What is stored.

Without an account, nothing leaves your device

Install Cinephile and use it, and no personal data reaches this site at all. Your watchlist, ratings, settings and keys sit on the machine in front of you. The app does ask this site one anonymous question — “is there a newer version?” — which sends no account, no name and nothing about you.

What is never stored, ever

• Your streaming logins. Your Netflix, Prime Video, JioHotstar, YouTube or any other username, password, cookie or session is never sent here and never written down here. You sign in to those inside the app's own browser window, and that stays on your device, exactly as it would in Chrome.
• What you actually watch. Cinephile cannot see your viewing history on any service, does not ask for it and has no way to get it. What it knows is only what you tell it: a title you saved, a title you marked watched, a rating you gave.
• Payment details. Nothing is sold, so none are ever asked for.
• What you do outside the app. No browsing history, no files, no other programs.
• Your data for anyone else. Nothing is sold, rented, shared or used to advertise.

With an account, this and only this

An account exists to keep devices in step. Here is every single thing it holds.

To have an account at all

• E-mail address — so the account has a name and you can sign back in.
• Your name — only if you sign in with Google and it passes one on. It is never required.
• A scrambled form of your password — if you chose a password. The password itself is never stored and cannot be read back, by anyone, including me.
• A Google account identifier — if you signed in that way. It is a meaningless string that lets them recognise you next time. Their passwords are never seen by this site.
• The date you accepted the terms, and which version, because an account cannot exist without that.
• The country code of the account, where known, to show the right availability.

For each app that is signed in

• A device name such as “Windows PC” or “Fire TV”, so you can tell them apart and sign one out.
• Which platform and app version it is running, so updates can be offered and faults understood.
• When it last synced.
• A sign-in token, stored scrambled. The app keeps the real one. A copy of the database is not a set of keys to anybody's account.

The synced data itself — all of it encrypted

Every item below is encrypted before it is written down, and can only be read back by the server handing it to your own signed-in app.

• Your settings — country, display language, which services you use, your language preferences and the app's appearance options. This includes your own TMDB, OMDb and YouTube API keys, so a new device works without you typing them on a remote. They are your keys, they are encrypted, and they are only ever sent back to your own apps. If you would rather they never left your machine, do not sign in — the app works perfectly without an account.
• Your watchlist — the titles you saved, with the name, year and poster reference so the list shows up instantly.
• Saved YouTube videos — the ones you bookmarked in the app.
• Watched and rated — which titles you marked as watched, and whether you said not liked, liked or loved.
• Your tags — the ones you made, and which titles carry them.
• Saved searches and saved filters — the ones you chose to keep.
• Recent searches — the last few, so the TV does not make you type again.
• Surprise me — your filters, and the titles you marked “not for me” so they stop coming back.

In every case the subject is a title — a film or a series — not you. There is no record of when you watched, how long for, or on which service you pressed play.

How much it is being used

• One line per account per day per device type, with a count of syncs. It answers “how many people use Cinephile, and on what”. It holds no titles and nothing about what anyone watched.
• Your IP address is kept with a website sign-in, as a basic protection against abuse.

Where it is kept

On the server that runs hiteshvaghela.com, in a database only this site can reach. The synced data is encrypted with AES-256-GCM before it is written. Connections use HTTPS.

What the app talks to directly

Most of what Cinephile shows comes straight to your device from other people, without passing through this site: TMDB (the catalogue and availability), OMDb (IMDb, Rotten Tomatoes and Metacritic scores), JustWatch (links and audio languages), YouTube (search and trailers) and the public pages of Netflix, Prime Video and JioHotstar (to confirm a title really is there, and in which languages). Those requests come from your machine and are covered by those companies' own privacy policies. This site never sees them.

How long it is kept

Your synced data stays until you change it or delete it. Sign-in codes for TVs are thrown away after half an hour. Delete your account and everything goes at once — the data, the devices and the account itself — with no copy kept.

What you can do about it

• See it — your account page lists everything stored, with its size and when it changed.
• Take it — one button downloads all of it as a readable JSON file.
• Erase it — remove the synced data but keep the account.
• Delete everything — the account and all of it, immediately and for good.
• Sign out everywhere — cut off every device that is signed in.

No e-mail, no waiting and no reason required. The buttons do it themselves.

Cookies

The Cinephile pages on this site set one cookie, to remember that you are signed in while you are using them. It is not used for advertising or for following you anywhere.

Children

Cinephile is not meant for children under 13, and accounts are not knowingly made for them. If one has been, say so and it will be removed.

Changes

If what is stored ever changes, this page changes with it and the version date at the top moves. The current text always lives here.

Getting in touch

Anything about your data, including a request to remove it: use the contact page.

See also the terms of use.