Privacy
What we keep, why, and how you can see or delete it.
Last updated: August 2026
What we store
Your email, display name and password (hashed, and not reversible). Also your activity on the site: comments, ratings, watchlist and watch history.
We do not store your IP address
To prevent abuse we keep only a cryptographic fingerprint of your address, never the address itself. The fingerprint cannot be turned back into an address, not even by us.
Encryption
Passwords are hashed with bcrypt and can never be recovered. Two-factor (2FA) seeds are stored encrypted with AES-256-GCM.
Cookies
We set exactly two, both strictly necessary: one remembers your language, one keeps you signed in. There are no advertising or third-party tracking cookies.
How long we keep things
Expired sessions and device codes are removed immediately. Administrative change logs are kept for 180 days and notifications for 90 days.
Getting a copy of your data
You can download everything we hold about you as a JSON file from your account settings.
Deleting your account
Deleting your account erases your email, name, picture and personal details, and signs you out everywhere. Your comments stay, anonymised, so other people's conversation threads are not destroyed. The account record is removed entirely after 30 days.
Contact
For any question about your personal data, use the contact page.