Draft. This text was written on 25 October 2026 and is not final yet. It can change before nextup opens to the public.
Privacy
nextup is built to know as little about you as possible. You do not need an account, and there are no third-party trackers and no advertising.
Who is responsible
Lans IT runs nextup and is responsible for the data described here. Contact details are on the contact page.
Before you press Play
The start screen comes only from our own server. It makes no request to YouTube, Vimeo, Google or anyone else: no player, no thumbnails, no fonts from elsewhere.
If you choose Browse without video instead, you get the same videos as a plain list with links to the originals. Nothing on that list loads from YouTube or Vimeo either.
When you press Play
Pressing Play loads videos from YouTube (owned by Google) and Vimeo, two other companies. From then on, their players receive your IP address and information about your device and browser, and they may set cookies or similar storage for their own purposes, including advertising.
We are responsible for loading their players and passing that information on. What YouTube and Vimeo do with it afterwards is their responsibility; see the Google Privacy Policy (opens in a new tab) and Vimeo's privacy policy (opens in a new tab).
Pressing Play is how you agree to this. You can withdraw at any time with the Videos setting at the bottom of every page: the players close at once and none loads again until you press Play again.
What YouTube and Vimeo may store on your device once you press Play, and for how long: They decide this themselves and change it from time to time, so these are examples, not a complete list. YouTube (we use its privacy-enhanced mode on youtube-nocookie.com) may set, for example, YSC (until you close your browser), __Secure-YNID (6 months; Google says it replaces VISITOR_INFO1_LIVE), __Secure-ROLLOUT_TOKEN (6 months), PREF (8 months after you last use YouTube) and __Secure-YEC or __Secure-YENID (13 months), and may keep items such as yt-remote-device-id in your browser's storage until you clear it. Vimeo (we ask its player not to track you) then sets only player_clearance (7 days), cf_clearance (1 year), _cf_bm (30 minutes) and _cfuvid (until you close your browser); cookies Vimeo set on an earlier visit, such as vuid (2 years), are still sent to it. Their own lists are in Google's cookie policy (opens in a new tab) and Vimeo's player cookies page (opens in a new tab).
nextup uses YouTube API Services to check that a video can be played here and to read its title, channel and length.
If you are under 16, ask a parent before you press Play.
What your device keeps
- Your choice on the start screen (Play, or Browse without video), so we do not ask again.
- The list of videos you have seen, up to 5,000, so nextup never repeats one. It is sent with each request for the next video so those can be skipped. The nextup application does not store or log it.
- Your display settings: night mode, the video length, and how you tuned the ranking (a preset's name or your slider settings).
These are needed for the service you asked for, so they need no separate consent. They stay in your browser's storage for this site. Forget what I watched, at the bottom of every page, clears the list of videos; clearing this site's data in your browser removes all of it.
What our server records
- Play reports.When a video stops, your browser reports which video it was, which stream it came from and how long it played. The server also notes which ranking it was served with: a ready-made preset, "custom" for anyone's own slider settings, or a public saved ranking, never a private one. The server keeps only a band for the time, such as "10 to 30 seconds". There is no name, account, device id or IP address in it. We use these reports to measure and rank videos (see How it works). Single reports are kept 90 days, then only totals per video remain.
- Your IP address is used to limit abuse, and only as a scrambled code (a hash with a secret that changes every day and is never saved). The nextup application never stores or logs the address itself. Nor does the web server in front of it: it keeps no log of play reports, or of requests for the next video (which carry the list of videos you have seen).Checked at deploy (task 1.17)
The legal basis for play reports and abuse limits is our legitimate interest in a working, honest stream. Dutch law lets a site measure the quality of its own service without consent when nothing identifies you.
Visitor statistics
We collect no visitor statistics at the moment. When we switch them on, we will use Umami, an analytics tool we run ourselves on the same server as nextup. It sets no cookies and stores nothing on your device. Your browser only ever talks to nextup for it: the script comes from our own address, and our server passes the counts on to Umami. No other company receives them. This is what it will record.
- Each page you open:its address without anything after a "?" or "#". On a shared video page the video's number is left out, so the statistics never say which video anyone looked at.
- Where you came from:only the other site's address, such as reddit.com, never the page on it.
- About your device: browser, operating system, type of device, screen size and language.
