Who is responsible
Watchlist is run by Ivan Petrović, based in Ireland, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and Ireland's Data Protection Act 2018. For any privacy question or request, email xnaaviitech@gmail.com.
If you use Watchlist without an account
- Your watchlist stays on your device. Titles you save are kept in your browser's local storage and never sent to us until you create an account or sign in.
- Offline copies. The app saves pages, posters and data you have viewed in your browser so it works offline. They stay on your device.
- AI picks. When you ask for picks, the text you type is sent to our server and to Cloudflare Workers AI to choose titles. We don't store it. To share the free AI allowance fairly, your IP address is used as a short-lived rate-limit key.
- Server logs. Like any website, our host (Cloudflare) receives your IP address, browser details and the pages you request, and keeps short-lived logs to run and secure the service.
If you create an account
- Account details: your name and email address. If you sign up with email, a securely hashed password (we can't read it).
- Google sign-in: if you choose it, Google shares your name, email address, profile picture and Google account ID with us, plus sign-in tokens. We don't get access to anything else in your Google account.
- Sessions: for each device you sign in on, when it started and expires, its IP address and browser (user agent), so you stay signed in and we can spot misuse.
- Your activity: the movies and shows on your watchlist, whether you've watched them and when, plus any Dolby Atmos votes and sound ratings you give. Other people only see votes and ratings as anonymous totals and averages, never linked to you.
- Emails: we send account emails only (verifying your address and resetting your password). No newsletters or marketing.
Why we use it, and our legal basis
- To provide the service you asked for (GDPR Article 6(1)(b), contract): your account, sign-in, watchlist, stats and ratings.
- To keep it secure and working (Article 6(1)(f), legitimate interests): sessions, logs, rate limits and preventing abuse.
- With your consent (Article 6(1)(a)): trailers only load from YouTube after you press play. You can choose not to.
We never sell your data, use it for advertising or build profiles about you. Watchlist makes no automated decisions that affect you legally.
Services that process data for us
These providers handle data on our behalf, or receive it directly when your browser loads their content:
| Service | What for | Data involved |
|---|---|---|
| Cloudflare | Hosting, caching, logs, rate limits and Workers AI picks | IP address, request details, AI picks text |
| Neon | The database for accounts and watchlists | Everything listed under 'If you create an account' |
| Sign in with Google, and your profile picture | Your Google profile, IP address when the picture loads | |
| Resend | Sending verification and password emails | Name, email address |
| TMDB | Posters and images, loaded by your browser | IP address and browser details |
| YouTube (Google) | Trailers, in privacy-enhanced mode, only after you press play | IP address, and YouTube may store data on your device |
Movie details, ratings and streaming availability also come from TMDB, OMDb and Watchmode, but our server fetches those. No personal data is sent to them.
International transfers
Some of these providers are based in, or process data in, the United States. Where data leaves the European Economic Area, it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account and activity: until you delete your account.
- Sessions: until you sign out or they expire, at most 7 days after your last visit.
- Email verification and reset links: 24 hours or less.
- Host logs: a few days, under Cloudflare's retention.
- Data on your device: until you clear it, or after sign-in for the guest watchlist, which moves to your account.
Deleting your account removes your account, sign-in methods, sessions, watchlist, votes and ratings straight away. Copies in our providers' backups expire on their normal schedule.
Your rights
Under the GDPR you can:
- Access and take your data: use Download my data on your profile for a copy in JSON.
- Delete it: use Delete account on your profile.
- Correct it, restrict it or object to how it's used: email xnaaviitech@gmail.com.
- Withdraw consent at any time, for example by not playing trailers and clearing YouTube's data from your browser.
- Complain to the Irish Data Protection Commission, our lead supervisory authority, or to the authority where you live or work. We'd appreciate the chance to fix things first.
We answer requests within one month.
Children
Watchlist isn't meant for children under 16, and we don't knowingly collect their data. If you believe a child has made an account, email xnaaviitech@gmail.com and we'll delete it.
Security
All traffic is encrypted with HTTPS, passwords are hashed, and sign-in cookies are HTTP-only and secure. No system is perfectly secure, and we'll tell you and the authorities if a breach puts your data at risk.
Changes
If this policy changes, we'll update the date at the top. For important changes, we'll let account holders know by email or in the app.
See also the cookies and storage page and the terms of use.