Privacy

• Your sign-in: an email address and password, or a Google or Apple account if you sign in that way. Whichever you pick, that provider confirms who you are — it never sees anything inside your cinema.
• Your profile: display name, optional photo, favourites and badge choices.
• Your cinema's content: titles, watch dates, nights, ratings, reviews and notes.
• Optional cinema venue name and location for films you mark as seen at the cinema (only when you pick one from the search results).
• Optional push-notification subscriptions for the devices you enable them on.
• If your cinema uses Premiere, your plan, how it started, its renewal or expiry date, and payment-provider customer and subscription references.
• Messages you send us, including anything you type and any screenshot you attach.

Premiere payments are processed by Stripe. The card form you fill in inside the app is Stripe's, not ours: Stripe collects that payment information directly, and how Stripe handles it is governed by Stripe's own privacy policy. We don't receive or store your full card number or card security code.

Stripe may set its own cookies in your browser while you check out and collect the standard device and fraud-prevention information that payment providers use. That information is Stripe's to handle under its policy, not ours.

We keep the limited billing information needed to unlock and manage Premiere, including your plan, payment status, renewal or expiry date, and Stripe customer, checkout and subscription references. Stripe may also send us information about trials, cancellations, refunds and failed payments.

What you pay, what happens when you cancel and our refund policy live in the Terms of Service under “Prices and refunds”.

We email you about your own cinema — movie night, what your cinema adds and rates, and replies to messages you send us. This is on to begin with; every email has an unsubscribe link, and Settings → Notifications lets you choose exactly which alerts you get. We never send you marketing, and we never share your address.

Only the two people in your cinema. Nothing you add is public by default. A guest pass link shows a read-only view of your queue, vault and numbers to whoever holds the link — you create those links yourself and can switch them off at any time in Settings.

The outside services below are the ones the app actually talks to, and each one only ever receives the small piece it needs.

Our own usage counts. On our live site we record anonymous, visit-level usage events — which pages and steps get used, like opening the sign-up page — in our own database. Each visit gets a random id that resets when you close the tab. No account, email or IP address is attached, and these records are deleted after 12 months.

Date night calendar emails. If you sign up for our 2027 Date Night Calendar, your first name and email are sent to Kit, our email provider. We use them to send you the calendar, our weekly picks and other marketing emails from Our Cinema, such as news, tips and offers. You can unsubscribe from any email with one click, and we'll stop sending marketing emails. We never sell your email address.

Google Analytics. On our live site, Google Analytics records which pages are visited and a few named steps (like finishing sign-up) so we can see what's working. It uses cookies and sees your device's address and browser, never your ratings, reviews or notes.

Meta (Facebook) Pixel. On our live site, the Facebook Pixel tells Meta which pages are visited and when someone signs up, adds a first film, starts a Premiere trial or buys Premiere (with the price), so we can measure and improve our Facebook and Instagram ads. It uses cookies and sees your device's address and browser. We never send Meta your name, email, ratings or anything you've logged. In the EU, UK, Switzerland and other places where the law asks for consent, it only runs if you tap Allow on the cookie banner. Change your mind anytime with Cookie settings — choosing No thanks stops it straight away.

The Movie Database (TMDB). Title artwork, cast and streaming availability come from TMDB. We send them the titles you search for. Poster images load from TMDB's own servers, so TMDB sees your device's address when a poster appears on your screen — never your name, email or ratings.

Streaming Availability and Wikidata. Title identifiers only, used for overall scores, streaming details and awards. These lookups run from our server, not your browser.

Google Places. When you tag where you saw a film, the venue name you type is sent to Google Places to find the real cinema. Google sees that search text; it doesn't see your account or anything else about you.

Google Fonts. The page's typefaces are served by Google, which sees the address of the device loading them.

Stripe. Your payment details, collected directly. See Payments above.

Google and Apple, for sign-in. If you use Continue with Google or Continue with Apple, that provider confirms your identity and sees the sign-in itself. With Apple you can keep your real email address private and let Apple relay a forwarding address instead.

Trakt (Premiere). Only if you connect it. You grant us read access to your Trakt watch history so we can import the films you've already logged. We never post to your Trakt account, and your Trakt login is never passed through to us.

Your browser's push service. Alerts on an installed app pass through the push service run by your browser or device maker — Google for Chrome and Android, Apple for Safari, Microsoft for Edge, Mozilla for Firefox. They carry an encrypted message and can see when it was delivered, not what it says.

Your own exports. If you import a Letterboxd or IMDb file, we read the copy you already exported. The app doesn't contact Letterboxd or IMDb to do it.

AI suggestions. The Recommender and Yes-or-No wildcard suggestions are generated by a third-party AI model reached through our platform provider. For suggestions we send the titles in your cinema, your star ratings and watch dates, your chosen favourite genres, your top-five list, and the cinema display names you set. We don't send your email address, password, payment details, or the reviews, notes and photos you write or attach — though anything you type to Reel naturally goes along as your question. The AI returns suggestions only; it doesn't learn about you between visits.

The hosting, database, authentication, email delivery and AI routing behind the app are run by our platform provider, under the same terms we're bound to.

Apart from the Google Analytics and Facebook Pixel cookies described above, here's everything the app stores on your device, all of it first-party and there to make the app work (including your cookie choice, with the date you made it):

• Sign-in. A sign-in token, kept by your browser, so you stay signed in between visits instead of typing your password every time.
• Preferences. Small settings in your browser's local storage, on this device only: your theme, the vault's layout choice, which release notes you've already read, your recent searches, where you got to in setup, and how often to stop nudging you about things you've dismissed.
• One small cookie that remembers whether the menu is open or closed.
• Guest passes. Someone who opens your guest link gets an unreadable, encrypted cookie for a year, so their suggestions stay credited to their device inside that cinema. It isn't shared with anyone, and they can clear it.
• Offline copies. If you install the app, your browser keeps a copy of the app itself and the artwork it has already shown you, so it opens when there's no connection.

Clearing site data or browser storage for this site signs you out and resets those preferences. Nothing you've logged in your cinema is lost — that lives on the server.

Everything lives in Settings → Danger zone, and there are three ways out:

• Delete my account. Removes your profile, ratings, reviews, notes, badges, notification devices, messages and your sign-in. It happens immediately and can't be undone. If you own a cinema that still has a partner in it, you choose whether to hand the cinema over to them or delete it as well.
• Delete the cinema. The owner can permanently remove the whole cinema — titles, nights, ratings, reviews, guest links and invites — for both people.
• Leave the cinema. A partner can step out at any time and start fresh with an empty cinema of their own.

We keep your data for as long as your account exists — there's no separate retention clock. When you delete your account or your cinema, the records are removed from the live database straight away; routine encrypted backups held by our hosting provider age out on their normal cycle.

Settings → Get in touch reaches the person who runs this site. Pick the topic that fits — a bug, a question, feedback, or a request about your account and data.

This policy may change as Our Cinema grows. The version in force is the one dated above, and that effective date is the one that applies to you. When we make a material change, we'll surface it in the app (a What's New note or a banner) and update both dates. Keep an eye on Settings → What's New. Continuing to use Our Cinema after a change means you're okay with the updated policy.