Privacy policy

Troped is run by Luke Carr, an individual based in the United Kingdom. For anything in this policy, email howdy@troped.co.

This policy covers the website at troped.co, the sign-in service at id.troped.co, the API at api.troped.co and the Troped iOS app. They all share one account.

Your account. The email address you sign in with and, if you use Google or Apple, the name they pass along. Each sign-in creates a session record with the IP address and browser or app it came from, so that you can see and end your sessions. Email sign-in codes are stored until they are used or expire ten minutes later.

Your profile. Your username, display name, bio and avatar. Your profile page is public: anyone with the link can see it, and so can search engines.

What you do in groups. The groups you create or join, the films you add, how you rank them, what you mark as watched and the invite links you make. Group members can see all of this. Anyone who opens an invite link sees the group's name and how many members it has.

Logs. Our hosting provider records each request, including the IP address, for a short period so that we can find and fix faults.

We do not run analytics or advertising, and we do not sell or share your information for anyone else's marketing.

We use your information to run the service you signed up for: to keep you signed in, to show your groups to their members, to send you sign-in codes and to keep the service working. Under UK data protection law this is performance of a contract, and for the logs it is our legitimate interest in keeping the service secure.

Troped sets one cookie when you sign in. It holds a reference to your session, is only readable by our server and lasts thirty days. A second, short-lived cookie exists only while a sign-in is in progress. Your theme choice (system, light or dark) is kept in your browser's local storage and never leaves your device.

These are needed for the service to work, so there is no cookie banner. Signing out removes the session cookie.

Cloudflare hosts every part of Troped, stores its data and delivers our emails. Your data is held in Cloudflare's data centres, which may be outside the UK. Cloudflare is bound by its own data processing terms and standard contractual clauses.

TMDB (The Movie Database) provides film titles, posters and details. When you search for a film, the words you type are sent to TMDB. Nothing that identifies you goes with them. This product uses the TMDB API but is not endorsed or certified by TMDB.

Google and Apple handle sign-in only if you choose them. Their own privacy policies cover what they collect when you do.

We do not share your information with anyone else unless the law requires it.

Your account, profile and group activity stay until you ask us to delete them. Sessions expire after thirty days. When the last member leaves a group, the group and everything in it is deleted. Removing a film from a list removes everyone's ranking of it.

You can ask to see the information we hold about you, to have it corrected, or to have your account and everything attached to it deleted. Email howdy@troped.co from the address you signed up with. Deletion normally completes within thirty days.

You can change your display name, bio and avatar at any time in Settings, and end your sign-in sessions at id.troped.co/account.

If you are in the UK and unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Troped is not for children under thirteen. If you learn that someone under thirteen has an account, tell us and we will remove it.

When this policy changes, the date at the top changes with it. If a change affects how we use your information in a way you would not expect, we will tell you by email before it takes effect.