goodrecmovies

movies worth your night.

privacy

goodrecmovies.com is a web app with no ads, no third-party tracking cookies and no cross-site tracking. Most of what you do here stays on your device; the parts that reach our servers, and the one analytics service we use, are listed below, in plain language.

What is stored on your device

Your browser's localStorage keeps, entirely on your device:

  • your watched marks, bookmarks and like/love ratings (before you sign in)
  • your filter and region preferences, theme and language
  • for our own team only: a marker that tags our test visits in analytics, set only by opening a link with ?grm_internal=1

Clearing this site's data in your browser deletes all of it permanently.

Sign-in and synced data

Sign-in is optional and runs through Google. When you sign in, we store on our servers: your Google account ID, your display name, profile picture and email address, and the data you choose to sync — your filter preferences, like/love ratings, watched marks and bookmarks. This is what makes your profile follow you between devices.

If you post reviews or replies, that content is public and shown under your display name. Follows and notifications are stored to run the social features. We do not sell personal data and we run no advertising.

Pro and payments

goodrecmovies Pro is an optional paid plan. Checkout, billing and receipts are handled by our payment processor and merchant of record, Dodo Payments: your card details go to them, never to us. We store the plan state needed to unlock Pro (plan, status, paid-through date, the processor's customer/subscription ids) and a log of the processor's billing notifications.

Upgrade funnel events (first-party)

To learn whether the Pro pages work, our own servers record a few first-party events: a click on a Pro link (and which page it was on), the start of a checkout (plan and the checkout session id), returning from sign-in to finish a checkout, and an abandoned-checkout notice from Dodo Payments. Each event stores the event name, the time, the page it came from, the plan, your account id if you are signed in, or otherwise a random id kept in this browser tab's sessionStorage (gone when the tab closes). No cookies, no IP addresses, no device fingerprints, and these records are not shared with anyone. Funnel events are deleted after 180 days. The same Pro steps are also counted in our product analytics, described next.

Product analytics (PostHog)

To learn which parts of the app help people find something to watch, and whether they come back, we count a short list of events with PostHog, our analytics processor: page views; arriving on the site (the campaign tag in the link, if there is one, and the domain of the site that sent you); opening a title or a ranked list from another page; opening sign-in, and creating an account or signing in; starting and finishing an import (the source, a rough size such as “101–500 rows”, and whether it worked); adding a rating, a bookmark or a watched mark; sharing or copying a link; and viewing Pro pricing or starting a checkout. Events about a title carry its IMDb id.

How it works: events go to our own domain (goodrecmovies.com/reel) and are passed on to PostHog from there, so your browser never loads a script from or talks to a third-party analytics domain. The analytics code keeps a random visitor id and the current session in a first-party cookie and localStorage on goodrecmovies.com (never shared with other sites), so we can tell when the same browser comes back and which page views belong to one visit. Clearing your site data removes them. An approximate location (city and country) is taken from our network provider, Cloudflare, and attached on our server; your IP address is not passed on to PostHog. When you are signed in, events are linked to a pseudonymous id made by one-way hashing your account id, so we can see whether accounts come back after a day, a week or a month. PostHog never receives your name, email address, Google account id, handle, or anything you type. Page addresses are sent without their query string (apart from utm_ campaign tags), and profile and invite links have the name or token removed. For the site that sent you, we record only its origin (for example https://t.co), never the full address. We also record sessions (session replay): a reconstruction of the page layout, scrolling, clicks and page changes during a visit, so we can see where the app is confusing. Everything you type into a field is masked before it leaves your browser and never recorded. With your Do Not Track signals respected, we also count which elements of a page are clicked (the element type and its position on the page — never the text inside it) so we can draw heatmaps, we receive a technical report when something breaks in the app, and PostHog may show you an occasional in-app survey or include you in an A/B test of an app layout. What you type is never captured.

If your browser sends Do Not Track or Global Privacy Control, none of this runs: the analytics code is not loaded, nothing is stored on your device and nothing is sent. The analytics cookie and storage are first-party only and never used for advertising. To have your analytics events deleted, email us (see Your rights below).

Third parties involved

  • IMDb public datasets — titles and rating facts, used under IMDb's non-commercial dataset license (see footer)
  • TMDB — poster images (served from TMDB's CDN) and cast lookups; TMDB sees standard web requests, no personal data from us
  • Wikidata — country-of-origin facts
  • Google — sign-in; Google processes your login under its own privacy policy
  • Dodo Payments — merchant of record for the optional Pro subscription; they receive the name and email you signed up with to process payments. Card details go straight to Dodo and never reach us
  • Oracle Cloud Infrastructure — hosting: the site and its database run on our own server in Oracle's cloud; like any web host, the server keeps short-lived technical request logs
  • Cloudflare — CDN and proxy in front of our server (all traffic passes through it), plus Cloudflare Web Analytics: aggregated page-load and traffic measurement without cookies; like any CDN they keep short-lived technical request logs
  • PostHog — product analytics processor (PostHog Cloud): first-party cookie/localStorage visitor and session id, relayed through our own domain, approximate location from Cloudflare (no IP address passed on), session replay with inputs masked, pseudonymous ids only; details above

Your rights (GDPR)

Device data is yours to clear at any time in your browser. For the data on our servers, email [email protected] and we will export or delete it for you, including your analytics events held by PostHog. If this page changes in a way that matters, we update it here before the change ships.

Contact

Questions? [email protected] — account issues via [email protected], business and press via [email protected]. Also reachable at github.com/0xm0w.