Privacy Policy

Last updated: 16 October 2026 · CINECLUB is currently free.

This page explains what information CINECLUB handles, why it handles it, and what you can ask me to do about it. If anything here is unclear, contact hello@thecineclub.co.uk.

Who runs CINECLUB

CINECLUB is operated by Lewis Fowler, trading as CINECLUB. I am the data controller for the information described below, under the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies.

• Email: hello@thecineclub.co.uk
• Postal address: Clyde Offices, 48 West George Street, Glasgow, G2 1BP

Information collected

Information you provide

• A display name you choose. A real name is not required. I also generate a random per-browser member ID so the app can recognise you inside a club.
• An email address, if you save your account or give me a reply address with feedback. You can use CINECLUB as a guest without an email address.
• A password, if you choose to set one. Your browser sends it securely to Supabase Auth, which stores a password hash rather than the readable password. Hashing helps protect passwords, but stolen hashes can still be attacked, especially for weak or reused passwords.
• Two-step sign-in, if you enable it. Supabase Auth holds your enrolled authenticator details and checks the codes you enter. During setup, your browser displays a QR code and setup key for your chosen authenticator app. This is used to protect your sign-in, separately from usage statistics.
• A Google account, if you choose to sign in with Google. I then receive your Google account identifier and the email address on that account. The provider may also supply basic profile information for the sign-in.
• An Apple account, if I offer sign in with Apple and you choose it. Sign in with Apple is not offered at the moment. When it is, I receive an Apple account identifier and the email address Apple provides, which may be a private relay address.
• Feedback you send me. The message text, the category you pick, your display name, your member ID, which club you were in, which tab was open, your theme and light or dark mode setting, plus an optional reply email. A report also includes, for each post it concerns, the post's reference, its author's display name and a short quote (up to five posts when you report a whole conversation from its Report link).
• Private replies. New feedback and reports open a conversation linked to your account or guest sign-in. I store its messages, category, sender role and dates. Only you and the service owner can read it. No email is required for in-app replies; guests must retain the same browser session to return. Clearing browser data or losing that session can remove access. You can contact me by email instead.
• Ideas-board posts and votes. Feature ideas and bug reports you post, their titles, details and type are held privately for owner review. If approved, the post, development status and vote totals are visible to other members. I keep the review decision and time privately. I store your account or guest identity privately with posts and votes to limit abuse and one vote per post. Your identity and individual vote are not shown on the board.

Information created as you use the app

• Your film-club activity. Clubs you create or join, films you add, spin results, votes, whether you marked a film watched, your half-star ratings, your written reviews, discussion comments, replies, emoji reactions and club chat messages. I also keep your "can't watch this week" passes and away dates, your Movie Night answers, films you mark as already seen, late-review requests and their outcome, deadline proposals and votes, and the streaks and achievements the app works out from that activity, including the calendar date you confirm a film as watched. Streaming corrections can be shared with other clubs using the same film.
• A watchlist file you import (for example from Letterboxd or IMDb) is read in your browser and is not uploaded. Only the films you choose to add are saved to your club, with your name as the member who added them.
• Start-up error reports. If the app fails to start, you can choose to send the technical details shown on the error screen and the page path, without its query text. Check the details before sending: error descriptions can contain information from the failure. It is stored with feedback and triggers the generic owner alert.
• Your ideas-board votes. I record your account or guest identity against each idea you vote for, so you can add or remove one vote per idea. Other members see only the total and whether they voted themselves; they cannot see your identity or individual vote record.
• Your streaming preferences. The streaming services and country/region you choose, shared with your club and used to show who in your club can watch a given film.
• Your film-content preference. If you save an account, I store whether you enabled incidental mature film data on the CINECLUB website, together with the confirmation time. The installed app reads this account setting; it cannot change it.
• Membership records. When you joined a club, and if you left or were removed, when that happened and who did it. A club keeps this so it can show its own history and stop a removed member rejoining with the same code.
• Your blocking choices. I store which members you have chosen to hide in each club. Other members cannot read your block list. Authorised service administration can access it where necessary. Blocking hides their posts from your view; it does not remove their club access. Where the ideas board offers author blocking, I also store those choices privately. You can clear them on the board. If a blocked author deletes their account, I keep the references to their retained posts so those posts stay hidden. Your own account deletion removes your list.
• Push notification details, if you opt in. While waiting to join, you can choose just an acceptance alert or ongoing club notifications after approval. Your browser generates a subscription that contains a delivery address for your device plus two encryption keys. These are stored privately and are not visible to other members. Your notification choices (which kinds you get, quiet hours and your device's time zone) are stored privately with your account.

