FilmShuffle Privacy Policy

Effective date: September 28, 2026\ Version: 2026-09-28

YouTube preview and playback update: September 12, 2026

Editable profile photo update: October 15, 2026

This Privacy Policy explains how FilmShuffle LLC (“FilmShuffle,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use filmshuffle.app, FilmShuffle web applications, FilmShuffle applications for iOS and Android, and related services that link to this Policy (collectively, the “Service”).

FilmShuffle LLC is the operator of the Service and, where applicable, the controller of personal information described in this Policy.

1. Scope

This Policy applies to visitors, account holders, Film Club participants, people who contact support, people who submit reports or legal requests, and purchasers or recipients of subscriptions, gifts, or other paid services.

It does not govern third-party websites or services that have their own privacy policies, even when FilmShuffle links to or integrates with them.

2. Age rules

FilmShuffle accounts and community features are for people who are at least 16 years old. We do not request a birth date; account holders confirm that they meet the minimum age.

People under 16 may browse public pages and use a guest ranking demonstration where available, but they may not create an account, publish content, or participate in community features. The Service is not directed to children under 13. If we learn that we collected personal information from a child under 13 in circumstances requiring parental consent and did not obtain it, we will take reasonable steps to delete the information.

A parent or guardian who believes a child provided personal information contrary to this Policy may contact contact@filmshuffle.app.

3. Personal information we collect

The information we collect depends on how you use FilmShuffle.

3.1 Account and authentication information

We may collect:

• email address;
• account identifier and authentication-provider identifiers;
• username and display name;
• password and authentication data handled by our authentication provider;
• sign-in, confirmation, password-recovery, session, and security timestamps;
• whether you used email/password, Google, Microsoft, Apple, or another sign-in option we make available; and
• records showing acceptance of legal terms, policy versions, age confirmation, acceptance method, and timestamp.

Supabase handles password authentication. FilmShuffle does not store plaintext passwords. When you reauthenticate for an action such as deleting your account, our server may briefly process the password you enter and transmit it securely to Supabase for verification. Do not send your password to support.

When an available connected sign-in option, such as Google or Apple, opens a browser or operating-system authentication session, you interact with that provider under its privacy terms. FilmShuffle and Supabase receive the authentication result and the account information needed to sign you in. Local storage used to complete sign-in is described in Section 4.

3.2 Profile and public information

Depending on the features and settings you use, we may collect and display:

• username, display name, profile photo, banner image, and biography or other profile fields;
• Film Personality or similar profile results;
• aggregate trivia or activity statistics;
• public reviews, ratings, shared Year-in-Film results, or other content you deliberately make public; and
• public sharing links and the information included in the shared page.

Public profile information and public User Content can be viewed, copied, indexed, captured, or redistributed by other people. Approved profile images may be stored at publicly accessible URLs.

3.3 Film activity and preferences

We collect information you create through FilmShuffle, such as:

• My Favorite Films order and comparison choices;
• FilmShuffle ratings and 100 Highest Rated results;
• watchlist, Everything Seen, skipped, unseen, or suppressed-film states;
• Film Log entries, watched dates, reviews, spoiler labels, rewatches, companions, notes, and photos;
• custom lists, Film Sets, Tier lists, board arrangements, and uploaded Tier images;
• trivia participation and first-attempt results;
• recommendations, preference settings, display settings, and interaction history; and
• technical ranking state used to calculate, place, compare, undo, or restore list positions.

3.4 Social and Film Club information

We may collect:

• friendships, friend requests, blocks, and feed-hiding preferences;
• invitation-link records and whether a person created an account through a tracked invitation, including internal account references and capture and credit timestamps;
• comments, replies, reactions, suggestions, votes, and notifications;
• Film Club membership, roles, invitations, submissions, comments, votes, programs, journeys, and selected films;
• visibility and comment settings; and
• reports involving profiles, content, users, or Film Clubs.

FilmShuffle does not currently offer direct messages. If direct messaging is introduced, this Policy will be updated before or when the feature launches as required.

3.5 User uploads and file information

When you use an upload feature, we collect the file and associated information, which may include:

• profile photos and banners;
• Film Log photos;
• custom Tier images;
• filenames or cleaned display titles;
• file type, size, dimensions, storage path, upload time, and moderation status; and
• images, audio, video, documents, or other files if FilmShuffle adds features that accept them.