- Roughly where you are: country and region, and sometimes a city, worked out from a shortened IP address.
- Three actions, with no detail attached: that Play was pressed, that Browse without video was chosen, and that the app was installed.
Your full IP address never reaches Umami. Before anything is passed on, our server cuts off the last part of it (the last of the four numbers, or everything after the first three groups of a newer address), so it points to a whole neighbourhood of connections rather than to you. Umami combines that shortened address with your browser and a secret that changes every month, and keeps only the scrambled result, to tell roughly how many different people visited. It cannot follow you from one month to the next or onto other sites. Pages for signing in and the owner's own pages are not counted.
If your browser sends Do Not Track or Global Privacy Control, nothing is counted at all.
Why: to see whether the site works and how many people use it. Once other people can add videos, the authorities may also ask us how many people in the EU use nextup each month (Digital Services Act, Article 24(3)), and these counts are how we would know. The legal basis is our legitimate interest in both. Dutch law lets a site measure the quality of its own service without asking consent when nothing identifies you, and that is the rule we rely on.
How long: 12 months. Umami stays off until the monthly job that deletes older records is running.
Reports and appeals
When you report something, we store what you reported, the reason and explanation you gave, and your name and email address if you gave them. If you appeal a decision, we store your appeal and the email address our notices went to. We use them to handle the report or appeal and to send you our confirmation and decision, which the EU Digital Services Act asks of us (legal basis: a legal obligation).
We delete a report, with your name and email address, two years after our decision, and an appeal two years after its outcome. If a report is still waiting for a decision two years after it arrived, we delete your name and email address from it then. The notes we keep on why a decision that followed a report was taken are deleted two years after the decision; the public entry stays, without them. The public moderation log never shows who reported something. Your IP address is not stored with a report; it only feeds the daily scrambled code that limits how many reports one address can send.
Accounts
Right now only the owner has an account. Visitors cannot sign up while nextup shows one person's picks. This section describes what happens once nextup opens to members; until then, none of it applies to you.
An account needs an email address and a handle, and you must be 16 or older. When you sign up we store your email address, your handle, the invite code you used (as a scrambled copy), which version of the terms you accepted and when, and when you confirmed your age. Your account exists only once you open the link we email you; a signup that is never confirmed is deleted after 24 hours.
The signup page uses Cloudflare Turnstile to keep bots out. Its script loads from Cloudflare only after you start filling in the form, and from then on Cloudflare receives your IP address and information about your browser. Nothing from Cloudflare loads on any other page, except the contact form if we switch the same check on there.
Signing in works with a link we email you. It sets one sign-in cookie that lasts 30 days; we store only a scrambled copy of it, with no IP address or browser details.
What members do on nextup
- Votes. We store your vote on each video and when you cast it. Votes count after a waiting time and weighted by trust (see How it works). No other member can see how you voted.
- What you watched. While you are signed in, we store which videos you have seen, so no device shows you one twice, and how your first play of each went (for example finished, or skipped early). Both are stored to the hour, not the minute, so they cannot be matched to the anonymous play reports. After 13 months both are deleted. The list of seen videos simply goes; how your plays went, where it already counted in the ranking, stays only inside an anonymous total per video.
- Videos you add, with your note and tags, are public, with your handle. Tags you suggest for a video that is already on nextup are seen only by the owner.
- Saved rankings. The rankings you save keep their name, settings and whether they are public. Only you see the name; a public one is shared by a random link that does not say who made it. They are in your data export and are deleted with your account.
- Your public profile shows your handle, the month you joined, the videos you added that are in the community stream or being tested, and how many of them graduated. It never shows your trust, your votes, who invited you or your email address. Search engines are asked not to list it, and you can hide it on your account page. Once you delete your account it is gone.
- Trust. We compute a trust score for each member once a day from how long you have been a member, what you watch and how your votes compare with the outcome. It sets how much your votes count and how many invites and submissions you get. It is not public: only you (on your account page, with how it was computed) and the owner who runs the site see it. If the owner sets it by hand, you see that and the reason there too.
- Invites. We record who invited whom. The owner sees this as a tree, to spot groups of fake accounts.
- Volunteer mode, if you switch it on: the setting and how often you want videos from New.
