Privacy Policy

Applies to the public instance at vivid.errexe.xyz. Last updated: October 18, 2026.

Vivid is a privacy focused frontend for YouTube. This page explains which data this instance receives, why, where it is kept, and how you can remove it. Other instances are run by other people and may handle data differently.

Short version

• No ads, no analytics, no fingerprinting, no third-party trackers.
• Vivid itself does not set cookies.
• Vivid does not log IP addresses, user agents or cookies. The instance sits behind Cloudflare, which does see them (see "Cloudflare" below).
• The instance runs the unmodified source code from GitHub (see "Source code" below).
• An account is optional. If you make one, only the data listed below is stored, and you can delete it yourself at any time.

Data you provide: accounts

You can browse and use Vivid without an account. If you create one, the following is stored in the instance's database until you delete the account:

• your username
• a salted hash of your password (the password itself is never stored)
• your synced channel subscriptions
• your synced playlists, including the videos in them
• the time the account was created
• a random session token for each device you are logged in on, with its creation time

This data is only used to provide the sync feature. It is not sold, shared or analysed. Sessions stay valid until you log out or delete the account.

Data you passively provide: server logs

When you request anything from this instance (a page, an image, an API call), one line is printed to the server's console. It contains only:

• the time of the request
• the response status code
• the request method
• the requested URL, including its query string
• how long the response took

2026-01-01 10:00:00 +00:00 200 GET /api/v1/videos/xxxxxxxxxxx 120.52ms

The logs do not contain your IP address, user agent, cookies or account name. They are not written to files by Vivid and are only used to find and fix errors. Because the URL is logged, things like a search term or a video ID can appear in it, but nothing links them to you.

The server is hosted on a virtual private server. Like any hosting provider, the provider's network can technically see connections to the server. Vivid itself does not record them.

Cloudflare

This instance uses Cloudflare as a reverse proxy. Your requests first go to Cloudflare, which forwards them to the server. This means:

• Cloudflare technically processes everything sent between your browser and this instance, including your IP address, your browser's headers and the requested URLs.
• Cloudflare may keep its own logs and may set technical cookies (for example for security or bot protection). These are set by Cloudflare, not by Vivid, and are not used by Vivid.
• The instance's own logs only show what is described above. Cloudflare's handling of data is governed by Cloudflare's privacy policy.

Content that you request through the proxy features (videos, thumbnails and so on) is also routed through Cloudflare on its way to you.

Content from YouTube and other services

Vivid fetches video, channel, search, comment and caption data from YouTube on its server and passes it on to you. Video and audio streams, thumbnails and avatars are proxied through the instance, so your browser does not contact Google directly for them. Google therefore sees the instance's IP address, not yours.

If SponsorBlock segments are enabled in your settings, the instance looks up the segments for the video on sponsor.ajay.app. Only the video ID and the categories are sent, and the request comes from the server.

Fonts and other assets are served by the instance itself.

Data stored in your browser

Vivid uses your browser's local storage, not cookies. It holds:

• your settings (theme, playback and filter options)
• your subscriptions and playlists
• if you are logged in: your session token and username

This data stays on your device unless you use the account sync. You can delete it by logging out and clearing this site's data in your browser.

Removing your data

• In your browser: log out and clear the site data in your browser settings.
• On the server: open Account, choose Delete Account and confirm with your password. Your user entry and all of your sessions are removed from the database.

Source code

Vivid is free software under the AGPL-3.0. The public instance at vivid.errexe.xyz always runs the latest available source code from the GitHub repository, without modifications. The only files that differ from the repository are instance-specific data and configuration files, such as cookies, OAuth2 credentials and the user database. You can verify what the software does by reading the source code.

Contact

Questions about this policy can be raised through the issue tracker of the GitHub repository.

Changes

If this policy changes, the date at the top is updated.