Supported formats and size limits vary by upload feature and device. The moderated upload pipeline processes still JPEG or PNG images. On the website, the profile-photo and banner tools also accept supported still iPhone HEIC/HEIF images, convert them in your browser, and let you choose the crop before uploading. In the iOS and Android applications, the profile-photo and banner tools crop, resize, and convert selected images to JPEG on your device before upload; Film Log photo tools also resize and convert selected images on your device. Other upload tools, such as Tier images, may send the selected supported image for server processing. These tools provide still-image uploads, not video, animated-image, or image-sequence publishing. Server processing validates and re-encodes supported uploads, removing embedded metadata from the resulting image.

The mobile applications use system photo and file pickers so you can choose the items for an upload or import. FilmShuffle does not scan your entire photo library or file collection through these tools. Your operating system may request permission or provide access to selected items; available controls vary by device. You can manage permissions in your device settings. Withdrawing device access does not delete content you already uploaded. Selected files and working copies may also be held temporarily on your device as described in Section 4.6.

New images first go into private quarantine storage and are checked before they are attached or made available to the selected audience. This includes photos attached to private Film Log entries: a private audience setting does not exclude necessary safety screening by our service providers. See Section 6. Do not upload highly sensitive information, payment information, government identifiers, barcodes, login credentials, or material you do not have the right to use.

The profile-photo and banner editors also keep a resized, private copy of the full photo so you can change its zoom and position later. The private copy is re-encoded to remove embedded metadata, including location metadata, and both the full photo and the visible crop are checked before the change is saved. Other members see only your published photo, not the private copy. We record the upload time and photo-upload policy version.

When you replace or remove that profile photo or banner, or delete your account, the private copy is no longer available to the editor and is queued for deletion. Failed uploads are also subject to cleanup. A cleanup record is normally removed after 30 days following verified deletion; it does not keep the photo itself. Existing safety, legal-retention and backup policies still apply. Older photos and uploads made with earlier app versions may retain only their saved crop, so restoring cropped-off edges requires you to choose the original photo again.

3.6 Imported information

If you import a Letterboxd, IMDb, or other supported export, we collect the information you select from that file. Depending on the source, this may include:

• source service and file name;
• film titles, years, TMDB or IMDb identifiers, and source URLs;
• ratings, watched dates, review text, list names, list order, watchlist items, and viewing history;
• row numbers, validation issues, matching outcomes, and duplicate status;
• cryptographic file or request fingerprints used to detect duplicate imports and support undo; and
• import status, counts, receipts, and records created by the import.

Raw Letterboxd and IMDb import files are processed for the import and are not intended to be retained in FilmShuffle database or file storage after processing. Import receipts and resulting FilmShuffle records may remain until deleted or no longer reasonably needed.

FilmShuffle does not request your Letterboxd or IMDb password for file imports.

3.7 Support, safety, and legal requests

When you contact us or submit a report, we may collect:

• your name, email address, account identifier, subject, message, and category;
• the relevant page URL or content location;
• report reason, details, and snapshots of reported content;
• correspondence and case status;
• moderation decisions, evidence, review requests, outcomes, and internal notes;
• copyright notices and counter-notices;
• intimate-image removal requests, signatures, contact details, and status information; and
• information reasonably necessary to verify identity, authority, a legal request, or a claimed right.

Do not send passwords, full payment-card information, government identification, suspected child sexual abuse material, or copies of nonconsensual intimate images through general support. Use the specified reporting process and identify the content by URL, post, account, or other location information.

3.8 Technical and usage information

FilmShuffle and its service providers may automatically process:

• date and time, requested page, route, action, and response status;
• session and authentication information;
• approximate network information, IP address, browser or device information, and request logs maintained by hosting, content-delivery, authentication, or security providers;
• sanitized error classifications, occurrence counts, and technical fingerprints;
• rate-limit identifiers and abuse-prevention counters; and
• interaction events needed to operate rankings, feeds, imports, notifications, and other features.

FilmShuffle’s application may read an IP address transiently for security, rate limiting, or support abuse prevention and store a keyed or hashed identifier rather than the raw address. Infrastructure providers may separately maintain ordinary network logs under their own retention practices.

FilmShuffle does not currently use persistent device fingerprinting, precise geolocation, camera access, or microphone access through its web, iOS, or Android applications. Selecting an existing photo or file is different from granting access to record through a camera or microphone.

