Privacy Policy

When you sign in with Google we receive your:

• Email address
• Display name
• Profile photo (avatar)

Beyond that, what we store is the content you create inside the app: your spoils (entries), lists, ratings, notes, and any profile information you fill in.

One other thing sits on your account. If you arrived on a link we tagged ourselves, in a post or an ad, we record the name that link gave itself, so we can tell which ones are worth writing. It is the name of a site or a post and nothing about you, it reaches nobody outside mySpoils, and it goes when your account goes. Arrive any other way and there is nothing to record. The cookie that carries it from the link to the account is in the Cookie Policy.

If you report a public profile without having an account, we hold the email address you gave and what you wrote. It is used to answer you and for nothing else. It is never shown to the person you reported, and no list you can be mailed on is built from it.

We keep the address for twelve months after the report is dealt with, then delete it. What was reported and what we did about it stays, without your address on it.

You have to be 16 to have an account here (why). Today that is a confirmation you make by signing up and nothing is stored: we hold no date of birth for anybody.

If that changes we will store the date and nothing derived from it, use it for the age requirement and for nothing else, never show it on a profile or hand it to a third party, and say so here before it starts. A date of birth is personal data and the least we can hold is none.

Your data lives in a PostgreSQL database managed by Supabase and the app is hosted on Vercel. Both are reputable infrastructure providers with their own security and compliance practices.

The database is in Europe; some of the companies are not. Supabase keeps your data in its Irish region. Supabase, Vercel, Resend, Stripe and Google are United States companies whose staff and systems can reach it from there, and each relies on the Standard Contractual Clauses, with the EU-US Data Privacy Framework on top where the company is certified under it.

Meta is the one that is not like the others. If you turn Marketing on, the advertising pixel described below sends a page view from your browser to Meta. Our agreement for it is with Meta Platforms Ireland Limited, which is an Irish company, and we read that to mean the journey to the United States is Meta's to make rather than ours. Meta Platforms, Inc. appears on the Data Privacy Framework list kept by the United States Department of Commerce; when we last checked, on 18 October 2026, its status there read “Active - Re-certification under Review” rather than a plain “Active”, and the listing covers the American company rather than the Irish one we contract with. That is the reading we take and not a settled question, and we would rather tell you so, with the awkward parts left in, than write it as though somebody had decided it.

Nothing you log is public until you say so, and it takes two separate decisions. A new account's profile is closed, and every spoil starts private. Turning the profile on opens your address; marking a spoil public puts that one spoil on it. Neither does the other's job.

A public profile is a public web page. It needs no account to read, we list it in our sitemap, and search engines may index it. Turning the profile off takes the page down.

Being findable is a separate switch. Other people here can search for somebody by name or handle, and a private account is in those results: a row carries a name, a handle and a face, and nothing about what anybody has logged. Private means your shelf is not on show, not that you are not on the app, and a row that leads nowhere discloses nothing about what is behind it. If you would rather not appear at all, the Social setting takes you out of search. Turning the profile off does not: it closes the page, not the door.

A profile that is on shows:

• Your display name, your username, your avatar and your bio
• Any badges you have earned, and the supporter mark if you have one
• The spoils you have made public. For each one: its title, subtitle, category, artwork, release date, the date you experienced it, your rating, whether you marked it a favourite, and your note
• Counts and summaries drawn from those spoils: how many per category, how many favourites, your year in review, and your Top 10

It never shows:

• Your private spoils, or any count or hint of how many there are
• Anything on a spoil you have kept private, including the files on it
• Your email address, or anything you have not published

A link to one spoil works off that spoil alone. If you share a single spoil, the link keeps working even while your profile is closed, because publishing that spoil was a decision about it and it stays true. Your name stays off the page while the profile is closed.

Planning something shares the one thing you are planning. Your want list is private and has no switch, and making a plan on one row of it is the only thing that lets anybody else read that row. Two sets of people can: the friends you invite, who see the thing, the day and who else is coming, and anybody who opens the plan's link, which needs no account. That page carries your name, the thing, the day and how many are going, and it never names your guests. You make the plan, nothing makes one for you, the rest of your want list stays private, and ending the plan closes the link.

