Security

Accounts and sign-in

• Passwords are handled by our authentication provider and stored only as secure hashes — ThaVibes staff can never see them.
• New accounts must confirm their email address before staff or creator features unlock.
• Sessions are signed tokens that expire and refresh automatically; signing out on a device ends that session.

Access control

• Every database table is protected by row-level security: you can only read or change your own private data, such as your saved list, watch progress, ratings and tips.
• Roles (viewer, creator, admin) are stored separately from profiles and are checked on our servers for every privileged action — never in your browser.
• Control Room actions (publishing, payouts, fee changes, rankings, role changes) require a verified admin on the server.
• Private account details are kept apart from public creator profiles, which contain only a display name, picture and bio.

Protecting films

Video files are hosted by Vimeo and are private on Vimeo itself; they play only when embedded on ThaVibes. Playback references are never included in the public catalog and are handed out only by our servers after checking the title is published and you're allowed to watch it.

Payments

Popcorn tips are paid through Stripe's hosted checkout. Card details go directly to Stripe and never touch ThaVibes servers. We confirm every tip by checking with Stripe before recording it, and each tip stores the fee that applied when it was sent.

Secrets and infrastructure

• API keys for Stripe and Vimeo are stored as encrypted server secrets and are never sent to browsers.
• All traffic is encrypted in transit with HTTPS/TLS, and data is encrypted at rest by our cloud provider.
• Translation runs on your device, so page text isn't sent to outside translation services.
• We run automated security scans and fix findings on an ongoing basis.

Our commitments

We apply least-privilege access for staff, review admin access regularly, keep logs of sensitive actions, and will notify affected users and regulators of a personal data breach as required by the Trinidad and Tobago Data Protection Act, GDPR, CCPA/CPRA and other applicable laws. No system is perfectly secure; see our Privacy Policy for more.

Keeping your account safe

• Use a unique, strong password and never share it.
• ThaVibes will never ask for your password by email, chat or phone.
• Only pay tips through the Send cash button on a ThaVibes title page.

Responsible disclosure

If you find a security issue, email support@thavibes.com with the subject "Security" and steps to reproduce it. Please give us reasonable time to fix it before sharing details publicly.

Do not access, change, delete or keep data that isn't yours, disrupt the service, run denial-of-service or social-engineering tests, or test payments with stolen cards. Good-faith research that follows these rules will not face legal action from us.