3.9 Communications and marketing preferences

We collect communications you send us and your preferences concerning newsletters, promotional email, and transactional notifications. Marketing consent is separate from acceptance of the Terms.

3.10 Payments, subscriptions, gifts, and access rewards

FilmShuffle uses Stripe Managed Payments for subscription and gift purchases, identified at checkout as Sold through Link. The merchant-of-record service processes payment-card, billing, tax, transaction-support and refund information under its terms and privacy information shown at checkout. FilmShuffle provides the membership features and product support. FilmShuffle receives information needed to administer the purchase, such as customer, subscription, checkout, and invoice identifiers; billing and payment status; plan; renewal and cancellation dates; country; tax information; and limited payment-method details. FilmShuffle does not receive your complete payment-card number through its checkout integration. Where available, checkout or billing-management controls in an application may open this payment service in a separate browser. The information you provide on that page is handled by the payment service under the terms and privacy information displayed there.

On supported installed iPhone builds, the app reads the country of your App Store storefront to determine whether it can offer external checkout. An eligible checkout request includes the platform and storefront eligibility information. This check does not use GPS or precise device location, and the app does not save the storefront result to persistent device storage.

For gifts, invitations, complimentary access, and earned membership rewards, we also process relevant purchase, eligibility, claim, redemption, and access-start/end records. A gift may link the purchasing account with the account that claims it. Claim links and codes should be treated as private, because a person with a valid link or code may be able to redeem it subject to the displayed eligibility rules.

4. Browser and mobile-app storage

FilmShuffle currently uses browser and mobile-device storage primarily for authentication, security, preferences, and user-requested functionality. Storage differs between the website, a browser-based application, and an installed iOS or Android application. The exact names or durations may change as security and features evolve.

4.1 Authentication and security cookies

These may include:

• Supabase authentication cookies, including cookies matching sb-<project-reference>-auth-token, which maintain a signed-in session;
• a short-lived email-confirmation cookie;
• a short-lived password-recovery cookie;
• a short-lived invitation-attribution cookie that remembers a tracked invitation through account creation; and
• short-lived reauthentication cookies used to protect account deletion.

These cookies are used to provide requested account functionality and protect accounts. They may be marked Secure, HttpOnly, and SameSite where appropriate.

The invitation-attribution cookie generally expires within 30 days or is removed after FilmShuffle finishes or rejects the attribution.

FilmShuffle also stores a filmshuffle_time_zone preference cookie so daily activities use your browser's time zone. It generally lasts up to one year and does not provide precise geolocation.

Hosting and content-delivery infrastructure also sets browser cookies, including __Host-appgarden-visitor and Cloudflare's __cf_bm. Cloudflare uses __cf_bm to help detect automated traffic and protect the Service; it generally expires after 30 minutes of inactivity. Infrastructure cookies are separate from your FilmShuffle account session.

4.2 Local storage

FilmShuffle may use local storage for:

• a guest ranking demonstration, including selected films, order, comparisons, and update time, generally retained for up to seven days;
• display preferences and saved game progress, including account-specific game positions;
• local state for achievement arrival notifications;
• dismissed import prompts; and
• dismissed product tours or feature prompts.

Local storage remains in your browser until it expires, you clear it, the browser removes it, or FilmShuffle code replaces or deletes it.

4.3 Session storage

FilmShuffle may use session storage for temporary rating or skip progress and to keep a private, one-time gift claim token in the same tab while you sign in. The gift token is not included in the sign-in URL and is cleared from tab storage after a successful claim. Session storage usually lasts until the browser tab or session ends.

The browser-based application also uses a temporary sign-in record in the same tab to complete a requested connected sign-in. It contains a sign-in verification value, the return destination, and, where relevant, unclaimed guest ranking progress and a signed invitation reference so these can continue after sign-in. This record is accepted for up to ten minutes and is consumed when the return is processed. Its expiry limits whether it can be used; it does not guarantee removal from browser storage at the exact expiry time. It does not contain the resulting signed-in session tokens.

4.4 Advertising, analytics, and embedded media

FilmShuffle does not currently operate its own advertising-cookie or cross-site behavioral advertising program, or use a third-party audience analytics tracker. Embedded YouTube playback is a separate third-party service and may use cookies or similar technologies when you choose to play a video, as described in Section 15. If we introduce additional nonessential tracking, advertising, or similar technologies, we will update this Policy and provide notice or choices required by applicable law before or when the practice begins.

