What we keep, and what we don't

• Your account: username, a hashed password (we can't read it), display name, region, theme and budget settings. Email is optional and only shown to your admin — nothing is ever sent to it.
• Your lists and what's on them, including lists you share with others.
• Your ratings, rankings and watch history — what you marked watched and when.
• Your subscriptions — which streaming services you say you pay for, and their prices. We never see or store payment details.
• The household's Plex link, if an admin connects one: a Plex access token and a list of what's in the libraries, so everyone can see what's already on your own server. Disconnecting removes the token.
• Your sign-in sessions — one row per signed-in device, so you can be signed out.

• No email, ever. There is no mail provider in the app, so no newsletters, no password-reset mail.
• No ads, no ad trackers, no analytics scripts.
• No selling or renting your data, and no sharing it beyond the services listed below.

The app looks titles up with these services. They see the request, not who you are:

• TMDB (The Movie Database) — titles, cast, artwork. Poster and photo images load straight from TMDB's image servers into your browser, so TMDB sees your IP address for those requests.
• JustWatch — where-to-watch data. We get it through TMDB; your browser never contacts JustWatch.
• OMDb — IMDb, Rotten Tomatoes and Metacritic scores. Our server calls it, not your browser.
• Plex — only if your admin connects it. Connecting signs them in at plex.tv, and our server then reads the household's libraries with the token Plex gives us.

Members of your household can see things you share with them — shared lists, and in some places what others in the household have watched or ranked. Household admins can see the account roster and reset passwords.

One cookie: ib-session, which keeps you signed in. It's httpOnly (page scripts can't read it), lasts 30 days from your last visit, and is deleted when you log out. We store only a scrambled copy of it. Your browser also remembers your light/dark choice locally; that never leaves your device.

Everything is kept for as long as your account exists. The database is backed up every night, and each backup is kept for 14 days before it's deleted. Only the operator holds backups.

Looked-up title details are cached for about a day and then refreshed; that cache holds nothing about you.

Download your data any time from Settings › Account: one JSON file with your lists and what's on them, your ratings, watch history, rankings, subscriptions and friends. It never contains your password, your sign-in sessions, or anyone else's ratings or history.

Delete your account from the same place. You'll be asked for your password, and shown what goes before anything happens:

• Lists other people are on stay, with everything on them: you choose who takes each one over (by default, whoever has been on it longest). Your own rankings on them are removed.
• Everything else of yours is deleted: lists only you are on, your ratings, watch history, rankings, subscriptions, friends, invitations, Plex link and sessions.
• If you're a household's last admin, you choose who takes over first. If you're its only member, the household is deleted with you.

Deleting can't be undone. A household admin can also delete a member's account the same way (lists other people are on still pass on). After deletion your data survives only in backups, which age out within 14 days.

Ask your household admin, or the person who invited you. See also the terms and credits.