A file follows the spoil it is attached to. Photographs, tickets, documents and links you keep on a spoil are private while it's private, and public when you make that spoil public. There is no separate switch per file: one decision about the spoil decides everything on it.

Files attached before 20 September 2026 stay private for ever, whatever happens to the spoil. They were attached when an attachment was yours alone, and that is not something a later change gets to reopen.

A shared link carries how you were looking at your collection, not only where. When you share a filtered view, the narrowing travels in the address: what you searched for, the categories, the date range, the rating and note filters, and your tags. A tag is your own word for something, and it is written into the link, so whoever you send it to can read it, and can forward it. Tags appear on no public page otherwise: nobody browsing your profile discovers them, and somebody holding a link is shown which spoils carry the tags in that link and nothing about any other tag on any of your spoils.

Every link, however it is filtered, resolves against your public spoils only. A filter that matches something private shows the visitor nothing.

Pasting a link somewhere generates a preview. Chat apps, social networks and messaging services fetch a preview card when a link is posted, and for a collection link that card carries your display name, username, avatar, bio and the number of public spoils in it. That fetch is made by the service you posted it to, not by us.

If you buy Pro or a Lifetime licence, the payment is handled by Stripe. You are sent to Stripe's own checkout page to pay, so your card number is entered there and never reaches mySpoils. We never see it, never store it, and could not produce it if you asked us to.

What Stripe receives from us is your email address, so it can send you a receipt and recognise you as the same customer next time, and an internal reference to your account so we know which account the payment was for. What we receive back and store is the identifier Stripe gives your customer record and your subscription, and whether the plan is active. That is all we need to know what you are entitled to, and it is all we keep.

Stripe handles the payment on their own terms and privacy policy as well as this one. If you cancel, your entitlements change and nothing you have logged is touched.

What we keep is on our side: which plan the account holds, whether it is active, and that it was paid for. Stripe keeps its own records of the payment itself, under its own terms, and what survives a request you make to them is theirs to answer.

We use the following external services to run the app. Each is listed with what it receives.

Signing in, paying, and email

• Google OAuth: sign-in only; we do not access your Google Drive, Gmail, or any other Google data.
• Stripe: payments. See the section above for what is sent and what comes back.
• Resend: to send transactional emails (e.g. sign-in links, waitlist confirmations) and, if you have asked for them, occasional product-news emails. We share only your email address, and your name if you have set one, for this purpose.

Looking things up when you log a spoil

When you log something, mySpoils searches public catalogues so you do not have to type in the director, the cover or the address yourself. What those services receive is the words you typed and nothing about you: the request comes from our server, not your browser, and it carries no name, no email address and no account identifier. They cannot tell one person's searches from another's, or from ours.

One request a night is different, and it is worth stating. To show which films are in cinemas where you are, we ask TMDB once for each country our readers have chosen as their catalogue. The request carries a country and nothing else: no account, no name, no list of who is where. What it does tell TMDB, over time, is which countries this product's readers are in. That is a fact about us rather than about you, and it is the one thing in this section that is not simply the words somebody typed.

• TMDB (The Movie Database): the film, series or person you are searching for, and the scores and artwork it holds for them.
• Open Library: the book or author you are searching for, and its cover. Where a book has an ISBN we send that instead, which names the exact edition rather than the title. An import sends it for every book that has one.
• Google Books: the same, as a second catalogue when the first has nothing; and the country your browser reports, which is what decides whether a preview of a book is available where you are.
• MusicBrainz and the Cover Art Archive: the artist, album or track you are searching for, and its sleeve.
• Google Places: the place you are searching for, as you type it, and a photograph of the one you pick. This is the one lookup that happens while you are still typing.
• Wikidata: an identifier or a code we already hold - an airport code on an imported flight, an airline code, a catalogue id - to find the city it serves, the carrier it belongs to, or a fact worth knowing about what you logged.
• Wikipedia and Wikimedia Commons: the name of a place or a subject, to find a photograph of it and the credit its licence requires.
• Logo.dev: the brand you are searching for, to find its logo.
• YouTube: an identifier for a trailer or a music video, to check that it can be played before we offer it to you. Nothing about you goes with it.

