Privacy Policy

Who is responsible

The data controller is Emin Karaman, the private individual who runs Filmdex. In this policy “we” and “us” mean the data controller. Filmdex is not a company and has no employees.

Contact: supportfilmdex@gmail.com. We do not publish a postal address; if you need one for a formal request, ask for it by e-mail.

The short version

• We collect what an account needs: your e-mail address, a password (kept only as a one-way hash), a username, your real name, your date of birth and what you do on Filmdex (the films you collect, your watchlist, ratings, quiz results, badges, friends and recommendations).
• Your profile is private by default. Your real name is shown only to you and to the people you accept as friends; your date of birth and e-mail address are never shown to other users.
• We do not sell your data, show ads or use analytics or advertising cookies.
• Service providers (hosting, database, bot protection, e-mail delivery) process data on our behalf; some of them are based in the United States.
• You can download your data, correct it or delete your account at any time from your profile.

The data we process

Account data

• E-mail address: to sign you in, to send you sign-up and security codes and to contact you about your account.
• Password: we never store it in readable form: while your sign-up waits for its code we keep only a one-way hash of it, and once your account exists our sign-in provider (Supabase) stores only a one-way hash.
• Username: your public handle, chosen at sign-up. When you change it, the old username is kept for 30 days, so that nobody else can take it during that time and links to your old profile address keep working; it is then deleted automatically.
• First and last name: shown only to you and your accepted friends. Their first letters form your initials, which are public: they appear next to your username wherever your profile can be seen.
• Date of birth: used only to check that you are at least 16 years old. It is stored apart from your profile and never shown to anyone.
• Consent record: the version of the Terms of Use and of this Privacy Policy you accepted at sign-up, and when.
• Pending sign-up: when you send the sign-up form, your account is not created yet. The details you entered (e-mail address, username, first and last name, date of birth, the accepted version and when you ticked the boxes) are kept together with a one-way hash of your password, a one-way hash of the 8-digit code we e-mail you, how many codes were sent and tried, and a one-way hash of a random value stored in your browser (so that only the browser that filled in the form can finish the sign-up). The account is created only when you type the right code. A code works for 15 minutes; the pending sign-up is deleted as soon as the account is created, after 5 wrong codes, or automatically a few minutes after the last code expired (at the latest one day after the sign-up).
• Sign-in records kept by our sign-in provider, such as when your account was created, confirmed and last used. The other details you enter at sign-up (username, name, date of birth, accepted version) are removed from the sign-in record as soon as your account is created; from then on they are kept only in the account data described here. Our sign-in provider also keeps a security log of sign-ins, sign-ups, password and e-mail changes and similar events, with the e-mail address and IP address involved; we delete its entries automatically after 30 days.

Profile data

• Bio: the optional text on your profile.
• Avatar: your initials (the default), one of the preset characters, or a photo you upload. An uploaded photo is cropped in your browser, re-encoded on our server as a 256 × 256 pixel WebP image (which removes embedded metadata such as location) and stored with our database provider.
• Visibility: whether your profile is public or private (private by default).

Your activity on Filmdex

• The films in your collection (with your quiz score and the date), your watchlist and your star ratings.
• Quiz attempts: the film, when you started and finished, your answers while the quiz runs, your score and whether you passed. We need them to grade the quiz on our server and to apply the waiting times after unsuccessful attempts.
• The badges you have earned, and your time zone as your browser reports it (for example Europe/Istanbul; UTC until it does), used only to work out the badges that depend on the local time of day, weekends and dates. Other users never see it.
• The member titles you have unlocked (only you can see the full list) and the one you choose to display, which appears on your profile to whoever can see it. Your level is calculated from your quiz scores and badges and is not stored separately.
• Your showcase: up to four of your badges that you choose to show on your profile. It is shown to whoever can see your badges.
• Reports about quiz questions you send from the quiz.
• Technical rate-limit records (an action and a time, linked to your account) that protect the service from abuse.

Friends and recommendations

• Friend requests, friendships and blocks between you and other users. A person you block is not told.
• Recommendations you send or receive: the film, the time and the optional message (up to 280 characters). Only the sender and the receiver can see them.
• Profile stars: you can star other members' profiles, once per profile. The total number of stars is shown on the profile to whoever can see it; who starred a profile is not shown to anyone except the person who gave the star. The stars you gave are part of "Download my data" and are deleted with your account.

Content reports

If you report a profile, a profile photo, a bio, a recommendation message or something else about an account, we store the report: the reported username as it was at that moment, the kind of content (profile, photo, bio, recommendation message or something else) and, for a recommendation message, which recommendation it was, the reason, the details you write (up to 500 characters), the time and the review status. The person you report is not told who reported them.

Technical data and e-mails

When you use Filmdex, your browser sends technical information such as your IP address, your browser type (user agent) and the pages requested. Our hosting provider, our database provider and Cloudflare (for the bot check) process it to deliver the site, keep it secure and investigate errors. We do not use it to build a profile of you.