The legal basis for all of this is our agreement with you (the terms): it is how the service you signed up for works. For trust and invites it is also our legitimate interest in a ranking that cannot be bought or faked.
Notifications
Members can turn on notifications for a device on their account page. Visitors without an account cannot: a notification needs an address for the device, and we keep no such thing for anyone without an account. Your browser asks for permission first, and only when you tap the button. On iPhone and iPad this works only in the app added to the Home Screen.
For each device we store the delivery address your browser's push service gave it (a web address at Google, Apple, Mozilla or Microsoft, depending on the browser), the two keys that encrypt what we send, when you turned it on and when a notification last arrived. We also store your choices: how often (at most one a day, at most one a week, or never; a day here starts at 16:00 UTC, and two notifications are always at least 20 hours apart), whether new picks count, and up to five tags you follow. No IP address and no browser details.
A notification says how many new picks and new videos in your tags there are, never which ones, and links to the stream. It is encrypted for your device, so the push service that carries it cannot read it. Notifications never change what you are shown or how anything is ranked.
A device is removed when you turn notifications off for it, when the push service says it no longer exists, and with your account; it is in your data download without its keys. Legal basis: our agreement with you (you asked for the notifications).
Checks against vote manipulation
Automatic checks compare members' votes to find patterns that suggest manipulation: accounts that keep voting the same way, groups from one invite branch voting together, or a burst of votes from new accounts. A hit only raises a flag for the owner; the checks change nothing themselves, and no decision about you is ever made by a computer alone. A flag holds account numbers and times, never an IP address. If the owner acts on it, you get a statement of reasons. Legal basis: our legitimate interest in honest votes. Flags are not part of your data download; you can ask us for them through the contact page.
Emails we send
We email sign-in links, the link that confirms a signup, notices about reports and decisions, and the manage-my-account link. They go out through our own mail service, which keeps a copy of every mail it handles so we can check what went out. It makes that copy just before sending, so a mail that then fails to go out is kept too. It deletes the text of a mail after 90 days. The address it went to, the reply address (for a contact-form message, that is yours), the subject and the time are kept with no time limit for now, and are not removed when you delete your account.
The contact form
A message you send with the contact form is passed on to us by email, with your name if you gave it and your email address, so we can answer. The nextup database does not store it. It exists as an email: in our mail service's archive (as above: the text for 90 days, even if sending failed, and your address as the reply address with no time limit for now) and in our mailbox, where we delete them at the latest 2 years after the conversation ends. Your IP address only feeds the daily scrambled code that limits how many messages one address can send. Legal basis: our legitimate interest in answering you, and for messages from authorities, a legal obligation.
How long we keep what
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your email address and handle | Signing in, notices about your account and our decisions; your handle is the name others see | Our agreement with you (Art. 6(1)(b)) | Until you delete your account (except in our mail service's records of mails we sent you; see Emails we send) |
| A signup that was never confirmed (email address, handle, invite code) | Finishing the signup when you open the emailed link | Our agreement with you (Art. 6(1)(b)) | 24 hours, then deleted |
| Which version of the terms you accepted and when, and when you confirmed you are 16 or older | Knowing which terms apply to you and showing that you accepted them | Our legitimate interest (Art. 6(1)(f)) | Until you delete your account |
| Sign-in sessions (a scrambled copy of the session code, its expiry and last use) | Keeping you signed in | Our agreement with you (Art. 6(1)(b)) | 30 days from sign-in, or until you sign out |
| Emailed links: sign-in links and manage-my-account links | Signing in, and export or deletion without signing in | Our agreement with you (Art. 6(1)(b)) | Sign-in links 15 minutes, manage links 30 minutes (the access they open lasts 15 minutes); then deleted |
| Your votes | Deciding which videos reach the main stream | Our agreement with you (Art. 6(1)(b)) | Until you delete your account; votes that already counted stay only inside an anonymous total per video |
| What you watched while signed in (the videos you have seen, and how each first play went, to the hour) | Never showing you a video twice, and counting real watching in the ranking | Our agreement with you (Art. 6(1)(b)) | 13 months, or until you delete your account if that is sooner. The list of seen videos is then simply deleted; how your plays went is deleted too, and where it already counted, only an anonymous total per video remains |
