Privacy

What you give us

• Your account. An email address and password — or, if you sign in with Apple or Google, the email they share with us — plus a username and display name. Optionally a bio, a profile photo and a banner.
• Your date of birth. Asked once at sign-up to confirm you're 13 or older. It's never shown on your profile or to other users, and it isn't used for advertising.
• A phone number, only if you add one. It's used for account recovery and two-factor codes, and is never shown on your profile or given to anyone else.
• What you post. Ratings, reviews (text, photos and voice notes), diary entries, lists, comments, community posts, direct messages and reactions.
• Who you follow, which communities you join, and anyone you block.
• Ratings you import from a Letterboxd, IMDb or Goodreads export, if you choose to.

What we collect as you use it

• Product analytics — which screens get used and which features get tapped, so we know what to fix. Tied to your account id, not sold, not used for advertising. It may include a rough location — a country or city — worked out from your IP address.
• Crash and error reports when something breaks, including the device type and what the app was doing.
• A push token if you turn on notifications, so we can send them to your device.
• Standard server logs — IP address, time and the page or endpoint requested. We use these for security and abuse prevention and keep them for a short period.

Your taste profile — the genres and eras you rate highly, who your taste twins are — is worked out from your own ratings. It powers recommendations and nothing else.

Who else is involved

These are the services EverRated runs on. Each one only receives what it needs to do its job.

• Supabase — accounts, database and file storage (your photos and voice notes live here).
• Railway — hosting for the website and API.
• Expo — push notifications and app updates.
• PostHog (analytics) and Sentry (crash reports).
• Twilio — only if you verify a phone number, to send the code.
• KLIPY — the GIF picker. Searching for a GIF sends your search term and an anonymous per-user id to KLIPY; it never sees your account, your messages or who you sent a GIF to.
• Catalogue providers — TMDB, IGDB, Hardcover, Open Library, Apple Music, MusicBrainz, Deezer and TVmaze supply posters, cast lists and release dates. They receive our lookups, never anything about you.
• Automated moderation — reviews, comments and community posts are checked against our own list of hate terms and for spam links, on our servers. Nothing is sent to an outside or AI service to do this, and direct messages aren't screened. We don't moderate swearing.

We don't sell personal data, and we don't share it for advertising. We only hand data to anyone else if the law actually requires it.

What other people can see

Your profile, ratings, reviews, lists and public community posts are visible to anyone. Direct messages are visible to the people in the conversation — and to us only when someone reports one. Your email address, phone number and which titles you've blocked or hidden are never shown to other users.

Some things are yours to control in Settings: who can message you, whether your comments appear on your profile, and what you get notified about.

Getting it back, or getting rid of it

• Export. Settings → Your data gives you everything you've written as CSV or JSON.
• Delete. Settings → Account deletes your account and your content. Communities you own are handed over or closed. This is permanent. Full steps, including if you can't sign in.
• Correct. Edit anything you've posted, any time.

Depending on where you live you may also have the right to object to processing or to ask for a copy of your data in a portable form — the export covers this, and you can always email us.

How long we keep things

Your content stays until you delete it or close your account. Deleted content goes for good, apart from records we have to keep briefly for safety — for example a moderation log of a removed post, so a banned account can't simply come back. Server logs are short-lived.

Age

EverRated is for people aged 13 and over, which is why sign-up asks for your date of birth. If we learn an account belongs to someone younger, we'll remove it.

Changes, and how to reach us

If this policy changes in a way that matters, we'll say so in the app rather than quietly editing this page. Questions, or anything you want removed: info@hivellc.net.