To slow down floods of requests, our server also counts recent requests per IP address (for example code attempts, e-mails sent and searches) in its working memory for up to an hour. These counters are never written to storage and disappear when the server restarts. For sign-ups, sign-up codes and new sign-up codes, our sign-up function also records the action and its time in the database under a one-way code derived from the e-mail address or the IP address (never the address itself); these rate-limit records are deleted after 3 days.

When you write to us, we process your e-mail and its contents.

Why we use your data and on what legal basis

For users in the European Economic Area (EEA), the legal bases are those of Article 6(1) of the General Data Protection Regulation (GDPR). For users in Türkiye, the corresponding grounds of Article 5 of the Law on the Protection of Personal Data No. 6698 (KVKK) are listed in the KVKK information notice.

Where we rely on legitimate interests, you can object (see Your rights). We do not use your data for advertising, sell it or share it with data brokers.

Grading a quiz, the waiting time after an unsuccessful attempt and rate limits are decided automatically by our software. These decisions only affect what you can do on Filmdex; if you think one was wrong, write to us and we will look at it.

Who can see your information

• Everyone, including visitors who are not signed in, can see a public profile: username, initials, avatar, bio, collection (with quiz scores and star ratings), watchlist and badges. Profiles are private by default, and profile pages ask search engines not to index them.
• Your accepted friends see what a public profile shows, plus your real name and your activity in their friends feed, even when your profile is private.
• Someone you have sent a friend request to sees your username, initials, avatar and bio until they answer, but not your lists or your real name. Sending a request shows you nothing of the other person's private profile beyond the username you typed.
• Your profile photo is stored at an address that cannot be guessed and is shown only to people who can see your profile. Someone who already has that address can still open it after you make your profile private, until you replace or remove the photo; copies can stay in browser and network caches for up to an hour after that.
• No other user sees your e-mail address, date of birth, quiz answers, reports or rate-limit records.
• We, as the operator, can access the database to run the service, handle reports and answer requests.

Service providers

We use the following providers to run Filmdex. They process personal data on our behalf, for the purposes described here.

Two services are contacted by your browser directly and handle what they receive under their own privacy policies:

• TMDB (The Movie Database): posters and backdrops load straight from TMDB's image servers, so TMDB receives your IP address and browser information when you view them. Our server fetches the film details and runs your film searches on TMDB without any personal data: TMDB receives the search words, not who typed them.
• YouTube (Google): a trailer loads from youtube-nocookie.com only after you press Play. From then on Google receives your IP address and browser information and may set cookies under Google's privacy policy.

Transfers outside Türkiye and the EEA

Filmdex is run from Türkiye and its database is in the European Union (Frankfurt). Several of the providers above are based in the United States or operate global networks, so personal data may also be processed outside Türkiye and outside the EEA.

Our providers describe, in their own data processing terms, the safeguards they use for international transfers, such as the European Commission's standard contractual clauses or, where a provider is certified, the EU-U.S. Data Privacy Framework (GDPR Chapter V). These transfers are necessary to provide the service. You can ask us for more information about them, and you can end the processing of your data by these providers at any time by deleting your account.

How long we keep data

We may keep specific data for longer where the law requires it or to establish, exercise or defend legal claims.

Your rights

Depending on where you live, you have some or all of these rights:

• Access and portability: download a copy of your data in a machine-readable format (JSON) from your profile (Settings → Download my data), or ask us by e-mail. The download covers your account; it does not include rate-limit records, our sign-in provider's technical records (such as its security log) or reports other people filed about you. You can ask us about these by e-mail.
• Rectification: correct your username, real name, bio and avatar under Edit profile; ask us for anything else.
• Erasure: delete your account from your profile (Settings → Delete account); your data is then deleted as described above.
• Restriction and objection: ask us to limit or stop processing that is based on our legitimate interests.
• Withdrawing consent: you decide each time whether to play a trailer; nothing else depends on your consent.
• Complaint: you can complain to a data protection authority: in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), in the EEA the authority of the country where you live or work.

Users in Türkiye have the rights listed in Article 11 of the KVKK; the KVKK information notice explains how to apply.

To use a right, write to supportfilmdex@gmail.com, if possible from the e-mail address of your account, so that we can confirm it is you. We answer within one month (30 days for KVKK applications), free of charge.

Minimum age

Filmdex is only for people aged 16 or over. We check the date of birth at sign-up and do not knowingly keep accounts of younger people. If you believe that someone under 16 has an account, tell us and we will delete it.

Security

Connections to Filmdex are encrypted (HTTPS). Passwords are kept only as hashes by our sign-in provider; the sign-in cookie cannot be read by page scripts; database rules ensure that each account can only read and change what it is allowed to; sensitive forms are protected by a bot check; and only the operator has administrative access. No system is completely secure: if a security breach affects your personal data, we will inform you and the authorities where the law requires it.

Cookies and storage in your browser

Filmdex uses only what is strictly necessary: sign-in cookies and a small record of your interface preferences on your device. There are no advertising or analytics cookies. The details are on the Cookies page.

Changes to this policy

If we change this policy, we will publish the new version here with a new version number and date. If a change materially affects how we use your data, we will tell you in advance, by e-mail or on the site, and ask for your consent again where the law requires it.

Contact

Questions about this policy or your data: supportfilmdex@gmail.com. See also the Contact page.