Your data, your call.

01Who we are

Cinemere is a film and television tracking and social platform. This page explains, in plain language, what personal data Cinemere handles, why, on what legal basis, and the rights you have over it. It is written to meet the transparency duties of the EU General Data Protection Regulation (GDPR), which binds us for everything we do because we are established in the EU, wherever you happen to live. If you are in the United Kingdom or Switzerland, we give you the same rights on the same terms. The California Consumer Privacy Act (CCPA), as amended by the CPRA, and the other United States state privacy laws do not apply to us, because we are below every one of their thresholds. We give you their rights anyway, wherever in the United States you live. Section 07 lists those rights one by one, says how to use each of them and how fast we answer, and keeps apart what the law makes us do and what we do by choice.

Cinemere runs in two modes. As a local copy without a server it is a pure client-side application: no server stores member data. On cinemere.com your account and activity are stored in a database on Cinemere's own server in Nürnberg, Germany (EU), so that you can sign in from any device.

The data controller is:

Cinemere AB
—
—, Sweden
Company number —
Privacy contact: privacy@cinemere.com

We have not appointed a Data Protection Officer. We assessed whether one is required under Article 37 and concluded it is not: we are not a public authority, our core activity is not large-scale systematic monitoring, and we process no special-category data on a large scale. The privacy address above reaches a person who can answer, and you can ask us for that assessment. It is written down, and we review it every year and whenever something it rests on changes, such as how many members we have or how advertising works here.

Your supervisory authority for data protection in Sweden is Integritetsskyddsmyndigheten (IMY). For questions about how we moderate content, the authority is Post- och telestyrelsen (PTS). Section 06 explains how to reach both, and section 11 covers our duties under the Digital Services Act.

02What we collect, and why

Cinemere only holds data you create by using it. We do not ask for your real name, your phone number, your precise location, or any special-category data. We do ask which country you are in, because streaming rights and cinema listings are national and we cannot answer "where can I watch this" without it. We never read your location from your IP address or your device's positioning: we suggest a country from your browser's time zone, you confirm or change it, and you can leave it unset. The table in Your data & rights above is generated live from your own browser and is the authoritative list. In summary:

