Privacy Policy

MediaTracker is an EU-hosted service. We collect only what the product needs to work: your account identity (from Apple or Google sign-in), the media you track, and the people you connect with. Private notes and private source links are end-to-end protected — they are encrypted at rest and decrypted only in your browser.

If you tell us your country — by choosing it in Settings, or through the App Store country of the iPhone app — we use it only to show release dates, times and age ratings where you are. It is never shown to anyone else, is included in your data export, and is deleted with your account. The web app never works it out from your browser or your connection.

We use no third-party analytics, no advertising trackers, and only essential cookies (keeping you signed in, and remembering a language you choose). You can export all of your data or delete your account — entirely — from Settings at any time.

If you choose a language in Settings, this browser keeps your choice in a cookie, mt_lang, so that our server can show you every page in that language. It holds only the language — for example “de” — and nothing about your account. It is set only when you choose a language, lasts one year, and is removed when you go back to following your browser's language.

Your display name is shown to people you are friends with, to people you share a watch group with, to anyone you send a friend request to, and to anyone who opens an invite link you created and is signed in. Nothing else about you is shown with it — not your email address, not which providers you signed in with, not your plan, and not the name Apple or Google gave us when you signed up.

Your name is not searchable, is not listed in any directory, and is not shown on any public profile. There is no way to look someone up by name. Connections happen only through a link one of you chose to send. An invite link shows nothing about the person who sent it until you sign in.

Nothing about your library, ratings, notes or watch history reaches another person unless you switch on a specific sharing setting, and every one of those is off until you do. A list you publish a share link for is the exception you asked for: it names you as its author.

A title you suggest to a friend reaches that friend with your name on it, and nobody else. What they do with it — save it, pass on it, or never open it — is not told to you, and what you do with a title a friend suggested is never told to them. You choose who can suggest titles to you in Settings.

You may use MediaTracker under a pseudonym. Your display name does not have to be your real name, is not verified, and does not have to be unique. You can change it at any time in Settings.

When you connect a media server, a browser extension or a script of your own, it tells us what you watched: the title and year in its own words, a show's season and episode numbers, the IDs it knows, when and how far it was played, and how long its story is and how much of it was played. We keep those details for 30 days after we decide what to do with a play — about two months from its arrival at most — and after that only the outcome: which title it was and the diary entry it wrote. Your choices of when a play counts as watched and when a film you begin is saved in progress are kept until you change them or delete your account.

A media server also tells us the names of the devices you play on, which you can mark as yours, shared or not yours; we keep them while the server is connected. A Jellyfin or Emby server can tell us the account names of the other people using it. Those names belong to people who may never have signed up here, so we keep at most twenty, and only until you say which account is yours or disconnect the server. Other people's plays are never stored.

We never store your IP address, file paths or pictures from these reports. When a request arrives with a wrong credential, the address it came from is counted for about a minute, so that a leaked link can't be used to guess others, and is not kept.

Only you can see your connected services and the plays they send. A play that is recorded becomes an ordinary diary entry and follows your sharing settings like any other. A film a connected service reports you began, if you turned that on, becomes an ordinary film in progress and no diary entry. Nothing tells anyone else either came from a connected service.

Disconnecting a service stops it at once, on any plan. What it kept — the outcome of each play and the names of its devices — is deleted 30 days later, and until then you can still take back what it recorded. The secret a connection uses is shown to you once and stored only as a scrambled fingerprint we can check it against.

You can change your display name, download everything we hold about you, and delete your account and its data outright — all from Settings, without asking us. Removing a friend, revoking an invite link, cancelling a request or taking back a suggestion withdraws a disclosure that is still in progress.

You can also decline an invite without accepting it, which ends the link and tells the sender nothing, or block the person who sent it, which stops them contacting you again. Blocked people are listed under Friends, and you can rename or clear what your own list calls them — that name is your note, visible only to you, and changing it never reaches them.

You can see and disconnect your connected services, take back what one recorded, and refuse every play from a device that isn't yours — in Settings, on any plan.

The full legal text will be published here before public launch. Questions: [email protected].