Privacy policy

Last updated: October 8, 2026

Cinepisode is a free service with no ads, no trackers and no data reselling. This page explains exactly what is collected, where it is stored and how to delete all of it.

Data controller

private individual, non-professional publisher (identity disclosed to the hosting provider in accordance with Article 6-III-2 of the French law on confidence in the digital economy, LCEN). Contact for any question or request about your data: contact@cinepisode.com.

Without an account

You can use Cinepisode without an account: your list then stays only in your browser (IndexedDB and localStorage) and nothing is sent to our servers. The catalog (search, recommendations) requires an account, because it goes through our server to protect the API keys.

Data processed with an account

Data	Why	Where
Email address, password (stored only in irreversibly hashed form), account creation and last sign-in dates	Create and secure your account, send you confirmation and password reset emails	Supabase (Auth), region eu-central-1, Frankfurt (EU)
Your list: titles, type, status, progress (season/episode), ratings, tags, collections, TMDB identifiers	Sync your list across your devices	Supabase (database), Frankfurt (EU)
Your interface language	Send you account emails in your language	Supabase (Auth), Frankfurt (EU)
Auto-tracking token (if you generate one)	Let the browser extension or Tautulli/Plex update your progress	Supabase, Frankfurt (EU)
Catalog usage counters (number of requests per day)	Enforce daily quotas and prevent abuse	Supabase, Frankfurt (EU); deleted automatically after a few days
IP address, browser, request timestamps (technical logs)	Security, abuse prevention, troubleshooting	Vercel and Supabase logs, short retention according to their plans

Legal bases: performance of the service you request by creating an account (Article 6(1)(b) GDPR) and our legitimate interest in securing the service (Article 6(1)(f)) for logs, the CAPTCHA and quotas.

Storage in your browser

Cinepisode uses no advertising or audience-measurement cookies. Your browser keeps your list (IndexedDB), your settings, your language and your sign-in session (localStorage). These are strictly necessary for the service to work and therefore don't require consent. You can delete them from your browser settings or when you delete your account.

Hosting and subprocessors

• Vercel Inc. (United States) hosts the website and the server functions, which run in Frankfurt (fra1). Transfers are covered by the EU–US Data Privacy Framework and the standard contractual clauses.
• Supabase Inc. provides authentication and the database, hosted in Frankfurt (EU).
• Resend (Resend, Inc., United States), the service that sends account emails: receives your address and the content of these emails, only to send them.
• Forwarding of the contact address (ImprovMX, then the publisher's Gmail mailbox): if you write to contact@cinepisode.com, your message and your address pass through these services.
• Cloudflare Turnstile (if enabled): anti-bot check loaded only on the sign-up, sign-in and forgotten-password forms. Cloudflare then receives your IP address and technical information about your browser. Turnstile doesn't use advertising tracking cookies.

Movie and series data sources

• TMDB and OMDb: queried by our server. They receive neither your IP address, nor your email, nor your list: only the request (for example a movie identifier) and its language.
• TMDB posters (image.tmdb.org), Kitsu and TVmaze: loaded directly by your browser, so these services see your IP address (as with any image or web resource), but no account data.

Retention periods

• Account and list: as long as your account exists. Deleting your account immediately and permanently erases this data from our database.
• Quota counters: a few days.
• Technical logs: according to the periods applied by Vercel and Supabase (from a few hours to a few days).

Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection. Directly in the app (Account menu):

• Export my data: downloads a JSON file with your account and your whole list;
• Change email address or password;
• Delete my account: erases your account, your synced list, your counters and your tracking token.

For any other request: contact@cinepisode.com. You can also lodge a complaint with the French data protection authority, the CNIL, or with the supervisory authority of your country of residence.

Minimum age

The service is intended for people aged 15 and over. Under that age, a parent's consent is required.

Security

Encrypted connections (HTTPS), passwords of at least 12 characters checked against known breaches, strict isolation of each account's data in the database (Row Level Security), API keys kept on the server only, strict content security policy.