Browser settings can clear or block storage, but doing so may sign you out, reset the guest demo, or prevent features from working correctly.

4.5 Installed-app sign-in and local state

Where Sign in with Apple is available, Apple may provide your name only when you first authorize FilmShuffle. FilmShuffle uses it to help set up your account without replacing a name you already saved. If you choose Apple’s private email relay, we receive the address Apple supplies for your account. For account deletion, we request fresh Apple verification and try to remove FilmShuffle’s Apple access. The app temporarily holds an encrypted, short-lived verification receipt in memory for this request; the server alone can read the provider token inside it. If automatic removal is unavailable after successful identity verification, we explain the manual removal step and ask you to confirm it before continuing.

The iOS and Android applications use the operating system's protected storage through Expo SecureStore for sign-in/session credentials. They also use protected storage for guest ranking progress, guest game-use and catalog-position records, invitation attribution or records associating a guest transfer with the account that claimed it, and preferences such as dismissing a guided-tour prompt. These records support requested features; they are not advertising identifiers. The operating system controls the underlying storage protection and removal behavior.

Signed-in screens may keep fetched account content, display choices, and unfinished edits in the application's memory while you use them. Display preferences saved through account-personalization controls, including a remembered list view where selected, are also sent to FilmShuffle and stored with your account. Signing out is intended to remove saved sign-in credentials and discard the active account's in-memory data. Unsaved edits may be lost when you sign out or the application closes. Signing out does not delete content saved to your account or cancel a subscription. Public artwork and other display assets may be cached separately on your device. Uninstalling the application is not the account-deletion process described in Section 11 and does not guarantee that every operating-system-managed storage item or separately saved file is removed.

4.6 Selected files, working copies, and exports

The mobile applications may create or access temporary local copies of files you select for import or upload, cropped or converted images, and files prepared for an export, share, or print action. These can include account-export files, Tier share images, and discussion-guide PDFs. FilmShuffle attempts to remove its working copies after the operation or when the relevant import or session is cleared. An interrupted operation or failed cleanup may leave a temporary file until it is later removed by the application or operating system; this is not a promise of immediate or complete device-file deletion.

When you choose to save, share, or print a file, your selected application, file provider, cloud-storage service, or printer may receive and retain a copy under its own settings and practices. FilmShuffle cannot remove those independently saved copies by signing you out or deleting your FilmShuffle account.

5. How we use personal information

We use personal information to:

1. create, authenticate, secure, and administer accounts;
2. provide rankings, ratings, logs, lists, profiles, imports, social features, Clubs, sharing, and other requested functionality;
3. attribute successful invitations and award related achievements;
4. personalize displays, recommendations, feeds, and feature settings;
5. publish content to the audience selected by the user;
6. process uploads and generate technical display versions;
7. moderate names, images, and community content using automated and human review;
8. detect, prevent, investigate, and respond to spam, fraud, abuse, security incidents, policy violations, and illegal activity;
9. receive and resolve support requests, reports, appeals, copyright notices, intimate-image requests, and legal requests;
10. communicate about authentication, security, community activity, moderation, legal changes, support, and billing;
11. send marketing communications consistent with your preferences and applicable law;
12. operate, maintain, debug, test, analyze, and improve the Service;
13. create aggregate or de-identified information for product, safety, and operational analysis;
14. process payments, taxes, subscriptions, gifts, access rewards, cancellations, and disputes;
15. enforce the Terms, Community Guidelines, and other policies; and
16. comply with law and protect the rights, safety, and property of FilmShuffle, users, and others.

FilmShuffle does not train its own general-purpose artificial-intelligence model using private User Content. Our use of external image moderation, including the provider's possible service-improvement processing, is explained in Section 6. We will not begin using private User Content ourselves for a materially different training purpose without updating our disclosures and obtaining any consent required by law.

6. Automated moderation and decision support

FilmShuffle uses Amazon Web Services (AWS) Rekognition for automated image moderation. Our server sends the normalized image bytes to Rekognition in the U.S. East (Northern Virginia) region. This applies to new profile photos, banners, Film Log photos, and custom Tier uploads, including images intended for a private audience. This integration checks image-safety categories; it is not used to identify people through facial recognition.

We retain limited operational records such as a file hash, detected category/confidence information, provider model version, decision, timestamps, and review or cleanup status. Clear violations are rejected; uncertain images stay private for review; a failed check keeps the image private for retry. Rejected and expired upload files are scheduled for deletion with verification and retry of failed cleanup. Legal preservation obligations may require restricted retention. A failed replacement does not replace your existing approved photo.