• Account & profile — your handle, display name, bio, accent colour, chosen avatar/cover (catalogue artwork only), taste tags and connected streaming services.
• Account email — collected at sign-up and used only to write to you about your own account: your welcome brief (with an address-confirmation link), password recovery, notice of a change to the terms, a receipt and a yearly reminder if you buy a plan, a moderation decision about you, our answers to a report you made when they go by email (section 08 of the Terms), and, only if you opt in, the Cinemere Dispatch newsletter. Your email is private: it is never displayed on your profile and never served to other members. Outside Cinemere, only the service that delivers our email and, if you buy a plan, the one that takes your payment ever receive it (section 03). Every Dispatch issue carries a one-click unsubscribe that needs no login; you can also flip it off in Settings → Account.
• Your activity — diary entries (reviews, watched dates, and any tags you add to a log, which only you can see: they are never served to another member or to a visitor), your ratings (one per title, with the date you first gave it and the date you last changed it), titles you have marked as watched without a date, watchlist, episode progress (and whether you are watching, have paused or have dropped each series, which is stored and shown like episode progress), ratings of seasons and episodes (stars only, with the date you first gave each one and the date you last changed it; they are shown like your other ratings, and they are not part of your rating of the series or of your Taste DNA), lists, posts, takes, poll votes, stories, follows and favourites. New-episode notifications: we use the series you follow (an episode you have ticked, or a series on your watchlist, and not one you have paused or dropped) to tell you when a new episode is out, at most once a day for each series and never with the episode’s name. It reaches your phone only where you have allowed push notifications. You can turn it off for every series (Settings, Notifications) or for one series on its page; the series you turned it off for are kept as a list that only you can see. The first-run tour: we keep the date you answered “Take a 30-second tour?” so you are asked only once. Only you can see it, and “Show the tour again” clears it.
• A fuller summary of your taste — from your own ratings, logs, likes and rewatches we calculate a score for each genre you have watched, including the ones you did not like, and keep it on our servers to tune features such as the Oracle’s match. It is never shown in the app, to you or to other members. The same summary notes which actors, directors and writers appear in the films and series you rated highly, worked out on our servers from public catalogue credits; it is never shown to other members, and the app shows it only as the reason for a single suggestion (for example “Because you rated 3 films with an actor highly”), never as a list. When you and a friend both accept a Taste Fusion, our servers also read both members’ summaries to rank the suggestions for the two of you; the friend sees only the titles, a one-line reason that names no person and no rating, and a harmony counted from the titles you both rated, and never your summary itself. Your Taste DNA bars, a short list of your strongest genres, are the only part anyone else can see. It is kept with your account, it is included when you download your data, and it is deleted with your account.
• The titles and people you opened recently, if you turn it on — so you can step back to a film whose synopsis you were reading a minute ago. This one never leaves your browser: it is a trail your browsing makes rather than anything you told us, and a browsing history is exactly the kind of record we do not collect centrally. It is off until you turn it on, from the row itself, and nothing is noted before then. We then keep the last few dozen on this device, only while you are signed in; turning it off clears it, and so does erasing your data.
• What the Oracle opens on — so its filters start on what you watch most, your browser works out the format, the usual running time and the usual country of origin from your own diary and watched titles, and keeps the running time and country of each title on this device after looking them up once in the catalogue. This stays in your browser and is never sent to us; it goes when you sign out of cinemere.com or erase your data.
• Titles you told us you have not seen — while marking up your history you can answer “not seen”, and we keep that answer so we stop asking. It used to live only in the browser you gave it in, which meant a second device, a reinstalled app or cleared site data quietly threw it away and we asked again. It is now stored with the rest of your account, and it is yours alone: unlike the titles you have marked as watched, this list is never served to another member. You can hand every one of them back into the deck whenever you like.
• An import, if you run one — you can bring your history from Letterboxd, IMDb or a CSV file. The file itself stays on your device. It is read in your browser, never uploaded, and not stored, not in your browser and not by us. Two things from it then go to our server, and nothing else does. First, the titles and years, so that they can be matched against the catalogue; TMDB sees those lookups from our server, never from you. Second, when you confirm the preview, the entries you chose to bring: watch dates, ratings, review text, watchlist titles and lists. We save them as ordinary diary entries, titles marked as watched, ratings, watchlist titles and lists, exactly as if you had added them by hand, and our word filter screens them like anything you write. We also keep a short import record so that you can undo the import: its date and source, how many of each thing it added, and, if you chose to replace a rating you already had, the rating you had before. It holds no titles and no review text. If our word filter holds back a review or a list text during an import, up to 20 of those texts (at most 500 characters each) stay on the import record only until the one moderation report for that import is filed when it ends, and are cleared then; the report keeps them as it does for any word-filter report (section 11). The record is deleted 30 days after the import and when you delete your account, and your data export includes it.
• How you saw something, and who with — a diary entry can record the carrier (cinema, streaming, disc, tape, broadcast), the format (70mm, 4K UHD, or the service you streamed it on), the place you saw it, and the members who were there with you. Every part of this is optional and you type it yourself. Two things are worth saying plainly. First, the place is somewhere you physically were, so Settings → Identity → Privacy carries a switch, Keep cinemas to yourself: turn it on and we remove that line from your logs before they are served to anybody else, on the server, not in the page. Second, naming a member writes nothing to their diary. It sends them a note asking whether they want to log it too, they decide, and whoever is named can take their own name off your entry at any time, without telling you. You can only name members who follow you back.
• Who can see a log — every diary log is private (only you), friends only (members who follow you back) or public (anyone who can see your profile), and you choose when you log. You can save a default, or be asked every time, and from your Diary you can change the setting of all your logs at once. The titles you mark as watched and your ratings carry the same setting: a rating follows the most visible of your logs and marks of that title, and a rating or a mark you give without logging takes your default, or is private if you have none. Logs from before this setting existed stayed public. We apply the setting on our server before anything is sent to another member, so a private log or rating is not sent to anyone else’s browser, and a private log does not send the members you named an invitation. A private profile still hides everything from people you have not approved, whatever a log says. Your own counts (films, series, logs, hours) include every log you have, whoever can see it. The one number that is not hidden by it: the average rating a title shows counts every member’s rating, private ones included, and is only shown once three members have rated that title, so it cannot point at one person. A Double Bill is built only from logs you made public. Logs also appear in the feed. The Premiere shows a log to the members its setting allows: a public log to anyone who can see your profile, a friends-only log to members who follow you back, and a private log to no one. Logs brought in from another service are never shown in a feed. A log in the feed shows its title, your rating, whether you liked it, which watch it was, how you saw it and who with, the day you watched it and your review, but never your tags, which stay yours alone.
• Shared cards — two features publish something about more than one member, and neither can happen without agreement. A Double Bill puts your verdict on a title beside someone else's: it is only published once both of you have said yes in your conversation, and it then shows the rating and the review you already wrote, as you wrote them. A Screening records one evening: what was watched, when, where, and who was in the room. It stores no ratings at all; it counts them from the diaries of the people who have logged it, so nobody is ever shown a verdict they did not enter, and anyone named can take their own name off it.
• Messages — direct and group messages you send within Cinemere.
• Your password — stored only as a salted hash (Argon2id on cinemere.com), never in plain text. See the security note in section 09.
• Your country, and your viewing settings — the country you are in, your content language, whether you are happy to read subtitles, the highest age rating you want suggested, and which kinds of title (films, series, anime, reality) you want Browse, the Oracle and search to lead with. These decide which catalogue answer you get: the streaming services and cinema listings for your country, synopses in your language, nothing rated above your ceiling, and only the kinds of title you chose. The last one only narrows what we suggest and search for you: your own diary, lists and profile always show everything. They are held in private fields, are never shown on your profile and are never served to another member. If you are in the United States you may also give us a state and city. Those are optional, they change nothing today because US streaming rights are national, and we hold them only as groundwork for cinema showtimes, which genuinely are local. Leave them blank, or clear them later, and nothing is lost. Choosing a country outside the United States clears them automatically, because there would be no purpose left for holding them.
• Your privacy choices — the consent record set by the banner on this site.
• Your year of birth — asked once, when you join or when you accept these terms, so we can tell that you are old enough to be here (see section 10). We keep the year only, never a full date of birth. If you were born in the year you turn the age that is being checked (16 for an account, 18 to buy a plan), the year alone cannot answer, so we also ask for the date of your birthday, month and day: it is compared once, on our server, and not kept, in your account, in a log or anywhere else. The year is held in a private field, is never shown on your profile, and is never served to another member.
• Your acceptance of our terms — which version of the Terms of Service and this notice you accepted, and when. This is what lets us rely on our agreement with you as a lawful basis, and what lets you ask us exactly what you agreed to. With each acceptance we also note the country you had set at that moment, because whether the arbitration agreement in Terms of Service 19.6 applies to you depends on it (section 19 of the Terms).
• Waitlist and invitations — if you joined the waitlist before you had an account, we hold the email address you gave us, your own referral code, the code that referred you if any (and whether it was a member's), and how many people joined through your link. That is used only to hold your place in line and to let you in; a person who joins the line through a member's link stands ahead of those who joined without one. It is deleted when you join, when you leave the list, or after 365 days of nothing happening.
• Invitation list — while sign-up is by invitation, we hold the email addresses that may create an account, which we add when we approve someone from the waitlist or invite them ourselves, and whether each invitation has been used. Some of those addresses were given to us by the person who invited someone, not by that person. A used invitation is deleted 30 days after it was used, an unused one after 365 days, and either one when the account it belongs to is deleted.
• Your invitation link — as a member you have a personal invitation code, made the first time you open Invite friends and kept with your account. You share the link yourself and your friend types their own email address on the waitlist; we never take anybody's address from you. We keep two numbers for you: how many people are in line through your code today, and how many friends have created an account through it. Only you can see them. We do not record who invited whom: the code on a friend's waitlist entry is deleted with the entry, which happens when they create their account. The tier that count earns (Usher at 1 friend, Head Usher at 5, House Manager at 15) is shown as a badge on your public profile; the count behind it is not. All of this is deleted with your account, and anyone still in line through your code is unlinked from it.
• Safety and moderation — reports you file (with any screenshot you chose to attach to one sent by email, and the email address you gave us in a report if your account has none, used only to answer that report), the updates we send you about them, reports about you, blocks and mutes, and any decision we have taken about your account together with the reason we gave you. Section 11 explains what happens to this.
• Clubs, games and quizzes — club memberships and club messages, ScreenPlay scores, daily results and streaks, and quizzes you build.
• Follow requests — requests you sent to private profiles, and requests awaiting your approval.
• People you might like — to suggest members you might follow, our server compares your public Taste DNA with theirs, counts how many of the same titles you have both rated (only ratings you are allowed to see), and checks who the people you follow follow (only where those follows are visible to you). It shows you a name and one reason, never a score or their ratings. When you tap ✕ on a suggestion we keep that answer so we stop suggesting them; it is yours alone and the member is never told. Your own switch, Suggest me to other members (Settings → Identity → Privacy, on unless you turn it off), decides whether you appear in other members' suggestions.
• Payments (paid plans only) — if you buy a subscription, we hold your plan, its price, its status and dates, any refund, and Paddle's references for you as a customer, for the subscription and for each payment and refund. We hold no card or PayPal details at all: no card number, expiry, card brand or billing address. With the plan we keep the record of what you agreed to at checkout: that you asked for the service to start inside the withdrawal period, which version of the Subscription Terms you accepted and when, and that you agreed to the automatic renewal terms (California law requires a business to be able to prove that for at least three years, and we keep it the same way for everyone). We never receive or store your full card number. This record is kept for as long as bookkeeping law requires, seven years after the end of the financial year it belongs to, because Paddle's statements of the sales are part of our accounts; sections 08 and 06 explain.

