or a closed tab loses nothing, the editors keep your work in this browser: the files you opened in its private file storage (the Origin Private File System, or IndexedDB where that isn’t available) and the settings in IndexedDB (vt-projects), plus a small flag in localStorage so the home page can make room for “Continue where you left off”. The projects page lists them, with their size, and lets you delete any of them. Older projects are cleared automatically.
• The latest export. Long videos are written to the private file storage instead of memory; only the newest export is kept, and starting another deletes it.
• Small preferences: your light or dark choice (vt-theme), your analytics choice (vt-consent), the rating card’s state (vt-feedback), a measured device latency if you press Use this offset on this device in the delay test or Remember this delay on this device in the sync player (sync-latency-ms), the clapperboard’s production, roll, scene and take (sync-slate), and whether you’ve seen an editor’s quick guide. While a tab is open, sessionStorage holds a tempo or offset you pass from one tool to another, and the sync player’s room code and setup choices (sync-player-room, sync-player-prefs) so a reload can rejoin; they are gone when you close the tab.

None of this is sent anywhere. Clearing this site’s data in your browser settings removes all of it.

The format converter

Some files can’t be read by a browser directly (AVI, WMV, camcorder MTS and similar). For those, sync.video downloads a converter (ffmpeg compiled for the web, about 10 MB) from its own address, only when such a file is opened, and converts the file on your device. No third party is involved and nothing is uploaded.

Ratings and error reports

After a download or share, a small card may ask how the tool did, with five stars. Answering is optional. Four or five stars offers a link to review the site on Trustpilot, a separate company with its own policy; following it simply opens their site and we send them nothing. Lower ratings let you pick a reason and add a note; please keep personal details out of notes.

With a rating we store the stars, any reason and note, the event that prompted the card, the page path (with project ids hidden), the site version, a two-letter country from the network, and the browser, operating system and device type. When something breaks unexpectedly, your browser sends a technical error report: the message and where in our code it happened, the page path, the site version, a random id for that page view, browser, system, device type and country, with web addresses shortened and anything resembling an email address or a media file name removed. Neither ever contains your files or anything you typed. Your IP address is used only for a moment to rate-limit abuse and is not stored. Ratings are kept for up to 24 months, single error reports for 30 days and grouped summaries for up to 180 days, in Cloudflare storage, with Cloudflare as our processor. Our basis is our legitimate interest in keeping the tools working (Article 6(1)(f)). Google Analytics hears the number of stars and the reason as an event, never the note, and one error event per page view with only its type.

Hosting

Cloudflare hosts sync.video. Delivering each page and keeping the site safe means Cloudflare’s servers process the request, including your IP address and browser details, and keep short-lived logs. We rely on our legitimate interest in a fast and secure site. Cloudflare describes its practices in its privacy policy.

Counting visits

Two cookieless counters give us totals: Cloudflare Web Analytics and Ahrefs Web Analytics report how many visits arrive, roughly where from and which pages are read, without storing anything in your browser or following you elsewhere.

Google Analytics 4 is the third, and it sets cookies. Beyond page views, it receives short descriptions of what was used: a tool was opened, an automatic match was sure or unsure, a drift fix was applied, a room had four devices, a tempo was found, an export finished. Offsets and tempos are rounded, durations are whole seconds and file sizes broad bands. It never receives your files, their pictures or sound, file names, room codes, device names, subtitles or anything you type. We use the figures for one purpose: to see which tools and guides earn their place. Google signals is off, Google’s advertising consent signals are always denied, and no advertising product is linked. Event data is deleted after 14 months.

Google processes this for us and may do so on servers in the United States, under the EU-US Data Privacy Framework; see Google’s privacy policy and its explanation for partner sites. Our basis is our legitimate interest in improving the tools and guides. Setting the analytics cookies is allowed under the statistics exception that the Data (Use and Access) Act 2025 added to the UK’s Privacy and Electronic Communications Regulations. For anyone browsing from the EU, the EEA or Switzerland the rules differ: there, Google Analytics sets no cookies at all and only sends cookieless, anonymous pings.

Cookies, and turning them off

Two cookies are involved, _ga and _ga_<id>; sync.video sets them and they expire after two years at most. The first time you visit, a short notice says so. You can say no on any page at any time: open Cookie settings at the bottom of the page and choose Turn off analytics; this browser remembers it, and Turn analytics on reverses it. If your browser sends Global Privacy Control, sync.video treats it as the same request and never shows the notice. Nothing about you is sold, and the site carries no ads.

Who runs sync.video

sync.video is a small independent project, paid for by the people who build it rather than by investors or advertisers. There are no accounts, so we hold no profile of anyone; the only records are the analytics figures, the relay’s short-lived room data and the ratings and error reports described above, none of which carries a name. Privacy questions and requests go to hello@sync.video; the contact page says what helps us reply quickly.

Your rights

UK and EU data protection law lets you ask what personal data we hold about you and ask us to correct it, erase it, restrict or stop using it, or give it to you in a portable form. Your files never reach us, so there is nothing of them to hand over or delete; saved projects stay in this browser’s storage, and you can delete them there. Analytics records carry no name, only a random ID: end them with Turn off analytics or by clearing the cookies. Ratings and error reports aren’t linked to you, so to have one removed, tell us roughly when you sent it and what it said. Room data disappears by itself within hours. Write to hello@sync.video. If you aren’t happy with our answer, you can complain to a data protection authority; in the UK that is the Information Commissioner’s Office.

Changes

If the way sync.video handles data changes, this page is updated in the same release and the date at the top moves on.