AWS's applicable service terms allow certain content storage and use for service improvement, which can include model training, unless an effective opt-out applies. This may involve processing outside the region used for the request. We do not promise that AWS retains no copies or that an opt-out is active. See AWS's AI services opt-out information at https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html and its Service Terms at https://aws.amazon.com/service-terms/.

Profile names are checked separately using local rules and, when enabled, an external text-moderation provider such as OpenAI. Authorized moderators may review flagged content and appeals. You can ask for review of an image decision through the available review/reporting controls or by contacting contact@filmshuffle.app.

Automated systems may also help identify spam, unsafe content, security events, or manipulation. FilmShuffle does not promise that automated systems will identify every violation or avoid every mistake. Moderation actions may be reviewed by a person where our process provides for review.

7. Legal bases for processing

Where data-protection law requires a legal basis, FilmShuffle relies on one or more of the following:

• Contract: processing necessary to provide the Service you requested and administer your account.
• Legitimate interests: operating, securing, improving, and protecting FilmShuffle; preventing abuse; supporting users; and understanding service performance, balanced against your rights.
• Consent: optional marketing, certain browser technologies, or other processing where we ask for consent. You may withdraw consent prospectively.
• Legal obligation: processing needed to comply with law, lawful requests, tax, accounting, safety, consumer-protection, or rights-enforcement duties.
• Vital or substantial public interests: limited processing reasonably necessary to address an apparent emergency, exploitation, or serious threat where recognized by applicable law.

8. How we disclose personal information

8.1 According to your visibility and sharing choices

We disclose profile and User Content to other people according to the visibility option or sharing link you choose. Public content may be available to anyone. Friends content may be available to accepted friends. Private content is not intentionally published to other users.

Ranked and Tier lists are available to their owners and accepted friends. Lists that were already Private, and imported custom lists, remain visible only to their owners until the owner chooses to make each list available to friends. Safety or legal restrictions can further limit access. Sharing an exported list image outside FilmShuffle is a separate action.

8.2 Service providers

We disclose information to vendors that help host, authenticate, store, deliver, secure, moderate, support, email, analyze, or operate FilmShuffle. Depending on enabled features, providers may include:

• Supabase for authentication, database, and file storage;
• hosting, edge-network, deployment, and operational providers;
• TMDB for film data and images;
• Google, Microsoft, or Apple when you choose an available sign-in service;
• AWS Rekognition for the image-safety processing described in Section 6;
• AWS S3 for restricted recovery copies of database information and uploaded files, separate from Rekognition safety processing;
• OpenAI when external text moderation is enabled;
• YouTube/Google for video playback you choose to load, as described in Section 15;
• Resend for authentication, account, support, legal and safety emails, including recipient addresses, message content, one-time confirmation or recovery links where needed, message identifiers, and delivery or failure information;
• Stripe/Link for the purchase, billing, tax, refund and transaction-support processing described in Section 3.10; and
• professional advisers or vendors supporting legal, accounting, security, or compliance work.

Service providers process information under the applicable agreements and law. Some providers also act independently for specified purposes, including the merchant-of-record service and third-party services you choose to use. Their privacy notices explain that independent processing. AWS service-improvement processing is described in Section 6.

FilmShuffle does not enable open or click tracking for its Resend legal and safety messages. Delivery status helps us retry or investigate failed notices; provider acceptance alone does not confirm that a person received or read an email.

8.3 Other users and Club administrators

Other users may receive information needed for friendships, comments, reactions, Clubs, suggestions, votes, reports, and other community interactions. Club hosts may have tools to manage membership and Club content but do not receive unrestricted access to private account information.

8.4 Legal, safety, and rights-protection disclosures

We may preserve or disclose information when we reasonably believe it is necessary to:

• comply with law, regulation, legal process, or a valid government request;
• protect a person from death, serious injury, exploitation, or other substantial harm;
• detect, investigate, or prevent fraud, abuse, security incidents, or illegal activity;
• enforce our agreements and policies;
• respond to copyright, privacy, intimate-image, or other rights claims; or
• protect FilmShuffle, users, or the public.

Copyright counter-notices may be forwarded to the person who submitted the original notice, as described in the Copyright and DMCA Policy. Apparent online child sexual exploitation may be reported to the National Center for Missing & Exploited Children and law enforcement as required or permitted by law.

