How your videos are protected

Nothing about a video leaves the server without a check, whether it's the stream, a single segment or the key to decrypt it. The check asks who wants it and whether they may watch: the video is on their shelf, it's public, or they came through a temporary link or a guest trade that is still open to them. It runs on every request, not only at sign-in. Video IDs are long random strings that can't be guessed or listed.

Videos play over HLS in short encrypted segments (AES-128). The key goes only to a viewer who has just passed that check, and it's never written to disk. A leaked link to a segment is useless on its own.

The player never gets a link to the video file. Downloading is a separate step, open only to these people:

• someone signed in who may watch the video: its author, anyone who has it on their shelf and, if it's public, anyone signed in;
• anyone with a temporary link, while it works;
• a guest who received the video in a trade, for a week afterwards.

Each download link is handed out after the same check and expires within two minutes.

Anyone who gets hold of a temporary link can watch and download its videos until it runs out, so pass it on the way you'd hand over a key. To narrow it down, tick “Only for one person”. The link then opens only with a one-time code sent to that person's email, or for someone signed in with that address. On Pro you can add a password, and if both are set, both are needed. Revoke a link in “My links” and it stops opening at once. Videos people already added to their shelves or downloaded stay with them.

A video file often carries more than the picture: where and when it was shot, the camera or phone, the author's name, comments. When you upload a video, we remove all of that from the file. People download the cleaned file, and the stream and the preview frames carry none of it either. Videos uploaded before 18 October 2026 were left as they were.

Shelves and video pages are closed to search engines. People reach your shelf through a link you gave them or through public friend lists, never through search.

On Pro you can hide your whole page in Settings → My page. Your profile, shelf and friend lists then open only for you and the moderators, and everyone else gets “page not found”. That goes for your public videos too, except for people who already have them on their shelf. In other people's friend lists, only the list's owner still sees you. Videos you already shared or traded stay with the people who have them. When Pro ends, the page becomes visible again.

Passwords are stored as argon2id hashes. Sessions live in HttpOnly cookies; Settings → Security lists every active session, and you can sign them all out at once. You can also sign in with Google. Sign-in attempts are rate-limited, and a second sign-up from the same IP address within a day has to pass a captcha first. So does a guest before their first upload in a trade.

Turn it on in Settings → Security, and after the password you'll confirm it's you with a code from an authenticator app (Google Authenticator, 1Password, Aegis and the like) or with a passkey: Face ID, Touch ID, Windows Hello or a security key. A stolen password alone then won't open your account. Turning it on signs out your other devices.

You also get ten recovery codes for when the phone or key isn't at hand, and each one works once. We email you when two-step sign-in is turned on or off and whenever a recovery code is used. Resetting your password by email doesn't turn it off. Signing in with a Google account that's already linked to yours doesn't ask for the second step; there we rely on Google's own sign-in. If you lose both the phone and the codes, write to contact@tapeshelf.com. We check that the account is yours and then reset the second step.

Every video and profile has “Report” in its menu. Reports go to a moderator, who can remove content and ban accounts, and you're told how your report was resolved. Questions and bugs go to Support in the account menu.

• No DRM. Someone who is allowed to watch a video can capture the stream if they try hard enough, as on any video site. What tapeshelf keeps out is everyone else.
• The 16-frame preview of a private video is visible to anyone who can see the shelf. That's on purpose: it's how people know what they're asking for.
• Shared copies are permanent. When you share or trade a video, the other person keeps their copy. The only way to withdraw it is to delete the video, which removes it from every shelf. A file someone already downloaded stays with them.

The videos, the database and the service itself all live in Germany, in the European Union. All traffic is encrypted in transit, and the database is backed up every day. Pro is paid through Paddle, our reseller: card details go to them and never reach our servers.