You cannot make a film impossible to copy. You can make copying it attributable and inconvenient, which is what deters it. In order of effect: never hand over a file, because a download is a permanent copy; serve the film through signed links that expire mid-play; cap how much one ticket can be watched in total; limit how many screens play at once; and put the viewer’s access code on the picture, so a leak points back at a ticket.
On watchmycreation a ticket carries 12 hours from first play, 1 completed playthrough, and a watching allowance: at most 5 times the runtime of actual playback, or 15 minutes on a film too short for that to be enough. Screen recording cannot be fully prevented — by anyone.
None of these is a guarantee, and all of them are worth having. They are in the order they actually matter, not the order platforms usually advertise them in.
This one counts for more than everything below it put together. If what you send is a file — an MP4 attached to an email, a transfer service, a link to a document store — then the moment it arrives a permanent copy exists on a machine you have no say over. Nothing you do afterwards reaches it. You cannot expire it, you cannot count it, and you cannot tell whose copy it was.
A film served over HLS is not a file. The browser fetches a manifest and then a few seconds of video at a time, each segment authorised separately. On watchmycreation the video sits in our storage with the download rendition switched off, so there is no single URL that resolves to the whole film, and no permanent address for it either: the video is stored so that it plays only against a signed link we issue, which makes its identifier worth nothing on its own. Reassembling segments into a playable copy is possible — that is not a secret — but it is work, and work is the whole mechanism here.
The leak that actually happens is rarely sophisticated. It is a screener sent to a festival, a cut left in a shared folder, a collaborator’s laptop. Keep the list of people holding the master short, know who has which cut, and get the paperwork straight before the film is anywhere public — there is a checklist for that. Nothing below this line reaches a file you handed over last year.
Every playback URL we issue is signed and short-lived. It stops working minutes after it is minted, mid-film, and the player fetches a replacement and swaps it in — which, on our player, costs a moment of re-buffering each time. The practical effect is that a URL lifted out of a browser’s network inspector and pasted into a chat works for whoever opens it in those few minutes, and then stops for good. It is a window measured in minutes, not a permanent address.
Compare that with the usual shape of a “private” link: a permanent address with an unguessable path. Unguessable is not private, and forwarded once it works for everyone, indefinitely. This is the difference between a screener that stops working on its own and one you can only regret.
Every ticket may be watched for about 5 times the film’s runtime in total — a little more than that on a very short film, where the allowance is floored so the shortest pieces are not squeezed. Only time spent watching counts: the player reports how far the film has got, and we credit how far it moved, never faster than the clock. Pausing, closing the tab, reopening the link and switching devices cost nothing. When the allowance is used up, the ticket is issued no more links. That is what stops a link being replayed indefinitely by however many people it reaches.
The margin above the runtime is there so an ordinary viewer — one who reloads, or whose connection drops — has room to spare, and a ticket that does run out can be reset by support. Behind it sits a second limit, on how long a ticket can hold working links at all, checked in the database before each link is signed. Our player never gets near it; it is there for a player that misreports its progress.
Be precise about what these count: playback as the player reports it, and how long a ticket holds a working link — not how much video travels over it. While a link is live, nothing limits how quickly it is used — a modified player can pull video faster than it plays — and a link copied out of one browser works in another until it expires. For an ordinary viewer on our player, what gets streamed stays within roughly that allowance, because the player only fetches a little ahead of what is on screen. It limits what a ticket can cost; it does not cap it, and it is not a punishment. If your film lives elsewhere, the question to ask is what stops one link being watched over and over by everyone it reaches. Usually nothing does, which leaves a link you can kill as the only lever you hold.
However many people hold the link, a ticket plays on 1 screen at a time. The rest are told the film is already playing elsewhere, and on what kind of device — usually enough for an honest viewer to work out what happened. The check happens when a link is issued, so a link already copied out of a playing browser still works elsewhere for the few minutes it has left.
Be clear-eyed about this layer: it is a read-modify-write on a distributed cache, so simultaneous first attempts can occasionally both succeed for a moment. It deters a link doing the rounds of a group chat; it is not a hard boundary. The harder limits are the link’s expiry, enforced where the video is served, and the limits on each ticket, enforced in our database. Wherever you host, what to look for is whether each viewer gets their own link instead of everyone sharing one — that is what lets you cut off a person without cutting off the screening.
The player draws the ticket’s access code and a masked version of the contact it was sold to over the video, faintly, for as long as it runs. This prevents nothing. What it does is make a leak attributable: a recording that circulates carries the identifier of the ticket it came from, and whoever made it knew that while they were making it. That knowledge is most of the deterrent.