8.5 Business transactions

Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or transfer of the Service. A recipient must honor applicable legal obligations and the privacy commitments that continue to apply.

8.6 With your direction or consent

We may disclose information when you direct us to, use a feature that requires the disclosure, or give consent.

8.7 Aggregate and de-identified information

We may disclose information that is reasonably aggregated or de-identified so it does not identify you. We will not attempt to re-identify it except for security, quality control, or as permitted by law.

9. Sale, targeted advertising, and tracking choices

FilmShuffle does not currently sell personal information and does not currently share personal information for cross-context behavioral or targeted advertising as those terms are defined by applicable U.S. state privacy laws. FilmShuffle does not currently operate an advertising network or use a third-party audience analytics tracker. Third-party processing associated with user-requested YouTube playback is described separately in Sections 4 and 15; this statement is not a claim that those third-party services never process information for their own purposes.

Because those practices are not currently used, a browser-based opt-out preference signal such as Global Privacy Control does not presently change advertising or sale activity on FilmShuffle. If FilmShuffle begins a practice that is legally treated as a sale, targeted advertising, or sharing for cross-context behavioral advertising, we will update this Policy and provide required opt-out methods before or when the practice begins.

10. Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account and content history, supporting user-directed sharing, meeting legal obligations, resolving disputes, preventing abuse, and enforcing agreements.

Retention depends on the type of information:

• account and User Content generally remain until you delete them or your account;
• public share links may remain until revoked or the underlying content is deleted;
• import receipts, ranking history, and technical state may remain while needed to support undo, integrity, duplicate detection, and product operation;
• invitation links generally remain while the inviter account remains active and the link is needed for attribution or abuse prevention;
• successful-invitation credit timestamps may remain for the inviter's permanent achievement history after the invited account is deleted, but the deleted account's identifier is removed from that record;
• support, reports, moderation, security, and legal records may remain after account or content deletion when reasonably necessary for safety, compliance, disputes, or enforcement;
• legal-acceptance records may be retained to document agreement;
• payment, subscription, gift, and tax records may be retained for legally required periods and to administer access, disputes, and fraud prevention;
• purchase-authorization evidence, including the offer and terms accepted, authorization time, selected plan and price, and related checkout or termination records, is retained for at least three years after authorization or, where applicable, one year after the subscription ends, whichever is later. Legal holds or another applicable requirement may require longer retention; these limited records are not erased automatically when an account is deleted;
• temporary security and rate-limit records may expire on shorter schedules; and
• restricted recovery copies may remain after deletion from the live Service. We review recovery retention and applicable deletion or preservation requirements; retained copies must not be used to restore deleted content or withdrawn marketing choices to active use.

Deletion from active systems may not remove information immediately from every backup or provider log. We may de-identify or detach retained records from your account when the identity is no longer needed. We may retain information longer when required by law, subject to a preservation request, or reasonably needed to address fraud, safety, or legal claims.

11. Account export and deletion

11.1 Export

FilmShuffle provides a downloadable core account export that may include account and profile information, Favorites, ratings, Film Logs, reviews, watchlist, custom lists, Film Sets, imported ratings or history, trivia information, public-review sharing records, invitation-attribution and successful-invitation credit timestamps and counts, and referenced movie metadata. The automated export does not disclose private invitation tokens or the identity of another person associated with an invitation.

The automated export is not necessarily a complete copy of every record FilmShuffle processes. It may not include uploaded files, social relationships, comments, reactions, Clubs, Tier data, detailed ranking state, legal acceptances, safety reports, support records, moderation records, provider logs, or operational records. You may contact us to request access rights provided by applicable law.

11.2 Account deletion

You may delete your account through account settings after confirmation and reauthentication. Deletion is immediate and generally irreversible once completed. It is intended to remove your account, owned content, and user-prefixed uploaded files from active systems.

Some information may remain in restricted recovery copies pending their deletion, or be retained or de-identified when necessary for legal, security, fraud-prevention, support, reporting, moderation, billing, dispute, or compliance purposes. Content independently created or retained by another user may remain. For subscriptions managed through FilmShuffle's current Stripe/Link integration, completing account deletion cancels future renewal and may immediately end paid access, as described in the Terms. Signing out, uninstalling an application, or removing a shortcut does not delete your account or cancel a subscription.

