Privacy Policy

Account data. Your email address and name — either from the sign-in provider you choose (Google, GitHub or Apple, including an optional profile photo URL) or entered directly when you register with email and password. If you use Sign in with Apple and choose to hide your address, we only ever receive Apple's private relay address. Passwords are stored only as bcrypt hashes, never in plain text.

Your content. The watch history, ratings, notes, watchlist, collections, reactions, comments and friend connections you create in the app. This is the product — it's stored so the app can show it back to you.

Technical data. Session cookies (web) or an authentication token (mobile) to keep you signed in. Rate-limit counters keyed to your account or IP address, to stop abuse. Error reports when something breaks on our servers or the website (the failing request and error message, without query strings or your IP address). On the website, cookieless, aggregated page-view and performance statistics. We run no advertising and no cross-site tracking.

Safety reports. If you report a comment or a user, we store your report (who reported whom, the reason, your note and the reported comment) so we can review it. If you block someone, we store that block.

Push notifications. If you allow notifications in the mobile app, we store your device's push token (an address Apple or Google issues so we can reach that device), whether it is an iPhone or Android device, and when the app last checked in. We also store your notification settings.

Payments. If you choose to buy us a coffee on the website, Stripe processes the payment. We never see your card details; we receive the amount and the email address you enter at checkout. Tips are voluntary — nothing is sold — and we refund a tip in full if you ask within 14 days.

To operate MovieRadar: sync your library across devices and show friends' shared shelves to accepted friends only.

AI features (recommendations, hidden gems, mood picks, chat) are optional and only work after you turn them on, confirm you are 18 or older, and agree to the data being sent to Google Gemini (we record when you agreed). What is sent: titles from your library with their genres, languages and ratings, and — in chat — the messages you type and the earlier messages of that conversation. Never your name or email. We use Google's paid Gemini API, under which Google does not use this data to improve its products. You can turn AI features off at any time (app: Settings → AI features; website: profile menu → AI features), and nothing more is sent from then on. To avoid repeating itself, the app remembers which titles it recently suggested to you for 21 days.

The try-it demo on our website and in the app (no account) sends only the titles you pick, after you confirm you are 18 or older.

Notifications are only sent after you allow them on your device, and only about your friends' activity: comments on your titles, replies in threads you commented in, friend requests, and — only if you turn it on — a daily summary of what friends watched. A notification shows a friend's first name, the title, and up to the first 80 characters of a comment. It is delivered through Apple (iPhone) or Google (Android), so they receive that text, the device token, and internal IDs for the title and your account — never your email. We never send marketing notifications. You can choose which notifications you get in the app under Settings → Notifications, or turn them off entirely in your device settings. Nobody you have blocked, or who has blocked you, triggers a notification to you.

We do not sell personal data. We do not use it for advertising.

• Vercel — hosting, plus cookieless Web Analytics and Speed Insights on the website
• Neon — managed PostgreSQL database (Frankfurt, EU)
• Upstash — rate-limit counters and the 21-day memory of recently suggested titles
• Cloudflare R2 (EU) — off-site database backups
• Google Gemini API (paid tier) — AI features, only after you turn them on (see above; no account identity)
• TMDB — title metadata lookups (search queries only, no account identity)
• Rollbar — error reports from our servers and website
• Apple Push Notification service — delivers notifications to iPhones, only if you allow them
• Google Firebase Cloud Messaging — delivers notifications to Android devices, only if you allow them
• Stripe — payments for optional tips on the website
• Gmail SMTP — transactional email (password resets, and reports to our moderation inbox)

Your data is kept while your account exists. You can delete your account yourself at any time — in the mobile app under Settings → Delete account, or on the web under Import / Export → Delete your account. Deletion is immediate and permanent: it removes your watch history, ratings, notes, collections, friend connections and chat history. You can export your data first from Import / Export.

Recently-suggested titles are forgotten after 21 days, and rate-limit counters (including the daily notification limit) after at most a day. A device's push token is deleted when you sign out on that device or delete your account; tokens that Apple or Google report as no longer valid, or that a device hasn't refreshed for 180 days (for example because the app was removed), are deleted within 30 days. Error reports are deleted automatically under our error-tracking provider's retention period. Safety reports are kept while needed to handle them and to prevent repeated abuse. Database backups, kept for disaster recovery, are deleted after at most 90 days.

If you would rather we did it for you, the contact form works too — write from your account's email address.

You have the right to access, rectify, export and erase your personal data, to restrict or object to processing, and to lodge a complaint with a supervisory authority (in Brandenburg: LDA Brandenburg). One email is enough to exercise any of them.

If this policy changes materially, the effective date above changes with it and we tell account holders about significant updates by email.