Browser storage

• Your browser keeps local copies of: your display name, member ID and the clubs you have opened; your sign-in session for this device and the email you used to sign in; your settings (theme, light or dark mode, language, picker choice, clock, reduced motion, opening club, sound, haptics, country or region, streaming services and whether packs use club streaming choices); a copy of your clubs' recent data so the app loads fast and works offline; your usage-statistics choice; and small records such as tips you have dismissed, emoji you used recently and a counter that rate-limits feedback sending. Some of these details also appear in your club or feedback records. Clearing browser storage removes the local copies; it does not erase server records.
• When you choose films from a shared wheel, this tab temporarily keeps that selection while you open your club. It expires after one hour or is removed when added or dismissed. Shared links contain the selected film list and wheel name; anyone with the link can preview them.

I do not collect payment details or precise location, and I do not run advertising or track you across other websites.

Usage statistics

I measure overall use to improve CINECLUB. The app counts fixed actions such as opening the app, creating a club, viewing a section, adding or rating a film and finishing a round. It sends a small batch of counts to my Cloudflare server about every 30 seconds while active, or when you leave the page. The server adds them immediately to service-wide daily totals; it does not store individual submissions as analytics records.

• No individual activity history. These submissions contain no account, member, club or visitor identifier, page address, referring site, film title, message, error description, screen size or language. I do not record screens or link visits together.
• Daily totals. My server sends totals to PostHog, my statistics provider in Frankfurt, Germany, after the day ends. Small nonzero feature counts below five are withheld. Separate server calculations use the account and club records needed to run the service to count clubs, accounts created, completed rounds, films waiting in club lists, linked sign-in methods, and accounts and clubs participating during the past seven days. Participation means recorded club actions, rather than simply opening the app. Only dates and overall numbers go to PostHog, without account or club identifiers, film titles, messages or reviews. These calculations do not create an individual browsing history.
• Theme and picker choices. To prioritise design, accessibility checks and maintenance, I count accounts that report each theme and the wheel or film strip during a UTC day. This separate request uses your existing sign-in token to verify the account, including a guest account, on my server. It does not send the token to PostHog. A randomly keyed daily account reference prevents counting the same account twice. Only its latest reported theme and picker are kept for that day, without a change history. Different devices use the last choice received. At day-end the server combines the choices and deletes the daily references and key before sending totals to PostHog. Cleanup can be delayed by service failures. Cloudflare recovery copies can retain earlier daily records for a further 30 days. Small nonzero counts below five are withheld. These are reporting accounts, not a count of all people or everyone with a saved preference.
• How to turn browser statistics off. Switch off Settings > Privacy > Usage statistics. This clears unsent counts and saves your choice on that device. Global Privacy Control and Do Not Track signals also stop these browser submissions and preference reports. When possible, the app also removes the current account's preference contribution for the current day; failed removal waits for day-end cleanup. Already combined totals are not individually reversible. The switch does not remove club records needed to provide the service or stop the separate overall account, club, participation sign-in-method, waiting-film and completed-round calculations.
• Connection information. Cloudflare receives technical connection data, including your IP address, when serving requests and preventing abuse. My counter does not forward it to PostHog or use it to create visitor histories.
• Earlier analytics. Before this change, PostHog received account-linked events. Changing collection does not erase those earlier records. Contact hello@thecineclub.co.uk for access or deletion of any remaining records.

