Privacy Policy | WTF Should I Watch?

1. Information We Collect

Account information. If you sign in with Apple or Google, we receive a provider identifier and the account details you choose to share, which may include your name, email address, private relay address, and profile photo. If you create an account with email and password, we receive your email address and the name you provide. Guest mode uses a random guest identifier and does not require your name or email address.
Content you provide. We collect the saved titles, custom lists, watch history, ratings, taste preferences, feedback, streaming-service choices, and shared collections you create or submit. What you type when you search is used to find recommendations, as described in section 2, and is not saved to your account.
Information collected automatically. We log basic usage data such as IP address, device type, browser, pages viewed, and interactions. On the website, our hosting provider counts page views and measures page speed without cookies. If you turn analytics on, which only the website offers, we also use Google Analytics to collect usage and performance data, including what you search for and the filters you choose. The mobile app has no analytics.
Device storage. We keep app settings, consent choices, account cache, and guest libraries on your device. A signed-in library may also be synced to our cloud database.
App Check. We use Firebase App Check to protect our API from abuse. On the website it works through reCAPTCHA Enterprise. In the mobile app it works through Apple's App Attest on iPhone and Google's Play Integrity on Android. These checks may collect device and browser information as described in Google's and Apple's documentation.
Reports. If you report a pick in the mobile app, we store the title, what was written about it, and the reason you chose. A report is not linked to you or your account.

2. How We Use Information

Provide, operate, and improve the Service.
Generate and deliver recommendations you request.
Store and sync your watchlist and preferences.
Maintain security, prevent abuse, and debug issues.
Measure website performance and usage. Detailed usage analytics run only if you opt in.

How recommendations are made. Recommendations are generated with AI. When you search, we send Google's Gemini model what you asked for, the filters you chose, and your country. To fit the picks to your taste, we also send the titles you have saved, watched, liked, or passed on and the genres you prefer or avoid. We do not send the model your name, email address, or account identifier. The mobile app asks for your agreement before your first search.

3. How We Share Information

We do not sell your personal information.

Service providers. We use third-party providers to run the Service, including Google Firebase (Auth, Firestore, App Check), Google Gemini (AI recommendations), Google Analytics (on the website, only if you opt in), and Vercel (hosting, page-view counts, and page-speed measurement).
Third-party content sources. We use The Movie Database (TMDB) for title information and poster art, and JustWatch for where-to-watch information. Posters load from TMDB, or from picsum.photos when a title has no poster. Trailers play from or open YouTube, and where-to-watch links open JustWatch or the streaming service. When your device loads their content or opens their links, these services receive your IP address and device or browser details, as any website does.
Legal obligations. We may disclose information if required to comply with law or valid legal process.
Business transfers. If we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction.

4. Affiliate Links and Sponsored Content

We may display sponsored placements and affiliate links to products. If you click an affiliate link, Amazon or other partners may receive information such as the referring page, device data, and browser details, and may use cookies or similar technologies to track purchases. We do not receive your payment information; transactions are handled directly by the retailer.

5. Data Retention

We retain account information and account content until you remove it, delete your account, or ask us to delete it. Device data remains until you reset it, clear the app's storage, or remove the app. Analytics data is retained according to our analytics settings and provider policies.

We do not keep what you search for once your recommendations are returned, unless you have turned analytics on as described in section 1. Our server keeps the recommendations themselves for a short time so a repeated search is answered faster. Google may keep what its model is sent for a limited time to detect abuse, under its own terms. Reports of picks contain no account information and are kept until we no longer need them.

When account deletion begins, we use a minimal security tombstone containing the account identifier, deletion status, and timestamps to block stale devices from restoring deleted data and to safely finish a retry. Once deletion completes, that tombstone is scheduled to expire after 48 hours; automated removal may take up to one additional day. If deletion is interrupted, the marker remains until automated repair can safely finish the request, then follows the same expiry schedule. Separate rate-limit security records associated with a network or request identifier may remain for up to five days to prevent abuse. Provider logs and backups may be retained for the limited periods required by those providers or by law.

6. Your Choices and Rights

Analytics control. On the website, you can turn detailed usage analytics on or off in the site footer. Page-view counts and page-speed measurement, which use no cookies, run for every visit. The mobile app has no analytics.
Access and deletion. You may delete a signed-in account from Account > Privacy & security in the app or on the website, or use our account deletion page if you cannot sign in. We may ask you to verify that you own the account before acting on an email request.
What deletion removes. Account deletion removes your Firebase sign-in record and app profile; lists and saved titles; watch, dismissal, and feedback history; taste and streaming preferences; push tokens; legacy watchlists; shared collections you created; and this device's cache for that account. It does not delete your separate Apple or Google account.
Guest data. Guests do not have an Apple-, Google-, or email-backed account. A guest's library and settings are kept only on that device: clear the app's storage or remove the app if you want to erase them.

7. International Transfers

We may process and store information in the United States and other countries where our providers operate. By using the Service, you consent to these transfers.

8. Security

We use reasonable safeguards to protect your information, including encryption in transit and access controls. No system is 100 percent secure, so we cannot guarantee absolute security.

9. Children's Privacy

The Service is not intended for children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us at wtfsiw@aimixtapes.com and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, if changes are material, provide a prominent notice.

11. Contact

For questions or requests regarding this Privacy Policy, contact us at wtfsiw@aimixtapes.com.