What you must give us, and what others can see. To open an account you must choose a handle and a password, give an email address and your year of birth, and accept the Terms of Service; without them we cannot open it, and everything else here is optional. Your handle, display name, picture, cover, bio, taste tags, Taste DNA, streaming services, founding number, follow counts and the people you follow, your Oscar ballot, and what you post and list, and the logs, marks and ratings you leave public, can be seen by other members and by visitors who are not signed in; each log, mark and rating can instead be kept private or shown to friends only (section 02). You can keep who you follow and who follows you to yourself with Keep your follows to yourself in Settings → Identity → Privacy; a private profile starts with it on. Other members then still see how many, never who, and we remove the list on the server before your profile is served to anybody else. (Another member who follows you and keeps their own list public still shows you on it: that list is theirs.) If you make your profile private, only the header stays public (picture, names, bio, taste tags, counts, favourite titles and badges) and the rest is shown only to followers you approve. Your email address, year of birth, country, settings, messages and notifications are never shown to anyone else.

We collect this data for one purpose only: to provide the features you are using (logging titles, building lists, talking to other members, personalising recommendations, recovering your account, keeping the place safe, and billing you if you chose a paid plan). We do not profile you for advertising and we run no analytics. The one thing that is not a feature, advertising on the free plan, is described in section 03 and never uses anything above. The legal basis for each use is in section 05, and how long each kind of data is kept is in section 08.

Automated processing. Everything you write for other members to see, except direct messages, passes through an automated word filter before it is saved, which can refuse a message outright. That is the only automated decision on Cinemere, it decides about a piece of text and never about you as a person, and no account is ever restricted without a human deciding. Section 11 explains it in full and how to challenge the outcome.

03Where your data goes

To function, Cinemere relies on a small number of outside services. Some act only on our instructions and some are independent of us, and that difference decides what they may do with anything they see. The register below states it for each one rather than calling them all partners.

Their own notices: Cloudflare · Paddle · Resend · TMDB · TVmaze · Google, and specifically how Google uses information from sites that use its services.

Fonts are not on that list, and that is the point. Our typefaces are self-hosted, so unlike most sites Cinemere sends nothing to Google in order to render text.

We use no analytics provider, no social-media pixel and no data broker, and no advertising network except Google's, on the terms above. The ads we serve ourselves involve no other company at all. We never sell, rent, or "share" (as the CCPA/CPRA defines that term) your personal information.

Advertising, before it starts

The free plan will be paid for by advertising, and everyone on it will see ads. It has not started. We describe it now so that nothing about it is new to you on the day it begins. Before any ad appears we will tell you in the app, and the consent banner will ask you. The rules, which the Terms of Service also set out:

• Google only with your yes. The banner asks whether Google may show you ads. Until you say yes, nothing loads from Google and your browser sends nothing to it. If you say no, or have not answered, you see ads we serve ourselves instead. They come from cinemere.com like the rest of the page, store nothing on your device, read nothing from it, and are chosen from the page alone. Showing one uses no personal data beyond what serving the page already does, and nothing about you reaches the advertiser or any ad company. Saying no costs you no feature: the free plan works exactly the same. You can change your mind at any time with Manage choices, as easily as you said yes.
• Chosen by the page, never from your account. Google's ads are non-personalised: Google chooses them from the page they appear on and your approximate location, never from your account, your diary, your activity on other sites or a profile of you. Changing that would need your separate consent first, and would never include members under 18.
• Free plan only, and Google never on a member's page. Cinemere+ and Cinemere Pro show no ads. Google's ads appear only on catalogue pages (browsing, a film, a series or a person in the catalogue, and The Oracle) and in the games, never on a page that is about a member or whose address or title names one, which keeps member names and handles out of every ad request. Our own ads can also appear on member pages, because no request about the page leaves Cinemere. No ad appears in messages, settings, checkout or the pages about your rights.
• How Google reads the page. To choose an ad for a page, Google's ad crawler visits its public address and reads what any signed-out visitor could see there, as a search engine does. It is never signed in and never sees your account. Google then picks the ad in its own auction, in which other advertising companies can take part; which of them may, and on what terms, is set by Google and by the controls in our advertising account.
• If you use Global Privacy Control, or any browser signal that asks sites not to sell or share, we treat it as a no to Google's ads: nothing loads from Google, and you see our own ads instead.
• No ads next to what could say something private about you. A film about a particular illness, faith or sexuality can reveal something about the person reading about it, so pages about titles like that carry no ads from Google, and nothing about your visit to them reaches Google.
• Who answers for what. We answer for our own ads in full. For Google's, we answer for putting the ad on the page, for asking you first and for which pages carry one. Google answers for what it does with the request afterwards. You can use your rights with either of us, and if you come to us about something only Google can act on, we pass it on and tell you we have.

Article 26 GDPR. The bullet above is the essence of how responsibility is shared between us and Google for the moment your browser sends an ad request, which Article 26(2) entitles you to see. Google's own terms with us, the Google Ads Controller-Controller Data Protection Terms, describe each of us as an independent controller and contain no separate joint-controller arrangement. The Court of Justice of the EU holds a site that embeds such code jointly responsible for that first step all the same (Case C-40/17, Fashion ID, judgment of 29 July 2019), so we set out our share here ourselves and answer for it. Once advertising has started, ask at privacy@cinemere.com and we will send you the version of Google's terms we accepted.