I do not use statistics for advertising, sell them, or make decisions about individual members from them. Counts are approximate: privacy choices, interrupted connections and abuse can affect them.

Newsletter

The CINECLUB newsletter is separate from the app. I send it only to people who ask for it on the newsletter page, by ticking an unticked consent box. I then email a link, and the newsletter starts only after you click it.

• What I collect. Your email address, the date you signed up and confirmed, and which emails were delivered, opened or clicked, so I can see what is useful and stop sending to addresses that fail.
• Who sends it. When you sign up, your browser sends your address directly to Loops (Astrodon Corporation, United States), which stores the list and sends the emails for me.
• How to stop it. Click the unsubscribe link in any newsletter, or email hello@thecineclub.co.uk. Unsubscribing does not affect your CINECLUB account.

Purposes and lawful bases

• Running your film club. Lawful basis: performance of a contract with you (UK GDPR Article 6(1)(b)). Without this data the app cannot work.
• Keeping the app secure and preventing abuse. Lawful basis: my legitimate interests (Article 6(1)(f)) in protecting members and the service.
• Reviewing and acting on reports and feedback. Lawful basis: my legitimate interests in keeping content lawful and the app working, and my legal obligations under the Online Safety Act 2023 where applicable. For EU GDPR processing, I rely on legitimate interests in responding to reports and protecting members, unless an applicable EU or Member State legal duty provides the basis.
• Running the ideas board. Lawful basis: my legitimate interests in improving the app with member input. New feature ideas and bug reports stay private until the owner approves them for publication. The owner may change their development status or withdraw them. Private feedback and safety reports are never published automatically. I use account or guest identities to limit posting and voting.
• Sending push notifications. Lawful basis: your consent (Article 6(1)(a)). A one-off acceptance alert does not enrol you in ongoing reminders. You can withdraw consent in your browser's site settings, cancel a pending request, or switch off club notifications in Account.
• Sending sign-in links and account emails. Lawful basis: performance of a contract with you. These emails never carry marketing.
• Sending the newsletter. Lawful basis: your consent (Article 6(1)(a)), which the Privacy and Electronic Communications Regulations also require for marketing email. You can withdraw it at any time with the unsubscribe link, and that does not affect earlier sending.
• Aggregate usage statistics. Where personal data is processed in collecting these statistics, my UK GDPR basis is legitimate interests in improving the service (Article 6(1)(f)). Individual analytics submissions are combined into totals rather than retained as visitor histories. I provide information and a free way to object as required when relying on the UK PECR statistical-purposes exception. This is not an exemption for advertising, individual profiling or every kind of analytics.
• Applying your film-content preference. Lawful basis: your consent (Article 6(1)(a)). Mature film data is off by default, and explicit or prohibited material is not displayed.

Service providers

These companies act as my processors, or as independent controllers where stated. I do not sell your data and I do not share it for advertising.

• Supabase. Database and authentication. This is where your club data and account are held.
• Cloudflare. Hosts the website and serves it to your browser, so Cloudflare may log requests, including your IP address, in order to do that. It also runs scheduled reminders and the owner-only generic alert that feedback needs review (that alert contains no feedback content), and stores my encrypted weekly backups (Cloudflare R2).
• Cloudflare Turnstile. Helps protect guest sign-in from automated abuse. Your browser contacts Cloudflare for this check, which processes technical browser and request information. This is a security function, separate from advertising or analytics.
• PostHog. Receives the aggregate statistics described above, on its EU servers (Frankfurt, Germany). It acts as my processor.
• Loops. Holds the newsletter list and sends the newsletter, from the United States. It acts as my processor under its data processing agreement, and uses its own listed subprocessors (for example Amazon Web Services for hosting).
• GitHub. Stores my source code in a private repository. It also runs my automated weekly backup job. The job reads club data into memory and encrypts the export before writing its file. GitHub still processes readable data in memory during that job; the backup file sent to storage is encrypted.
• Email providers. Account messages and correspondence with me pass through the relevant email services. Feedback is saved privately in Supabase; new submissions are no longer copied through EmailJS. Earlier email copies may remain subject to my retention policy.
• Google or Apple. If you use a sign-in provider, that provider processes the sign-in as an independent controller under its own privacy policy.
• Your browser's push service (for example Google, Mozilla, Microsoft or Apple, depending on your browser). It delivers reminder notifications to your device. The message content is encrypted before it leaves me.

