Privacy policy
Last updated: October 13, 2026
Cinepisode is a free service with no ads, no trackers and no data reselling. This page explains exactly what is collected, where it is stored and how to delete all of it.
Data controller
private individual, non-professional publisher (identity disclosed to the hosting provider in accordance with Article 6-III-2 of the French law on confidence in the digital economy, LCEN). Contact for any question or request about your data: contact@cinepisode.com.
Without an account
You can use Cinepisode without an account: your list then stays only in your browser (IndexedDB and localStorage) and nothing is sent to our servers. The catalog (search, recommendations) requires an account, because it goes through our server to protect the API keys.
Data processed with an account
| Data | Why | Where |
|---|
| Email address, password (stored only in irreversibly hashed form), account creation and last sign-in dates | Create and secure your account, send you confirmation and password reset emails | Supabase (Auth), region eu-central-1, Frankfurt (EU) |
| Your list: titles, type, status, progress (season/episode), ratings, tags, collections, TMDB identifiers | Sync your list across your devices | Supabase (database), Frankfurt (EU) |
| Your interface language | Send you account emails in your language | Supabase (Auth), Frankfurt (EU) |
| Auto-tracking token (if you generate one) and paired extension devices (only a SHA-256 hash of each device token, device name, browser, system, extension version, dates) | Let the browser extension update your progress | Supabase, Frankfurt (EU) |
| Titles detected by the browser extension (if you use it): title, movie or series, season, episode, date and percentage watched, source | Show them in your private “Detected” tab so you can add them to your list | Supabase, Frankfurt (EU) |
| Catalog usage counters (number of requests per day) | Enforce daily quotas and prevent abuse | Supabase, Frankfurt (EU); deleted automatically after a few days |
| IP address, browser, request timestamps (technical logs) | Security, abuse prevention, troubleshooting | Vercel and Supabase logs, short retention according to their plans |
Legal bases: performance of the service you request by creating an account (Article 6(1)(b) GDPR) and our legitimate interest in securing the service (Article 6(1)(f)) for logs, the CAPTCHA and quotas.
Browser extension “Cinepisode — Auto tracking”
The extension is optional. It sends data only to Cinepisode's server (Supabase, Frankfurt, EU). It works on Netflix from installation. Prime Video, Crunchyroll, Disney+ and Apple TV are off by default: each one is turned on only when you click “Turn on” in the extension, and Chrome then asks your permission for that site only. You can remove that permission at any time (in the extension or in Chrome), and the extension then stops working on that site. It does nothing on any other website.
- Connecting the extension (pairing). When you click “Sign in with Cinepisode” then “Allow this device” on cinepisode.com, the website hands the extension a token unique to this browser, directly (never through a web address or the clipboard). Only cinepisode.com can talk to the extension. Our server stores only a fingerprint (SHA-256 hash) of this token, never the token itself, plus the device name, browser, system, extension version and dates of pairing and last use. You can see and revoke each device on the website; a revoked or uninstalled device can no longer send anything. The older manual token (pasted by hand) still works.
- Live detection, while you watch on a platform you turned on, it reads the title, season, episode and playback position of the video being played. When you have really watched 80% of an episode (or the end credits start; 90% for a movie), it sends the title, type, season and episode to update your progress. If the title isn't in your list, it goes to your “Detected” tab instead.
- History import, only when you click “Import”: for Netflix, Prime Video and Crunchyroll, it reads your viewing history on that platform using the session already open in your browser; for Netflix, it can also read the CSV file you choose. Nothing is read from your history without this click.
- What is sent, for each title and nothing more: the title, movie or series, the last season and episode watched, the date watched, the percentage watched (when known) and where it was detected (platform, file or live).
- Never read or sent: your passwords and cookies on these platforms. Never sent: your account or profile identifiers on these platforms and your profile names. A profile identifier is read in the platform's tab only to request your history from that platform.
- Kept by the extension, in your browser only: your device token, a random device identifier, the last detection, the title currently playing, the status and date of the last import, and the number of new detected titles. Removing the extension deletes them.
- Stored in your account: the detected titles, shown in your private “Detected” tab, visible and editable only by you (Row Level Security), and the list of your paired devices. Pending titles stay until you add, ignore or clear them (“Clear all” deletes every pending title). Titles you have added or ignored are kept with that status, so they are not suggested again. Deleting your account erases all of them.
Servers contacted by the extension: Cinepisode's server (batfulcvvquffgfeppcx.supabase.co, EU), www.netflix.com, and, only for the platforms you turned on, www.crunchyroll.com and static.crunchyroll.com (Crunchyroll), www.primevideo.com and Prime Video's regional servers atv-ps.primevideo.com, atv-ps-eu.primevideo.com and atv-ps-fe.primevideo.com, the Disney+ sites (www.disneyplus.com, disneyplus.com, apps.disneyplus.com) and tv.apple.com. The extension contains no analytics, no advertising and no tracker, and contacts no other server.