Transfers outside Europe

Your account lives in the EU and stays there. The database and everything you write are stored in Nürnberg, the encrypted backups in Helsinki, and anything you email us in Berlin. Your diary, your lists and your direct messages are never stored outside the EEA.

Four services in the register are outside it, and data passes through each, so each needs a lawful basis:

• Cloudflare, Inc. (United States). Every request you make and every page we send back passes through its network, which is how it protects the site. Like any security proxy, its servers handle that traffic in readable form while it is in transit, including what you write, so it sees your IP address and what is sent. Under its contract with us it may use that traffic only to deliver and protect Cinemere. Covered by the European Commission's standard contractual clauses, controller-to-processor, together with Cloudflare's EU-US Data Privacy Framework certification.
• Your device's push service (Apple, Google or Mozilla; in the Cinemere app, Apple's push service or Google's Firebase Cloud Messaging), only if you turn notifications on. A new direct message's first lines travel through it to your phone, encrypted so that only your device can read them; the service carries them without being able to open them. In the app the key that opens them is made on your phone and shared only with us, never with Apple or Google.
• Plus Five Five, Inc., trading as Resend (United States), receives your email address and the text of the emails we send you, and keeps its own records of their delivery. Same basis, in two parts because it has two roles: standard contractual clauses, controller-to-processor for the messages, and controller-to-controller for the delivery records, in both cases together with its EU-US Data Privacy Framework certification.
• Paddle.com Market Limited (United Kingdom), only if you buy a plan. It sells you the plan as an independent controller, and what we send it, your handle, the plan and the record of your checkout choices, is covered by the European Commission's adequacy decision for the United Kingdom (GDPR Article 45). Where Paddle uses other companies of its own, that is under Paddle's notice and its responsibility.

Advertising from Google, once it starts, adds one more, and only if you say yes to it. Our own ads add none. Our counterparty is Google Ireland Limited, in the EU. Google's own processing in the United States is its responsibility as an independent controller, under Google's EU-US Data Privacy Framework certification. For visitors in the United States, Google handles the ad request under its restricted data processing terms, as our service provider, which restricts what it may do with that request.

We add no transfer outside the EEA without a safeguard the GDPR recognises, and a new one is named in this section before it begins.

You are entitled to see those safeguards. Write to privacy@cinemere.com and we will send you a copy of the clauses we rely on, with the commercial terms removed and nothing else.

The catalogues are a different case and we would rather be exact than tidy. TMDB and TVmaze receive no account data from us at all. Catalogue lookups leave from our own server, so they carry no identifier and not your address. That includes the titles and years from a file you import: they are looked up from our server and are never tied to you at TMDB. Poster artwork and airing listings are fetched by your own browser, which necessarily shows those services your IP: that is a connection your device makes, not a transfer we perform, and it is the reason both appear in the register and in the Cookie Policy rather than being left unsaid.

When the law asks

We disclose member data to an authority only where we are legally required to, and in one situation where the law requires us to act on our own: if something on Cinemere makes us suspect a crime that threatens someone's life or safety, Article 18 of the Digital Services Act requires us to tell the police promptly, with the information we have. We also report sexual content involving a child to the police. We will tell you if either happens to you, unless the law or the investigation forbids us from telling you.

04Cookies & local storage

Cinemere sets no analytics or tracking cookies, in either mode. It never profiles you across other sites, and there are no third-party trackers on this page. Advertising cookies do not exist on Cinemere today. Once ads start on the free plan, Google may set them, but only after you say yes. The ads we serve ourselves set none. Google says it uses them with non-personalised ads to prevent fraud, cap repeats and count ads; what Google does as its own company is in its own policies (section 03).

The full register lives in the Cookie Policy, which lists every item, who sets it, why, how long it lasts and whether it needs your consent. It governs where the two ever differ. What follows here is the summary.

As a local copy without a server, Cinemere sets no cookies at all: it uses your browser's localStorage as the application's database (your account and your library).

On cinemere.com, signing in sets one first-party cookie, cin_session. It holds a signed token that tells the server which member you are, so you stay signed in as you move between pages. It is httpOnly (JavaScript cannot read it), SameSite=Lax and sent only over HTTPS, and it is used for nothing but keeping you signed in. Under the EU ePrivacy rules, storage that is strictly necessary to deliver a service you have asked for does not require consent, and a sign-in cookie is the textbook example; we still tell you it is there. Signing out removes it. On cinemere.com your localStorage additionally holds a local copy of your account and activity. It is where the app puts what the server sends, and every page reads from it in order to show you your library, so it is part of how the service works rather than an optional speed-up; it also keeps pages working through a brief connection drop. The authoritative copy lives on the server (see section 03).

Because Cloudflare protects the site (section 03), it may also set its own strictly-necessary cookies while its bot protection is engaged: __cf_bm, which lasts about half an hour and exists to tell a browser apart from a bot, and cf_clearance, which remembers that you passed a check if you were shown one. It carries no advertising or analytics purpose and is not used to profile you.

If you buy a subscription, Paddle's checkout opens in its own frame, from Paddle's own domain, and may store what its fraud checks need there, under Paddle's name. It stores nothing on cinemere.com. It is strictly necessary to take a payment you asked for.

Two things need your consent: the optional YouTube trailer embed, which is a third party that can set cookies, and, once it starts, advertising from Google on the free plan. That is why the banner gives you a clear choice for each, defaulted to off, and why you can change either at any time with Manage choices above.