Some of these providers operate outside the United Kingdom or European Economic Area (EEA). The applicable safeguards depend on the provider and processing location. Contact me for details of the relevant adequacy decision or contractual safeguards and how to obtain a copy.

Third-party services your browser contacts directly

• The Movie Database (TMDB): film posters, details and where-to-watch data, which uses JustWatch. Film-data API requests go through my Cloudflare Worker. Your browser downloads poster images directly from TMDB, which receives your IP address for those requests. This product uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB.
• YouTube (Google), for trailer preview images and playback. When a preview image loads, your browser contacts Google's image service, which receives your IP address and the requested trailer image. These image requests omit cookies and the referring page. The video player loads only when you press Play. I use YouTube's privacy-enhanced player, but playback still contacts YouTube and is subject to Google's privacy policy.

Cookies and browser storage

CINECLUB sets no advertising cookies and no analytics cookies. Browser storage keeps your sign-in and guest session working, remembers preferences such as your chosen theme and your usage-statistics choice, and caches app files for loading and offline use. I use it to provide these functions, not to track you across websites. Clearing it can sign you out and can make a guest seat harder to recover. Push notifications are separate and require your permission.

Retention

• Join notification details. One-off device records are removed when the acceptance alert is prepared for delivery. Cancelling or declining a pending request removes its unused notification records. Ongoing club subscriptions remain until account deletion or another removal; switching them off stops delivery but keeps the device record for re-enabling.
• Club content (films, ratings, reviews, comments) is kept until the club is reset or deleted. Because a club is shared, content you posted stays visible to that club until then.
• Membership records, including a record that you left or were removed, are kept for as long as the club exists.
• Your account is kept until you ask me to delete it.
• Push subscriptions are kept until you delete your account or remove the device record, so switching reminders off and on again does not need a new browser prompt. I delete a subscription automatically when your browser reports it as expired.
• Feedback, reports and private correspondence are reviewed for deletion after 24 months. I may need to retain information longer for an unresolved complaint, a legal claim or a legal preservation duty.
• Ideas-board votes remain until you remove your vote, the post is removed, or your account or guest identity is deleted. Public posts can remain after account deletion, without the private author link. Contact me if a post you want removed remains visible.
• Aggregate statistics. Unsent browser counts stay only in memory. Cloudflare keeps daily counters until delivery to PostHog, with a 35-day limit if delivery fails while the scheduled cleanup runs. Cloudflare recovery copies can remain for up to a further 30 days. PostHog holds aggregate reports. Earlier account-linked analytics were subject to a stated 12-month limit; contact me for removal of any that remain.
• Newsletter sign-ups are kept until you unsubscribe. A sign-up that is not confirmed is deleted within 3 months. After you unsubscribe, I keep only your address and that you unsubscribed, so I never email you again, unless you ask me to delete it.
• Backups are encrypted recovery copies. The local downloader keeps the latest 12 weekly backups; this is a file-count limit, not a guaranteed three-month expiry. Older cloud or legacy recovery copies need separate deletion. Account deletion does not immediately erase backup copies. I restrict their use to recovery and reapply erasure requests after a restore.

Deleting your data

You can delete your account yourself, at any time, from Account in the app. You do not need to ask me. A successful deletion takes effect immediately and cannot be undone. If the request fails or its result is unclear, contact me so I can check what completed.

When you delete your account:

• Your sign-in account and its email address are deleted. An email you supplied in a report or correspondence is handled under the separate retention rules above.
• Your ideas-board votes are deleted with your account.
• Your account loses access to every club. A member seat shared with another login can remain for that login; otherwise the turn order closes up behind the removed seat.
• Your reminders stop on every device, and the stored delivery details are deleted.
• Your membership display name and account link are removed. Club members may still recognise your activity from its context or from names mentioned in existing content.

