The Film Timeline

Privacy

Last updated September 23, 2026

What we collect

• A random sign-in token, stored in a cookie once you first play, rate or save something. It lets your scores and watchlist work before you make an account, and it is not tied to your name or email until you add them. Alongside it we keep the kind of browser or device it was issued to, so a session can be recognised and ended.
• A display name, if you pick one. It is public: it appears on leaderboards, on your profile and next to anything you post.
• An email address, if you sign in with email, Google or Apple (Apple may give us a private relay address instead of your real one). We use it to sign you in and, only if you say yes, to send the daily reminder. It is never shown publicly, never sold and never shared with anyone else.
• What you do here: ratings, game scores, your watchlist, your shelf, posts, comments and likes. Posts, comments and likes are visible to other users; your ratings and scores appear in aggregate and on boards under your display name.
• Pictures you upload for your profile. Uploads are re-encoded, which removes hidden data such as the location a phone stores inside a photo, and each one is checked automatically by an image safety model (Cloudflare Workers AI) before it appears.
• A birthday, if you set one. It places your account in an age group for messaging, is never shown to anyone, and cannot be edited once set; mistakes go through support.
• A notification token and time zone, only in the app and only if you turn on notifications, so the daily reminder reaches your phone in your morning.
• A scrambled form of your network address, used only to limit abuse such as mass signups, sign-in link floods and report spam. It is a keyed one-way hash, so it cannot be turned back into the address, and it is used only for rolling limits measured in hours or days.
• Direct messages you send. The person you message sees them; other users never do. See Messages and safety below for how the site itself treats them.

Messages and safety

Direct messages are stored on our servers and screened automatically for spam and abuse, and messages that trip the screening are delivered folded behind a warning. We do not read conversations as a matter of course, but messages are not private from the site and carry no expectation of privacy: we review them when a message is reported, when something suggests a threat to a user's safety, and when the law requires it, and we cooperate with law enforcement. Abuse directed at minors is reported to the relevant authorities. Deleting a message removes it from the conversation, and deleting your account removes your messages entirely.

What we do not do

• No advertising trackers and no third party ad networks.
• No selling or sharing of personal data.
• No reading of your address book, contacts or anything outside this site.

Who touches the data

The site runs on Cloudflare, which stores the database and uploaded images. Sign-in and reminder emails are delivered by Resend. If you use Google or Apple sign-in, they confirm your address to us; we never receive your Google or Apple password. In the app, daily reminders are delivered by Apple's notification service. Film data comes from Wikidata and TMDB, and streaming availability from JustWatch via TMDB; those lookups happen from our servers. Some things do load straight into your browser from other companies, and like any website you load something from, they see your network address when they do: poster images come from TMDB's image servers, a trailer loads from YouTube in its privacy enhanced mode only when you press play, the Google sign-in button loads Google's own script, and news thumbnails load from the publisher that ran the story.

Analytics

We use Cloudflare Web Analytics, which counts visits without cookies and without profiling individual visitors.

Deleting your account

Settings has a delete button. It permanently removes your account, name, email, posts, comments, likes, lists, scores and uploaded pictures. There is no grace period, and we never restore a deleted account. Our database host keeps rolling disaster recovery backups for up to 30 days; a deleted account ages out of those on its own and is never brought back from them.

Age

The site is for people 13 and older.

Your rights where you live

Shown for your detected location: Ohio, US. Every protection on this page applies to every user everywhere; this section just names the law that covers you. It is a plain-language summary, not legal advice.

United States. Federal law (COPPA) forbids collecting personal data from children under 13, which is why the site requires users to be 13 or older; an account we learn belongs to a younger child is deleted. Many states add their own protections for minors, and where your state does, they apply to your use of this site. Our baseline already sits above every state's requirements: no data sales, no targeted advertising, no profiling, self-serve deletion, and messaging between adult and under-18 accounts limited to film suggestions.

To exercise any right, or if we got something wrong, email support@thefilmtimeline.com and a person will fix it.

Who we are

The Film Timeline is operated by ZH Tech LLC, an Oklahoma limited liability company, which is responsible for the data described on this page.

Questions

Problems and privacy questions go to support@thefilmtimeline.com. Suggestions, ideas and business go to inquiries@thefilmtimeline.com.