05Legal bases (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)) — storing your account, diary, lists, follows and messages so the product works for you; personalising Cinemere for you, which is a large part of what the service is: your Taste DNA, the order of your For You feed, the fuller taste summary and the actors, directors and writers behind the titles you rated highly that we keep on our servers, and the Oracle’s and Taste Match’s suggestions worked out from them, plus, for a Taste Fusion both members accepted, ranking titles for the two of you from both summaries, and suggesting members you might like to follow; sending the account emails you ask for (the welcome brief, address confirmation, password-reset links); and, on a paid plan, taking your payment, renewing it and issuing your receipt. The contract is the Terms of Service you accepted.
• Legal obligation (Art. 6(1)(c)) — keeping invoices and transaction records for as long as Swedish bookkeeping law requires, seven years after the end of the financial year they belong to (section 08); the duties the Digital Services Act places on us, such as confirming a report, telling a member why we acted, sending the anonymised statement to the Commission (section 11) and telling the police about a suspected crime that threatens someone's life or safety; keeping content removed on an authority's order about terrorist content for six months, as Article 6 of Regulation (EU) 2021/784 requires; and acting on a valid order from an authority. Section 06 explains why bookkeeping is something deletion cannot reach.
• Members aged 16 or 17. An agreement made without a guardian's consent does not bind someone under 18 (föräldrabalken 9 kap.), so for a member under 18 whose guardian has not approved it, we do not rely on the contract. We rely instead on our legitimate interest in providing the service they signed up for (Art. 6(1)(f)), for exactly the same purposes, and their consents count as they would for anyone, because 16 is the age at which the GDPR lets them give them alone (section 10). Once they confirm the terms as an adult, the contract applies.
• Steps before a contract (Art. 6(1)(b)) — the waitlist: holding your place in line and letting you in, because you asked us to.
• Legitimate interests (Art. 6(1)(f)) — the things that follow, each narrow. Opening the doors in order: the invitation list, including addresses someone else gave us to invite. Checking age: your year of birth, so we do not hold accounts for anyone under 16. Keeping proof of what you agreed to: the record of which terms you accepted and when, and the renewal consent at checkout, because we must be able to show a consent we rely on (California's law on automatic renewal is not EU law, so it is this interest, not a legal obligation, that lets us keep that record). Then five more. Suggesting you to other members: your public Taste DNA, the ratings and follows another member is already allowed to see, and nothing private, so that people with a taste like yours can find you; the member is shown your name and one reason, never a score, and Suggest me to other members in Settings turns it off at once. Keeping the service up and safe: rate limiting, blocking attacks, and the moderation record described in section 11, because a platform that cannot enforce its own rules cannot protect the people on it. Showing you film data: connecting to TMDB and TVmaze, with no profiling or advertising involved. Keeping our own records straight: the audit log of moderation decisions. Answering you and being able to show we did: reading and replying to email you send us, and keeping it for the windows in section 08, so that we can prove how a request or a complaint was handled and defend ourselves if one ever turns into a claim. We weighed each against your rights and concluded they are what you would reasonably expect from a service like this; you can object at any time using the address in section 12, and you can ask us for the assessment.
• Consent — the Cinemere Dispatch newsletter (off by default, a deliberate opt-in at sign-up or in Settings, withdrawable with one click in every issue), push notifications (off by default, enabled only when you allow them on your device), loading optional third-party trailers from YouTube, and, once it starts, advertising from Google on the free plan: loading an ad from Google and letting it store an identifier in your browser (section 03). The consent covers both the storing, which 9 kap. 28 § of the Electronic Communications Act requires us to ask about, and the request your browser sends. You may withdraw consent at any time, as easily as you gave it.

06Your rights under the GDPR

The GDPR gives you the rights below wherever you live, because it binds everything we do. Most of them are self-service and instant on this page:

• Access & portability — see and download all your data: use Export my data above (GDPR Arts. 15 & 20).
• Erasure ("right to be forgotten") — wipe everything: use Delete account above (Art. 17).
• Rectification — correct your profile in Settings, and edit or delete any diary entry, list or post (Art. 16).
• Restriction — ask us to pause using data while a question about it is settled, turn off optional connections via Manage choices, or stop processing entirely by erasing your data (Art. 18).
• Objection — you can object at any time to anything we do on the basis of our legitimate interests: the invitation list, the age check, keeping consent records, rate limiting and security, the moderation record, connecting to the film catalogues, being suggested to other members (or simply turn off Suggest me to other members), and keeping email you sent us (section 05). Write to the address in section 12. We then stop, unless we can show compelling grounds that outweigh your interests or we need it for a legal claim, and we tell you which (Art. 21).
• Withdraw consent — switch trailer playback, advertising, push notifications or the Dispatch back off at any time, as easily as you turned them on (Art. 7(3)).
• Not to be subject to automated decisions — no decision about you as a person is made automatically. See section 11 for the one automated step and how to challenge its outcome (Art. 22).
• Lodge a complaint — with Integritetsskyddsmyndigheten (IMY) (imy.se), our lead supervisory authority, or with the authority where you live. You do not have to come to us first, though we would like the chance to fix it.

You exercise these yourself, immediately: no request form and no 30-day wait. Export downloads your data straight from your browser. Delete account (the control above, also in Settings → Privacy & Data) asks for your password and then deletes your account on the server before wiping this device, in one step: your profile, posts, takes, stories, diary, your ratings, watchlist, the titles you marked as watched, the titles you told us you have not seen, your import records, episode progress, your ratings of seasons and episodes, series status and the series you muted for new-episode notifications, lists, notifications, your own message threads, quizzes, game scores, push subscriptions, follow requests, the suggestions you dismissed (and you from anyone else's dismissed list), blocks and mutes, your consent record, your waitlist entry, your invitation code and its count (anyone still in line through your code is unlinked from it), and any queued email, plus your saved password, email address and year of birth. It also removes your footprint from other members' pages: your club memberships and club messages, the comments, reactions, reposts and poll votes you left on their posts, your likes on their takes and lists, your name from any log where they recorded you as company, your name from any Screening you were part of, your handle from their follower lists, and any notification about your activity sitting in their notification centre. Any Double Bill you appeared in is deleted outright, not left standing with one side missing: it carried your rating and your words, and half of that card is not a card.