Limited Use. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. This data is used only to update your list and fill your “Detected” tab. It is never sold, never used for advertising, profiling or creditworthiness, never shared with third parties, and nobody reads it except with your consent (for example when you ask for support), for security, or when required by law.
Importing your Disney+ or Apple TV data export
Disney+ and Apple TV don't let us read your history directly. Cinepisode can guide you to request a copy of your personal data from them (official links to their privacy portals). The date of your request is remembered in this browser only (local storage), to remind you when the export should be ready. When you drop the file you received, it is read in your browser only: the file is never uploaded, neither to Cinepisode nor to anyone else. Only the titles found are used: they appear in your “Detected” tab and are matched against your list and the TMDB catalog (title searches through our server, as for any search). Nothing is added to your list until you click “Add selection”.
Feedback sent with “Send feedback”
The “Send feedback” form (app menu and home page footer) is optional and works with or without an account.
- What is stored: the feedback type (idea, bug, other), your message, the email address you give for a reply (optional, can be cleared before sending), the page you write from, the interface language, your browser and system in a short form (for example “Chrome 154 · Android”), the site version, the date, and your profile if you are signed in.
- Why: to reply to you if you wish, to understand and fix bugs, and to improve Cinepisode. Legal basis: your request and our legitimate interest in improving the service (Article 6(1)(f) GDPR).
- Abuse prevention: your IP address is never stored. The server computes an encrypted fingerprint of it, which changes every day, only to limit the number of submissions; it is erased after 2 days.
- Where: in our Supabase database (Frankfurt, EU), unreadable by other users. A copy is emailed to contact@cinepisode.com (via Resend, then ImprovMX and the publisher's Gmail mailbox, see below). Nobody else has access; nothing is sold or used for advertising.
- How long: 24 months at most, then automatic deletion. You can ask at any time for a message to be deleted by writing to contact@cinepisode.com; deleting your account also erases feedback sent while signed in.
Storage in your browser
Cinepisode uses no advertising or audience-measurement cookies. Your browser keeps your list (IndexedDB), your settings, your language and your sign-in session (localStorage). These are strictly necessary for the service to work and therefore don't require consent. You can delete them from your browser settings or when you delete your account.
Hosting and subprocessors
- Vercel Inc. (United States) hosts the website and the server functions, which run in Frankfurt (fra1). Transfers are covered by the EU–US Data Privacy Framework and the standard contractual clauses.
- Supabase Inc. provides authentication and the database, hosted in Frankfurt (EU).
- Resend (Resend, Inc., United States), the service that sends account emails and feedback notifications: receives your address and the content of these emails, only to send them.
- Forwarding of the contact address (ImprovMX, then the publisher's Gmail mailbox): if you write to contact@cinepisode.com or send feedback, your message and your address pass through these services.
- Cloudflare Turnstile (if enabled): anti-bot check loaded only on the sign-up, sign-in and forgotten-password forms. Cloudflare then receives your IP address and technical information about your browser. Turnstile doesn't use advertising tracking cookies.
Movie and series data sources
- TMDB and OMDb: queried by our server. They receive neither your IP address, nor your email, nor your list: only the request (for example a movie identifier) and its language.
- TMDB posters (image.tmdb.org), Kitsu and TVmaze: loaded directly by your browser, so these services see your IP address (as with any image or web resource), but no account data.
Retention periods
- Detected titles: pending ones until you add, ignore or clear them; added or ignored ones as long as your account exists.
- Account and list: as long as your account exists. Deleting your account immediately and permanently erases this data from our database.
- Quota counters: a few days.
- Feedback sent with “Send feedback”: 24 months at most (IP fingerprint: 2 days), or less on request.
- Technical logs: according to the periods applied by Vercel and Supabase (from a few hours to a few days).
Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection. Directly in the app (Account menu):
- Export my data: downloads a JSON file with your account, your whole list and your detected titles;
- Change email address or password;
- Delete my account: erases your account, your synced list, your detected titles, your counters and your tracking token.
For any other request, including deleting feedback you sent: contact@cinepisode.com. You can also lodge a complaint with the French data protection authority, the CNIL, or with the supervisory authority of your country of residence.
Minimum age
The service is intended for people aged 15 and over. Under that age, a parent's consent is required.
Security
Encrypted connections (HTTPS), passwords of at least 12 characters checked against known breaches, strict isolation of each account's data in the database (Row Level Security), API keys kept on the server only, strict content security policy.