STOCKFILM

Legal

Privacy Policy

This policy describes what stockfilm.com actually collects, why, how long it is kept, and which outside services see it. It is written to match the site as it runs today.

Effective date: September 24, 2026. Last updated: October 2, 2026.

1. Who Is Responsible

Stockfilm operates this website and is the controller of the personal data described here. Contact: phil@stockfilm.com, or by post at Stockfilm, 2823 Callan Ct, Broomfield, Colorado 80023, USA.

2. What We Collect, by Activity

Browsing the site

Cloudflare sits in front of the site and filters automated traffic before it reaches us. Our servers log the IP address, browser user agent, requested URL, and time of each request so we can keep the site up, block scrapers, and investigate abuse. API endpoints are rate limited by IP address. Some visitors are asked to complete a short browser check; passing it sets a cookie (see section 3) so you are not asked again for 30 days.

Searching the archive

We store the text of search queries, with a timestamp, the result count, the filters you applied (year range and place), and the page path the search ran on, to power autocomplete and to see which subjects people look for. No IP address or account identifier is stored with a query.

Licensing footage

When you buy a direct license we record:

  • Your email address. Checkout asks for nothing else about you. The licensee named on the license certificate and invoice is the holder of that email address.
  • The clips licensed, the price paid, any coupon or referral code, and the payment method used.
  • Payment details according to the rail you choose. Card payments are handled by Stripe Checkout on Stripe's own pages: Stripe collects your card number, name, and billing address there, under its privacy policy. We receive only a payment confirmation with Stripe's session, payment, and payment method identifiers. We do not receive or store card numbers, the last four digits, or the billing address. Bitcoin (on-chain), Solana SOL, and Solana USDC payments are settled on public blockchains; we record the payment address and transaction reference, which are public by design.
  • For each download of a licensed file: the time, IP address, and browser user agent. This is our proof of delivery.

Licensing records are business and tax records. We keep them for as long as the license is in force and as long as tax and accounting law requires. If your order involves a jurisdiction we cannot serve automatically, the inquiry you submit for manual review is stored with your IP address and user agent and sent to us by email.

Contact and request forms

The contact, request footage, and metadata correction forms send your message and email address to us through our own mail server. The submission is not stored in a database; it lives in our mailbox for as long as we need it to reply and act on it.

Two forms work differently. TimeFly inquiries (name, email, organization, and the brief you write) are stored in our database and forwarded to our internal brief queue, where we review them. Partner program applications are posted from your browser to partners-api.stockfilm.com, our own partner-program service, and stored there for as long as the application is under review or the partnership is active.

Free tools

  • Clip Analyzer. The video or image you upload is processed on our own server and deleted within one hour. The analysis record (results, a single thumbnail frame, the original filename, and a salted hash of your IP address) is kept for 30 days so the result page and PDF keep working, then purged. If you ask for the PDF by email, we store your email address, the analysis it relates to, your browser user agent, and the same hashed IP, and we send the report. That email record is purged on the same 30-day cycle.
  • Grain overlay downloads. Your email address is used only to send you a signed download link that works for 7 days. We do not store the address or a record of which pack you requested.
  • Rough cut builder. Rendered previews are stored for 7 days (168 hours) and then deleted. No account is required.
  • Boards. Project boards are tied to an anonymous browser cookie, not to an account. If you clear the cookie you lose access to the board; we cannot link it to you by name.

3. Cookies and Browser Storage

The site sets these first-party cookies:

  • __sf_v (1 hour): proves your browser runs JavaScript. Required for search endpoints.
  • __sf_human (30 days): set after you pass the browser check.
  • sf_dc (6 hours): marks traffic that arrives from datacenter networks so it is kept out of our analytics.
  • sf_ref (30 days): remembers an allowlisted referral source such as a partner association, so the checkout can show the matching benefit.
  • _cref (90 days): partner referral code, used to credit a partner if you buy a license.
  • _sf_gclid (90 days): the Google Ads click identifier from the URL you arrived on, stored so a later purchase can be attributed to that ad.
  • boards_owner (2 years, HttpOnly): the anonymous identifier for your project boards.

Your light or dark theme choice is kept in browser local storage. Google Analytics and Google Ads set their own cookies, described in section 4. You can delete or block cookies in your browser; search, the browser check, and boards will stop working without them.

4. Analytics and Advertising

We use Google Analytics 4 (property G-T99XZRT5ZX) with IP anonymization turned on to see which pages and searches are used. We also run Google Ads conversion tracking (account AW-18306466700). When you complete a purchase, the browser reports the order value and the clip to Google, and, for enhanced conversions, your email address is hashed by Google's script in your browser before it is sent so Google can match the purchase to an ad click. We also keep the Google click identifier on the transaction record and may upload it to Google Ads to report the sale. We do not run other advertising or social tracking pixels.

5. How We Use Email Addresses

We use your email address only to deliver what you asked for: license files and certificates, tool downloads and reports, and replies to your messages. We do not keep a marketing list and we do not send promotional email.

6. Services That Handle Your Data

We do not sell personal information. The following services process data on our behalf or are contacted by our servers while serving you:

  • Cloudflare: edge network, bot filtering, and TLS for every request.
  • Stripe: card payments and receipts.
  • Google: Analytics 4 and Ads conversion tracking, as described above.
  • CoinGecko (exchange rates), mempool.space (Bitcoin transaction status), and a Solana RPC node (Solana transaction status). These see the payment address and amount, not your name or email.
  • Twilio: when configured, sends an SMS to the site operator with order details, including your email address, so we can fulfil quickly.
  • Our own mail server: sends license emails, download links, and form messages.
  • Our internal brief queue: receives TimeFly inquiries (name, email, organization, and brief) for review.
  • partners-api.stockfilm.com: our own partner-program service, which receives and stores partner applications.

We disclose data to authorities when the law requires it or to protect our legal rights. Links to marketplaces and social platforms lead to sites governed by their own policies.

7. Retention Summary

  • Server and security logs: rotated on a short cycle measured in hours to days.
  • Search queries: kept indefinitely, without any personal identifier.
  • Licensing and download records: for the life of the license plus the period tax and accounting law requires.
  • Clip Analyzer uploads: deleted within 1 hour. Analysis records and PDF email requests: 30 days.
  • Rough cut renders: 7 days.
  • Form submissions: in our mailbox for as long as needed to respond.
  • TimeFly inquiries and partner applications: stored for as long as the inquiry, application, or resulting partnership is active.

8. Security

Traffic is encrypted in transit. Payment card data is handled entirely by Stripe. Download links and license links are signed and expire. Access to the production database is limited to the site operator. No system is perfectly secure, and we cannot promise that a breach will never happen.

9. Your Rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. We will do so unless we have to keep the record for tax, accounting, or license enforcement reasons, in which case we will tell you what we are keeping and why. Email phil@stockfilm.com. If you are in the EU, UK, or a US state with a privacy statute, the rights that law gives you apply, and you may also complain to your local supervisory authority.

10. Children

This website is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has sent us data, email us and we will delete it.

11. Governing Law and Changes

This policy is governed by the laws of the State of Colorado, USA. When we change how the site handles data, we update this page and the date at the top. Material changes to how purchase data is used will also be noted on the checkout page.