What your browser loads from somebody else

Three things inside the app are loaded from another company's server, and each only after you ask for it:

• A YouTube player, when you press play on a trailer or a music video. We load it from youtube-nocookie.com, Google's privacy-enhanced host, which holds cookie data back until the video actually plays. And pressing play is what creates the player in the first place.
• A Google Books preview, when you open a book's preview.
• A Google Map, when you expand the map on a place.

The two Google frames are requests to Google. If you are signed in to Google, they carry your Google cookies with them, and Google can set more. That is true of any page anywhere carrying a Google map or a book preview; we cannot show them and prevent it. All three are set out in the Cookie Policy.

Vimeo videos are drawn as a still picture with a link out. No Vimeo player is ever loaded.

Pictures are fetched by your browser directly. A poster, a cover, a sleeve, a portrait, a brand's logo, a video thumbnail: your browser goes to whoever holds it, with nothing of ours in between. Each of them sees your IP address and your browser's user agent, and each can set a cookie on its own domain. They are TMDB, Open Library, Google Books, Wikimedia, Logo.dev, the Cover Art Archive, Primavera Sound, and the thumbnail hosts of YouTube and Vimeo.

Two kinds of picture do not work that way, because our server fetches them for you: photographs you have uploaded, and photographs of places from Google. For those, the other service sees us rather than you.

Understanding how the app is used

• Google Analytics: to understand how the app is used in aggregate, and only if you turned analytics on in the cookie banner. The cookies it writes are named in the Cookie Policy. It is a company measuring a product, and what it receives is page views that are not tied to your name or your email address.

Measuring whether our ads work

If we run an ad, we want to know whether anybody came from it. That is the Meta Pixel, and it is the one thing here that reports you to an advertising network, which is why it answers to a switch of its own rather than riding on the analytics one. It loads only if you turn Marketing on: refuse, or never answer, and the script is never added to the page.

What it reports is that a browser arrived and, if you came by pressing one of our ads, the id of that press. It goes from your own browser to Meta, so Meta sees your IP address, and it writes two cookies that are named in the Cookie Policy. Because Meta served you that ad, it can connect the visit to your Facebook or Instagram account. That is the difference between this and analytics, and it is why it is worth a separate decision rather than a single yes.

What we never send: that you made an account, your email address, anything on your shelf, or any event for something you did in the app. The pixel reports the visit and nothing else.

Meta is not simply doing this for us. Under Meta's own terms for these tools, we and Meta are jointly responsible for collecting what the pixel collects and sending it to Meta, and what Meta then does with it is Meta's own decision rather than ours, under Meta's own privacy policy rather than this one. That is the part we cannot answer for, and that is where to go for it. It is also the difference between an advertising network and a service working to our instructions, and the reason this has a switch of its own.

If you accept and later change your mind, the Cookies link at the foot of any page stops the pixel and deletes both cookies.

We only send these if you have asked for them. The switch is off by default, at sign-up and in Settings, and signing up never subscribes you. Turn them off any time under Settings → Emails, or with the unsubscribe link at the bottom of any one of them. Either way we stop; emails about your account, like sign-in links, still come through.

News mail is a different thing and carries your own titles. If you switch it on, a weekly message names things from your own collection, including things on your want list, which are private by construction. It is the only mail we send that carries titles you have never published. It goes to you and to nobody else, through Resend, the same service as every other message. It is off unless you turn it on, and the unsubscribe link in it stops it.

We do not sell, rent, or trade your personal data to anyone. Full stop.

You can delete your own account from Settings, at any time, without asking anybody. It asks for a deliberate confirmation, because after 30 days it cannot be undone.

Deleting takes your public profile down at once and signs you out. The data stays for 30 days, so an accident can be undone and so you can still ask for a copy. Export your collection first if you want to keep it. After 30 days it is deleted, apart from records we have to keep: payment and tax records, and the fact that an account was closed and why.

If you cannot sign in, write to hello@myspoils.app and we will do it for you.

Questions or concerns? Reach out at hello@myspoils.app.