And note what it is not. It is drawn by the player in the browser, not burned into the file at encode, so someone determined can crop it or cover it. It survives a casual screen recording, which is the case that actually happens.
Access lasts 12 hours and the clock starts at first play, not at purchase — nobody loses a film they bought at midnight and meant to watch at the weekend. The ticket is spent by 1 completed playthrough; closing the tab, losing the connection or stopping halfway does not spend it, and the same link reopens the unfinished watch close to where it stopped. That is a starting point the platform picks from where the player last reported, not a seek control — the viewer still has none — and each return draws on the same delivery budget.
The link itself is bearer authority: whoever holds it can watch. That was chosen deliberately over locking a ticket to a device, because device locking punishes the viewer who changes phones more often than it catches anyone. What makes it safe is that every cap above is per ticket, not per person.
Screen recording. Not by us, not by anyone, and any platform that tells you otherwise is selling you something. A camera pointed at a monitor defeats every technical measure ever built, and always will. The question was never how to make copying impossible. It is how to make it attributable, inconvenient and slow enough that almost nobody bothers — and how quickly you can act on the copy that does appear.
Hardware DRM raises the cost of capture on some devices, and some operating systems refuse to record a protected surface. It also does nothing about the camera, and it adds failure modes on exactly the older, cheaper handsets a first audience is watching on. We took the view that a film that will not play is a worse outcome for a filmmaker than one that was recorded. That is a judgement about who our viewers are, not a law of nature; a distributor with a studio title behind it would rightly decide the other way.
The comparison that matters is about shape, not price: what does the other person end up holding, and can you take it back?
| How you share it | What they end up with | Can you revoke it |
|---|---|---|
| File by email or transfer service | The film, permanently | No |
| Cloud storage link | A file, usually downloadable, always forwardable | Only by unsharing — after any copies have been taken |
| Unlisted video on a public platform | A permanent URL anyone it reaches can open | Only by taking the video down for everyone |
| Password-protected page | A permanent URL and a password, forwardable in one message | By changing the password, for everyone at once |
| Ticketed stream (this) | A timed, budgeted, attributable session | Ask us to refund that ticket, which ends its access — or unpublish, which ends every ticket at once |
The honest reading is that the first two are what most independent filmmakers use, and neither is a protection of any kind. If your film has done a festival circuit, the screener you emailed is already the version in circulation. That is not a reason to panic; it is a reason to stop sending files.
Our own row has a catch worth stating plainly: ending one viewer’s access means refunding them, so it costs you the sale. And a ticket protects revenue you have, not revenue you hope for — if nobody would have paid for this film, the free options cost you nothing and this costs a listing fee. Put it somewhere public, keep the audience, and come back when there is something to sell. None of the protections on this page is an upgrade you pay extra for; they are how a ticket works here, which is why the pricing page has no security tier on it.
The trailer is the exception, and it should be. It lives on YouTube or Vimeo, it is public, and being copied is its job — it is the part you want travelling. Only the film itself is ticketed.
Move quickly and keep it unglamorous. A takedown is an evidentiary process, and the evidence has a habit of disappearing while you decide how you feel about it.
We keep a complaint register rather than an inbox: when a complaint arrived, when we acknowledged it and how it was disposed of, with a reference you can quote. Where it warrants it, the film comes off sale while we look into it. The deadlines are on the grievance page, and they are the outer limits the IT Rules 2021 set rather than targets.
What we cannot do is decide who owns a film when two people both say they do. We do not own the films we sell — filmmakers license them to us and are responsible for the rights in them — and that dispute belongs to a court, whose order we will comply with. Infringement is dealt with by the Copyright Act, 1957, and wilful infringement can be a criminal offence under section 63 of it. Indian courts will injunct infringing sites, and a dynamic injunction — which the Delhi High Court has extended to the mirrors that appear afterwards, without a fresh suit each time — is the device that keeps up with them. But that is a road with a lawyer on it. For most independent films the proportionate answer is the notice, not the suit.
Do not send a file. Serve the film instead, through links that expire, with a budget on the ticket and the viewer’s own code on the picture. Then accept that a recording is always possible, and make sure that when one appears you can say which ticket it came from and get it taken down. That is the whole of what anyone can honestly offer; a platform promising more is describing something it does not have.
Published by Sajai Digital, which operates watchmycreation. We describe how our own platform works and what Indian law requires of it; this is not legal, tax or financial advice, and rates and rules change. Check anything that matters with a professional. Something wrong on this page? Write to support@watchmycreation.com and we will fix it.