| Videos you added, your notes on them, and tags you suggested | Showing and judging what you added | Our agreement with you (Art. 6(1)(b)) | Until you delete your account; then your notes are deleted and the videos and tags stay without your name |
| Invites: who invited whom, and a scrambled copy of each code | Invite-only membership and spotting groups of fake accounts | Our legitimate interest (Art. 6(1)(f)) | Unused codes expire after 14 days. The link between inviter and invitee stays, also after deletion, pointing to an account without email or handle |
| Notifications: each device's delivery address and keys, and your choices (how often, new picks, tags you follow) | Sending the notifications you turned on | Our agreement with you (Art. 6(1)(b)) | Until you turn notifications off for that device, the push service says it no longer exists, or you delete your account |
| Your trust score and how it was computed | How much your votes count and how many invites and submissions you get | Our legitimate interest (Art. 6(1)(f)) | Recomputed every day while you are a member. Not public: only you and the owner who runs the site see it. After deletion only the last number stays, without email or handle |
| Abuse signals about your account (patterns in voting that a person must review) | Protecting the ranking against fake and coordinated votes | Our legitimate interest (Art. 6(1)(f)) | Until reviewed; then 180 days after a dismissal, or 2 years after we acted on it |
| Reports you filed and appeals, with any name and email address you gave | Handling notices and complaints as the Digital Services Act requires | A legal obligation (Art. 6(1)(c)) | 2 years after our decision (appeals: 2 years after the outcome) |
| Our decisions about your content or account | Statements of reasons and the public moderation log | A legal obligation (Art. 6(1)(c)) and our legitimate interest (art. 6(1)(f)) | The public entry stays, without your handle. The facts we noted for a decision that followed a report are deleted 2 years after it. The facts and scope we noted for a decision that did not follow a report stay with the decision, without your name or handle. Any trust change the owner made by hand is noted the same way |
| Play reports from your browser (no account, no device id, no IP address) | Measuring how well each video does | Our legitimate interest (Art. 6(1)(f)) | 90 days, then only totals per video |
Who else handles data
- Hosting: Hostinger, for hosting and email: Hostinger International Ltd (Larnaca, Cyprus, EU), part of the Hostinger group based in Vilnius, Lithuania
- Sending our emails: Hostinger (see above): our mail service sends through a mailbox there
- Cloudflare, Inc. (United States), for Turnstile on the signup page and, if switched on, the contact form. Cloudflare is certified under the EU-U.S. Data Privacy Framework.
They process data only on our instructions. YouTube and Vimeo are not on this list: they decide for themselves what they do with the data their players collect.
Your rights
You can ask us what we hold about you, and ask us to correct or delete it, to limit how we use it, or object to how we use it. For visitors we hold almost nothing that points to you, because we store no identifiers. Write to us via the contact page.
Members can do the most important things themselves, on their account page:
- Download your data as one file: your account, sessions, votes, what you watched, videos and notes you added, tags, invites, the terms you accepted, reports you filed, and our decisions about your account.
- Change your handle (once every 30 days).
- Delete your account.It happens at once. Your email address and handle are erased, you are signed out everywhere, your notes are deleted, and so is the list of videos you have seen. Your votes and how your plays went are deleted too; those that already counted in the ranking stay only inside anonymous totals per video. Reports you filed lose your name and email address, and any appeal you made from this account's address loses that address.
If you cannot sign in, the manage-my-account page emails you a link that lets you download or delete without signing in.
What deleting cannot erase. The account itself stays as a record without email address or handle, so the videos and invites it was part of still make sense. That record keeps only its role, its join date, the date it was last changed (the day it was deleted), its place in the invite tree and the last trust number we stored for it. Deleting also cannot reach our mail service's records of the mails we sent you: your address stays in them, as described under Emails we send. Videos you added stay, shown as added by a former member. Deleting cannot find text that mentions you in someone else's words, or in your own free text inside a report or an appeal; that text goes when the report or appeal is deleted (2 years after the decision), or sooner if you ask us. Entries on the public moderation log stay, without your handle. Our internal notes on decisions about your account, including any trust change made by hand, stay without your name. If you want any of this gone earlier, write to us and we will look at it.
You can also complain to the Autoriteit Persoonsgegevens (opens in a new tab), the Dutch data protection authority.