What is stored, and what is not

The short version: this site stores what it needs to work, keeps nothing else, and sells nothing to anyone. No advertising, no analytics, no third-party trackers.

What is stored

• Your email address — it is your login.
• A hashed password. The password itself is never stored. It is scrambled with scrypt, and the original cannot be recovered from what is kept, including by the person running this site.
• Your display name, and a profile picture or banner if you upload one.
• Your list: what you have watched, your progress, scores, moods and private notes.
• Your mood votes — the one-tap answers to "how did this feel?". These are shown in aggregate to everyone.
• Anything you post publicly, such as a review or a comment.
• Server logs, which may include IP addresses, kept by the hosting provider for security and troubleshooting.

What is not done with it

• No advertising, and no ad networks.
• No analytics or tracking scripts of any kind.
• No selling, renting or sharing your data with anyone.
• No profiling, and no feeding it to third-party AI services.
• No email beyond what you ask for — there is no newsletter.

Cookies

One cookie, and it is strictly necessary: a session cookie that remembers you are logged in. It is httpOnly (not readable by scripts) and SameSite=Lax (not sent on cross-site requests). There are no advertising or analytics cookies, so there is no cookie banner, because there is nothing to consent to.

Your control over it

• Edit anything — your profile, your list, your moods and notes — at any time.
• Delete your reviews and comments yourself.
• Delete your account and everything in it by asking. It is removed, not hidden.

Where it lives

The database runs on a single self-hosted server. It is not spread across third-party services, and no one else has access to it.

Children

This site is not intended for children under 13, and accounts for them are not knowingly created.

Contact

Questions about any of this, or a request to delete your data: send a direct message to @ughdrag on Twitter.

This describes what the software actually does, written to be readable. It is not legal advice, and a site that collects personal data in the open may have obligations under laws such as India's Digital Personal Data Protection Act or the GDPR. See DEPLOY.md.