12. Your privacy rights

Depending on where you live and whether a law applies to FilmShuffle, you may have rights to:

• confirm whether we process your personal information;
• access or receive a copy of personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain portable information in a usable format;
• object to or restrict certain processing;
• withdraw consent for future processing;
• opt out of marketing;
• opt out of a sale, targeted advertising, or certain profiling if FilmShuffle begins those practices;
• appeal our denial of a privacy request; and
• complain to a privacy or data-protection authority.

Submit a request to contact@filmshuffle.app with the subject “Privacy Request.” Describe the right you wish to exercise and identify the account or information involved. We may ask for information reasonably necessary to verify your identity, authority, and jurisdiction. An authorized agent may submit a request where permitted by law, but we may require proof of authority and direct verification with the individual.

We will not discriminate against you for exercising a privacy right. Rights are subject to exceptions, and we may deny or limit a request where permitted by law. If we deny a request, you may appeal by replying or emailing contact@filmshuffle.app with the subject “Privacy Appeal.”

You can unsubscribe from marketing by using the link in the message. We may still send necessary transactional, security, legal, or account communications.

13. International processing

FilmShuffle is based in the United States. Personal information may be processed in the United States and other countries where FilmShuffle or its providers operate. Those countries may have different privacy laws than your country.

Where required, FilmShuffle will use an available lawful mechanism or contractual protection for international transfers. The Service may not be offered in every jurisdiction, and FilmShuffle may restrict features or registration while establishing required local compliance arrangements.

If the European Economic Area or United Kingdom data-protection laws apply to our processing, you may have the rights described above and may complain to the supervisory authority in your country. FilmShuffle will identify any legally required local representative in this Policy before intentionally offering the Service in a manner that requires such a representative.

14. Security

FilmShuffle uses administrative, technical, and organizational measures designed to protect information, including access controls, encrypted network transport, security headers, private file storage for certain uploads, reauthentication for sensitive account actions, moderation controls, and abuse-prevention measures.

No system can guarantee absolute security. You are responsible for using a strong unique password, protecting your email account and devices, signing out of shared devices, and promptly reporting suspected compromise.

15. Third-party services and links

Third-party services may collect information directly from you or receive information needed to perform an integration. Their privacy policies govern their independent processing. FilmShuffle is not responsible for a third party’s privacy or security practices.

TMDB poster and profile images may load from TMDB infrastructure, which receives ordinary request information such as IP address and browser or application request headers. Google, Microsoft, or Apple receives information when you select an available sign-in option. Stripe receives billing information when you use its checkout or account-management features.

YouTube videos: FilmShuffle displays static preview images through its own image service, which fetches them from YouTube on the server. Your browser or FilmShuffle application requests these previews from FilmShuffle, not directly from YouTube. The embedded player initially loads only after you choose Play. A short notice and Privacy link on each card point to this explanation before playback. Requested playback uses YouTube's standard embedded player, including an embedded web view in the iOS and Android applications. Google then receives playback and device/request information and may use cookies or similar storage, associate activity with a signed-in Google account, or process it for its own purposes under Google's Privacy Policy: https://policies.google.com/privacy. On the website, your choice is held for the current video page rather than saved as a playback preference for future visits. When that page is unloaded, its player unloads too. In the iOS and Android applications and their browser-based version, leaving the video screen or moving the application into the background unloads its embedded player and clears the Play choice, even when navigation retains the screen. Choose Play again when you return. You can also pause playback using YouTube's player controls. Unloading a player does not erase information Google already received or remove cookies it already set. The separate Open on YouTube link takes you to Google's service. FilmShuffle does not award Rings for watching YouTube videos and does not use this player to collect watch-time achievement records.

Requested YouTube playback may also load Google's advertising services. Choosing not to load a video leaves the embedded player off and does not prevent use of other FilmShuffle features.

16. Changes to this Policy

We may update this Policy to reflect changes in the Service, law, technology, or our practices. We will post the updated version and change the effective date. We will provide additional notice or obtain consent where required for a material change.

We will not rely on a general statement about future features to begin a materially different use of previously collected personal information without providing notice and any choice required by law.

17. Contact us

FilmShuffle LLC\ 160 South 150 East\ Valparaiso, IN 46383\ United States

Email: contact@filmshuffle.app\ Phone: (219) 255-8072

For privacy requests, use the subject “Privacy Request.”\ For a privacy appeal, use the subject “Privacy Appeal.”