You then choose what happens to what you wrote. Because a club is shared, this is a genuine choice rather than a formality, so both options are set out before you decide:

• Keep it as club history. Your ratings, reviews and comments stay in your club, with your name replaced by "Former member".
• Erase what you wrote. Your reviews, comments, replies, chat messages and ideas-board posts are deleted where they are attributable to your deleted identity. Your star ratings remain linked to a former-member record to preserve club statistics. These records are not guaranteed to be anonymous.

These controls do not automatically remove every reference to you from film entries, other people's messages, reports, private correspondence, recovery records or older backups. Account deletion unlinks your sign-in from retained private correspondence and removes your access to it; necessary case records follow the review policy above. If you need remaining personal information removed, contact me so I can assess and complete your request.

Other ways your data goes:

• Leaving a club removes you from its member list.
• Resetting a club erases that club's films, ratings, reviews and comments for everyone. A reset needs every member to agree.
• If you would rather I did it, or you want specific content removed without deleting your account, email hello@thecineclub.co.uk from the address on your account, or tell me your display name and club code. I will respond within the deadline applicable to your request and explain any lawful exception or extension. I may need proportionate information to check your identity.

Your rights

Under applicable UK or EU data protection law you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how I use it, and to receive it in a portable format. Where I rely on consent, you can withdraw it at any time. To use any of these rights, email hello@thecineclub.co.uk. I normally respond within one month. If a lawful extension applies, I will explain it within that period. Requests are normally free.

You can also download a copy of your own data at any time in Settings, under Privacy and data. The file holds your club seats, ratings, reviews, comments, chat messages, films you added, feedback and settings. It does not include other members' posts. Emailing me still works for anything the file does not cover.

Other countries may give you additional rights, including access, correction, deletion, consent withdrawal and an appeal against a refused request. I apply the rights and deadlines that cover your request and do not penalise you for exercising them. For example, covered Canadian access requests normally have a 30-day response period; covered New Zealand access and correction requests normally require a decision within 20 working days. You may also contact your local privacy regulator. A right may have lawful conditions or exceptions.

Complaints

If you are unhappy with how I have handled your personal data, tell me first so I can put it right. Email hello@thecineclub.co.uk with "Data protection complaint" in the subject line.

• I aim to acknowledge your complaint within 5 working days, and will do so within the statutory 30 days.
• I aim to give you a substantive response within 30 days, investigate without undue delay, keep you informed and explain the outcome. If more time is needed, I will explain why.

You can also complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk/make-a-complaint or 0303 123 1113. Complaining to me first does not remove your right to go to the ICO.

Where the EU GDPR applies, you can also complain to a data protection authority in the EEA country where you normally live or work, or where you believe a breach occurred. You do not have to complain to me first. The European Data Protection Board lists these authorities.

Security

Database row-level security limits ordinary members to their own clubs. Authorised service administration and my providers may access data where necessary to operate, secure and support the service; club messages are not end-to-end encrypted. Traffic is encrypted in transit. Push notification content is encrypted before delivery. No service can promise perfect security, but if a breach happens that puts your rights at risk, I will notify the relevant UK or EU data protection authorities where required, without undue delay and, where feasible, within 72 hours of awareness. I will also tell affected people without undue delay where the law requires it. Where another country's breach rules apply, I also follow its reporting thresholds and deadlines.

Children

The current minimum age is 13. If you are under 18, please involve a parent or guardian. Your club's members can read what you share, so avoid posting contact details or private information about yourself or someone else. You can report anything worrying to me using the report control or hello@thecineclub.co.uk, including concerns about a club administrator.

I am assessing the safeguards needed for wider family use. The minimum age in my terms does not verify anyone's age or remove my responsibilities towards children. Tell me if you believe someone under 13 has an account so I can respond appropriately.

Changes

I may update this policy. If I do, I will change the "last updated" date above, and for significant changes I will say so in the app or on this page.