The six honest limits

Deletion is immediate and it is thorough. It is not magic, and we would rather tell you exactly where it stops than let you discover it later:

• Messages you sent remain in the recipient's copy of the conversation, the same way a sent email stays in someone's inbox. We cannot reach into another person's mailbox, and it would not be right if we could.
• Backups. We take an encrypted database backup every day and keep a weekly copy for longer, so that a failure does not destroy everybody's library. That means a copy of your data can survive in a backup for up to 56 days after you delete it, until that backup ages out and is destroyed. Backups are never used to restore a deleted account, they are only ever used to recover the whole database after a disaster, and if that ever happened we would delete your account again from the restored copy before the service reopened. That is what our deletion register is for: when you delete your account we record your handle and the dates it was created and deleted, nothing else, and keep that record for 60 days, a little longer than the oldest backup can live. This is a recognised limit on the right to erasure, and it is the honest answer to "is it really gone": gone from Cinemere immediately, gone from the last backup within 56 days.
• Invoices and payment records, if you ever bought a subscription. Swedish bookkeeping law makes us keep them until the end of the seventh year after the year in which the financial year they belong to closed (bokföringslagen 7 kap. 2 §). Our financial year is the calendar year, so that is 31 December, seven years after the end of the financial year the payment belongs to: a payment made in 2027 is kept until 31 December 2034. We are not allowed to delete them on request before then. We keep only what that law requires, we separate it from your member account, and we use it for nothing else. When you delete your account we archive your customer record at Paddle. Paddle, as the seller, keeps the records of the sale that its own legal duties require, as its own controller (section 03), under its own notice; you can ask Paddle about them directly.
• The moderation record. If we ever had to act on your account, the decision, the reason and the date survive your account for 3 years. Section 11 explains why and what it contains.
• Emails you sent us. A message you wrote to one of our addresses is not part of your account, so deleting the account does not reach it. Section 08 says how long each kind is kept, and how to ask us to delete it sooner.
• The record of emails we sent you, kept by our email service. Resend, which delivers our email, keeps its own record of which address we wrote to and when, as an independent controller (section 03), and the copies of the emails in its system are deleted under its own schedule. Deleting your account here cannot reach either. Resend's privacy notice says how to ask it directly, and we will help if you ask us.

Everything not in that list is gone, apart from short-lived technical traces: our server logs keep your handle for a deletion like any other request until they rotate out, and a copy of the database taken during an update can hold it for up to 14 days before it is dropped. Neither is ever used to restore anything. Reports and decisions about you are covered in section 11.

07United States privacy rights

As far as we can assess, none of the United States privacy statutes applies to Cinemere today, and we grant their rights anyway. Most of them apply only above a size threshold. The California Consumer Privacy Act, for example, reaches a business above roughly USD 26.6 million in revenue, or one handling the personal information of 100,000 consumers, or one earning half its revenue from selling data, and most other states use tests of the same kind. Texas and Nebraska work differently: they have no threshold of that sort, and instead exempt small businesses, while still forbidding even a small business to sell sensitive personal data without consent. We are far below every threshold, we are a small business under the Texas and Nebraska test, and we do not sell anything about you, sensitive or otherwise. So none of them binds us today.

We are telling you that rather than claiming a compliance we do not owe, because a promise in a privacy notice is enforceable whether or not the statute behind it applies, and a claim nobody checked is worth nothing to you. What follows is a commitment we are making of our own accord. It applies to you wherever in the United States you live, not only in the states that have passed a law. If we ever cross a threshold, nothing here changes except that it also becomes compulsory.

What we collect about you, in the categories the CCPA uses

Section 02 is the plain-language version and the table at the top of this page is generated live from your own account. This is the same thing in the statutory buckets, because those are what a request or a regulator will ask in.

Where it comes from: mostly you, as you use Cinemere. Some of it comes from other members (a report about something you wrote, being named as company on someone's log, an @mention, a follow request) and some from us (a moderation decision and the statement we send about it, your founding number). An invitation may come from someone who invited you. We buy nothing from a data broker, we take nothing from a social network, and no analytics or advertising service feeds us anything. When Google's ads run on the free plan with your yes, your browser sends Google a request (section 03), and nothing about you comes back to us from it.

Why we hold it: to run the service you asked for, to take a payment if you bought a plan, to keep the place safe, and to obey the law. Section 05 sets out the legal basis for each. We do not use it for cross-context behavioural advertising or to build a picture of you for anybody else. The only profiling we do is Taste DNA and the For You ordering, which personalise Cinemere for you, are never used for advertising, and never decide anything with a legal or similarly significant effect on you.

How long: section 08 is the schedule. A job on our server enforces the first table there nightly; the table for email you send us is kept by a person, as that section explains.

Sensitive personal information, and being exact about it

Two of the things Cinemere holds are sensitive personal information in the CCPA's sense, and we would rather name them than let you find out from a definition:

• Your account credential (§ 1798.140(ae)(1)(D)). We hold a salted Argon2id hash, never the password itself.
• The contents of your messages to other members (§ 1798.140(ae)(1)(F)), because we are not the intended recipient of a direct message between two members. We store them so the conversation works. No filter scans them. A person here sees one only when a member in the conversation reports it, or when the law obliges us to look, and then only that message.

The right to limit the use of sensitive personal information exists to stop a business inferring characteristics about you from it. We never do that, with either of those two things or with anything else, and we use both only to deliver the service you asked for, which is what § 1798.121(a) permits without any limitation request. So there is no toggle here, and that is because there is nothing behind it to switch off, not because we left one out.

Your rights, and how to use them

• Know and access. What we collect, why, from where and who receives it: this section, sections 02 and 03, and the live table at the top. For a copy of the data itself, press Export my data.
• Delete. Press Delete account. It deletes the server account first and this device second, and if you ever paid for a plan it also ends any live plan at Paddle and archives your customer record there; what Paddle keeps as the seller is under its own notice. Everything else a service holds for us is either on our own server, and goes with it, or is one of the six things section 06 names that deletion cannot reach, with the reason for each.
• Correct. Edit your profile in Settings, and edit or delete any diary entry, rating, list or post yourself. If something we hold is wrong and you cannot reach it, write to us and we will fix it.
• Opt out of sale or sharing. There is nothing to opt out of. Cinemere has never sold personal information and has never "shared" it as these laws define that word, which means disclosing it for cross-context behavioural advertising. The ads we will show on the free plan are chosen from the page and your approximate location, never from your activity here or elsewhere, which is not that; and in the United States Google handles the request as our service provider, which is not a sale. There is therefore no "Do Not Sell or Share My Personal Information" link on this site. If you want nothing at all to reach an ad network, say no to advertising in the banner, or send the signal below, and nothing will.
• Opt out of profiling and targeted advertising (the Virginia, Colorado, Connecticut, Texas, Oregon and similar laws). We do not profile you for targeted advertising, sale, or any decision with legal or similarly significant effects: the ads are contextual, never targeted at you, and Taste DNA only orders recommendations inside Cinemere.
• Limit sensitive personal information. See directly above.
• Shine the Light (California Civil Code § 1798.83). We do not give personal information to any other business for its own direct marketing, so there is nothing for that law to report. Write to privacy@cinemere.com and we will confirm it in writing.
• Non-discrimination. Using any right here never costs you anything: we will not refuse you the service, charge you a different price, give you a lesser plan or a worse version of anything, or suggest that we might. We offer no financial incentive in exchange for your data, and we will not.
• Appeal. If we ever refuse a request, we will tell you why in writing and how to appeal it. Appeals go to legal@cinemere.com, a different address from the one that refused you, and we answer within 45 days with our reasons. If we uphold the refusal we will also give you the contact details of your state's Attorney General.

The practical details

• Two ways in, always. The buttons at the top of this page, and privacy@cinemere.com. Most people will never need the second.
• How we verify you. The buttons run inside your own signed-in session and erasure asks for your password again, which is a stronger check than any request form. By email, we verify by writing to the address on the account. We will never ask you for more personal information in order to prove who you are, and we will never ask for a photograph of a document.
• How long we take. Export and erase are immediate: no form, no queue, no thirty-day wait. An emailed request gets a confirmation without delay and an answer within 45 days, extendable once by a further 45 where a request is genuinely complex, in which case we tell you before the first 45 are up.
• Authorised agents. Someone may act for you if you give them written permission and we can verify both of you. We may still ask you to confirm it directly, because "an agent said so" is how an account gets taken.
• No charge. Ever, for any of this.

Opt-out preference signals

We honour the Global Privacy Control and any other browser opt-out signal, including the older Do Not Track setting, and we treat it as a valid request without asking you to confirm it. There is no sale, no sharing and no targeted advertising for it to switch off, so we go one step further: we treat the signal as a no to Google's ads, and while it is on, nothing loads from Google and your browser sends it nothing. On the free plan you then see our own ads, which no other company is involved in. We say it here so that you do not have to take that on trust.

Other companies can collect information about what you do on Cinemere only where you have said yes: YouTube when you switch trailers on, and Google if you say yes to advertising on the free plan. Section 04 says what each of them receives. Your browser also fetches artwork straight from TMDB and TVmaze, which shows them your IP address the way loading any image does, but nothing about your account (section 03). We let no other company track what you do on Cinemere, or follow you from Cinemere to other sites.

Minors

Cinemere is for members aged 16 and over, and section 10 explains the check. We do not knowingly collect personal information from a child under 13, in line with COPPA, and our own limit is higher than that law requires. We do not sell or share the personal information of anyone, which includes every member under 16.

A few laws that people ask about by name

• California "Shine the Light" (Cal. Civ. Code § 1798.83): we disclose no personal information to third parties for their own direct marketing, so there is nothing to request.
• Washington My Health My Data, and Nevada's equivalent: we do not collect, use, sell or infer consumer health data. What you watch is not treated by us as a signal about your health, and we make no inference of that kind from a diary, a watchlist or a rating. We would have to build something to do that, and we have not.
• Biometric privacy laws, including Illinois BIPA and Texas CUBI: Cinemere collects no biometric identifier of any kind. There is no face, voice or fingerprint anywhere in the product, and no way to upload one.
• The Video Privacy Protection Act: Cinemere is not a video tape service provider. It does not rent, sell or deliver films or series; a trailer plays from YouTube only after you switch trailers on (section 04). We disclose nothing about what you watch to anybody, and an ad request carries no account identifier and nothing from your diary. What you choose to publish on your own profile is published by you.

If there is ever a breach

If personal data is ever exposed in a way that could put anyone at risk, we will tell the Swedish supervisory authority within 72 hours of becoming aware, as Article 33 of the GDPR requires. We record every breach, including those that could not. We will tell you directly and without undue delay where there is a real risk to you. If you live in the United States, we will tell you within 30 days of discovering the breach at the latest, or sooner where your state's law requires it, and notify the authorities your state's law names, including the California Attorney General within 15 days of telling you where more than 500 Californians are affected. The only thing that may delay that is a written request from law enforcement that it would harm an investigation. We will tell you what happened, what was exposed, what we have done and what you should do, in that order, and we will not wait until we have a comfortable explanation.

08Data retention

Everything you make is kept until you delete it, either item by item or by erasing your account. That is the promise for your own library, and we will not expire your diary out from under you. Everything else has a fixed window, and a job runs on our server every day that actually enforces the table below. It is a schedule, not an intention.

Open reports are never swept, however old they are: an unresolved report is a live obligation, and the answer to an old one is to deal with it, not to delete it. Server logs are capped at 30 MB and the oldest lines are dropped as new ones arrive, so how long a line lasts depends on traffic. They record the address of each request without its query, so no one-time link or email address is ever written to them, and we do not record your IP address in them.

Email you send us

If you write to one of our addresses, the message and our reply sit in our inbox at mailbox.org in Berlin (see section 03). How long depends on what the message was about, and every window starts when the matter is closed, not when you first wrote.

Unlike the table above, this one is kept by a person. Nothing on our server can reach our inbox, so there is no nightly job for it: we go through it every 3 months and delete what has reached its date. A message can therefore stay up to that long past the date in the table, and never longer. After we delete a message, our provider's own safety snapshots may hold it for up to 7 more days before it is gone for good.

Deleting your account does not delete emails you sent us, because they are not part of your account. Ask us at privacy@cinemere.com and we delete them straight away, unless one is a request about your data, a report, a legal matter or a payment question that is still inside its window above, which is exactly what those windows are for. We never ask you to send identity documents. If you send one anyway, we delete the attachment as soon as we have what we need from it.

09Security (and an honest caveat)

Passwords are never stored in plain text: Cinemere keeps only a salted hash. In a local copy without a server, understand the limit of client-side software: storing credentials in the browser is obfuscation, not real authentication. Anyone with access to this device and its developer tools could read the local data. cinemere.com runs a real backend behind the same interface: passwords are hashed with Argon2id on the server, sessions are secure HTTP-only cookies over HTTPS, your email lives in a private database column that is never served to other members, and reset links are one-time and short-lived.

Keep your device secure. Signing out ends your session and clears the copy of your account and activity this browser keeps for the pages to read. What stays is what belongs to the device rather than to you: your consent choices, sound settings, cached catalogue data, and Recently Viewed if you turned it on, which only you can see when you sign in again. On a shared or public computer, sign out and then close the browser or clear this site's data, as section 07 of the Cookie Policy explains. Do not use Erase for this: it deletes your account itself, not just this browser's copy.

Who can reach your data, and how it is guarded

• Every read is checked on our server, not hidden in the app: a conversation can be opened only by the people in it, a notification only by the person it is for, and what is behind a private profile only by the members its owner approved.
• Private fields stay private. Your email address, year of birth, country and viewing settings are held apart from your public profile and are never served to another member.
• Traffic is encrypted between your device and us (HTTPS). Backups are encrypted with a key that is not kept on the server, so the server cannot read its own backups.
• Access to the production server and database is limited to the people who run Cinemere, which today is a very small number. The secrets the service runs on are deliberately left out of every backup.
• Sign-in and password reset are rate-limited, and our logs never record email addresses or one-time links.
• Every moderation decision is logged, kept for 3 years, and cannot be taken outside the one routine that also tells the member why (section 11).
• Every release passes automated checks before it goes out, including that no private field reaches the member directory and that no key or secret is shipped with the site.

One limit you should know about. Direct messages are not end-to-end encrypted. They are stored on our server so that a conversation works on every device you use, which means the people who administer that server could technically read them. Our rule is that nobody here reads one, and no filter scans one, except when a member in the conversation reports it, or when the law obliges us to, and then only that message (section 07 of the Terms of Service). Do not use Cinemere for anything you would not want a service provider able to see.

What we do not claim

We hold no security certification. We are not ISO 27001 certified and we have not been through a SOC 2 audit, and we are not going to put a badge on this page that we have not earned. No service can promise it will never be breached, and we are not going to be the one that does. What we can tell you is what is actually in place, which is above, and what we will do if it fails, which is below.

What we will promise: we will not quietly sit on bad news. Section 07 sets out the breach commitment, including the 72 hours Article 33 gives us to tell the supervisory authority, and what we will tell you and in what order.

One structural note, because it is the part most services cannot say: Cinemere has no file uploads anywhere in the product. There is no upload endpoint to exploit, no stored file to serve back to another member, and no way for anyone to use Cinemere to distribute malware. That is not a security measure we maintain, it is a shape the product has, which is a much stronger kind of guarantee.

10Age, and younger members

Cinemere is for members aged 16 and over. We ask for your year of birth when you create an account, and again once for accounts made before we introduced the rule. The check runs on our server, not only in your browser, so it cannot be clicked past.

16 is our own rule, not one the law hands us. Your account rests on our agreement with you (section 05), not on consent; for a member under 18 whose guardian has not approved that agreement, it rests on our legitimate interest instead, as section 05 explains. Where the law does set an age is consent. Article 8 GDPR lets a member state choose between 13 and 16 as the age at which a person can consent to an online service on their own, and several things here do ask for your consent: the Dispatch, trailers and advertising. By using 16, the highest of those ages, for everyone, no consent anyone gives on Cinemere can be one they were too young to give alone, and we never have to build a parental-consent system we could not verify. On a service with private messaging, that felt like the right call. In the United States we follow COPPA and do not knowingly collect data from children under 13; our own limit is higher.

We keep the year of birth only, never a full date, and it is never shown to another member. If we learn that an account belongs to someone under the limit, we close it and delete the data. If you believe a child is using Cinemere, tell us at privacy@cinemere.com and we will act on it.

11Moderation, and decisions about your account

Cinemere is an online platform under the EU Digital Services Act. That gives you a set of rights about how we police content, and gives us duties we would want anyway.

What is automated, and what is not

Everything written on Cinemere for other members to see passes an automated word filter before it is saved. Direct messages do not: they are private conversations, and we do not scan them. An unambiguous slur or explicit threat is refused outright; a borderline match is published but flagged for a person to read. The filter judges a piece of text. It never suspends, restricts or bans anyone: every decision about a person is made by a human being, which is why Article 22 of the GDPR, on decisions taken solely by automated means, does not bite here.

If we act, we tell you why

If we remove something you posted or restrict your account, you get a written statement of reasons: what we did, whether it was because the content is unlawful or because it breaks our Community Guidelines and which rule, whether a report or our own review started it, whether automated tools were involved, and how to challenge it. It arrives in your notifications and by email, because a suspended member cannot sign in to read a notification.

You can appeal for six months, and a person reviews every appeal. If we got it wrong we reverse it and say so.

Your decisions

Every decision we have made about your account, with the reason we gave you and the state of any appeal:

What we keep, and for how long

Blocks and mutes are erased when you delete your account, and so are reports, with three exceptions kept as evidence: a report that is still open, a report about sexual content involving a child, and one that led us to remove something as unlawful. Those stay until the ordinary 365-day limit for closed reports in section 08; if you made one, your handle is taken off it. The record of a moderation decision is not erased either. It holds the member it concerns, the moderator, the action, the date, what it was about, the reason, the statement we sent, and any appeal and its outcome. It is kept for 3 years after the decision, longer only while an appeal or a legal claim about it is open, and it survives the account it concerns, because a safety record that disappears when someone deletes their account makes a ban unenforceable and erases the history of what happened to the people they affected. We rely on our legitimate interest in keeping the service safe, we use it for nothing but safety, and we never use moderation data for profiling or advertising.

We also send an anonymised copy of each statement of reasons to the European Commission's public DSA Transparency Database, as Article 24(5) requires. It never contains your handle, your name or anything else that identifies you: that database is public, and publishing a moderation record about a named person is exactly what the law is trying to prevent.

To complain about how we moderate, write to safety@cinemere.com, take it to a certified out-of-court dispute settlement body under Article 21, or contact Post- och telestyrelsen (PTS) (pts.se), the Digital Services Coordinator for Sweden. Our point of contact for authorities is legal@cinemere.com, in Swedish or English.

12Changes & contact

If this notice changes materially, the version and date at the top change, and we tell you in the app and by email at least 30 days before the change applies to you. The date at the top is when the new version applies to people who join after it. If you already have an account, a change in what we do with your data does not apply to you until 30 days after we told you, even if the new version is already published. Where a change needs your agreement, such as consent to Google's ads, we ask for it rather than assuming it, and nothing changes until you say yes. We keep the old versions, so you can always ask us what applied when.

We answer data-rights requests within one month, as Article 12(3) requires, and usually far sooner because most of them are the two buttons at the top of this page. We do not charge for them.

Cinemere AB
—
—, Sweden
Company number —

Written to meet what the GDPR, the ePrivacy rules and the Digital Services Act require of us, to grant what the CCPA/CPRA and the other United States state laws would require of a larger company, and to be readable while doing both. See also the Terms of Service.