CinAPP

Privacy.

Last updated: 24 October 2026

CinAPP recommends films and series based on your mood and your taste. To do that it has to know some things about you. This page says what it stores, why, who else sees it, how long it's kept, and how to get it or delete it.

Who I am

CinAPP is a small, non-commercial project run by me, Acton Pimpao Pereira, as an individual. ("APP Industries" is the name I make things under; it isn't a company.) I'm responsible for your data, which makes me the "controller" under UK data protection law. For any question or request, email privacy@cinapp.co.uk.

As the person running CinAPP, I can access the data it stores. I only do so to run, fix or protect the service, and I don't browse people's taste data.

The short version

  • CinAPP only collects what it needs to recommend things to you: your email address, your taste (what you've watched, rated, saved and reacted to) and how you've used it.
  • No ads, no tracking cookies, no analytics. CinAPP will never sell your data or share it for advertising or marketing.
  • Your answers and history are sent to Anthropic's Claude to choose your picks. Your email address is not.
  • Your Setup → Your data lets you download everything as a file, or delete your account and all of it straight away.
  • CinAPP is for adults: you must be 18 or over.

What CinAPP stores

Your account

  • Your email address, when you joined and when you last signed in. CinAPP uses it to sign you in with an emailed link.
  • When you confirmed you're 18 or over (you tick a box when you sign up).
  • While CinAPP is invite-only: your email on the invite list, or on the waitlist if you asked to join.

Your taste

  • Your Letterboxd history, if you import it: each film's title, year, your rating, the date you watched it and how many times you've rewatched it, plus your watchlist. Your export file is read in your browser; only those details are uploaded, never the file itself.
  • Films and series you've marked as seen, with any rating you gave.
  • My List: what you've saved to watch.
  • Your reactions to picks ("want to watch", "seen it", "not my taste" and the reasons you ticked, "not tonight") and titles you've passed on.
  • What CinAPP has learned from all of that: a set of scores for genres, tones, styles, directors and so on, which you can see, correct or reset on Your Setup. If you use "Teach CinAPP my taste", a short written summary of your taste too.
  • The questions you answered about yourself (films you love, films that didn't connect, how often you watch, favourite decades, how you'd describe yourself) and your minimum IMDb and Rotten Tomatoes scores.
  • Your streaming services and region.

Your sessions

  • Each time you get picks: the mood and format you chose and the picks you were shown, so CinAPP doesn't repeat itself and can learn from your reactions.
  • What you type about your evening ("what's going on in your life", "last watched") is used for that request only. CinAPP doesn't store it.

Usage records

  • A record of each paid lookup CinAPP makes for you: which feature, which service, the time, the size of the request and its estimated cost. These records never contain what you typed or the text of the picks. CinAPP uses them to enforce fair-use limits and keep its costs under control.
  • A scrambled (salted and hashed) version of your IP address, used to stop sign-in forms and other features being hammered by too many requests. It can't be turned back into your IP address and is deleted after a day.

In your browser

  • Sign-in cookies, which keep you signed in. They're essential, so there's no cookie banner.
  • Your answers on the Film & TV page and your last set of picks, stored in your browser (not on CinAPP's servers) so you don't lose them if you leave the page or need to sign in. Clearing your browser's site data removes them.

Why (the legal part)

CinAPP uses your data to provide the service you signed up for: recommendations that fit you. Under UK data protection law (UK GDPR) that's "performance of a contract". Usage records and the hashed IP addresses are kept to protect the service from abuse and runaway costs, which is a "legitimate interest". CinAPP will never sell your data or share it for advertising or marketing.

Who else sees it

CinAPP relies on these services. Each one only gets what it needs.

Supabase
What it doesDatabase and sign-in
What it seesEverything CinAPP stores (listed above). Hosted in London, UK.
Anthropic (Claude)
What it doesChooses your picks and, if you ask, writes your taste summary
What it seesYour answers for that session, your taste history and Letterboxd ratings, and titles you've seen. Not your email address. Anthropic doesn't use this to train its models by default, and deletes it within 30 days, except content flagged under its Usage Policy, which it can keep for up to 2 years for safety review.
TMDB (The Movie Database)
What it doesFilm and series details, posters, and where to watch (data from JustWatch)
What it seesFilm and series titles CinAPP looks up, never who they're for. Posters load straight from TMDB's image server, so TMDB sees your IP address when your browser shows them.
OMDb
What it doesIMDb and Rotten Tomatoes scores
What it seesIMDb IDs of titles CinAPP looks up, never who they're for.
Resend
What it doesSends sign-in emails (EU region)
What it seesYour email address and the sign-in link. Click and open tracking are off.
Vercel
What it doesHosts the website. CinAPP's server runs in London, UK; static files such as scripts and styles come from Vercel's worldwide network.
What it seesYour IP address and the pages you request, in short-lived server logs.
Cloudflare
What it doesDomain name, the "are you human" check on the sign-in and waitlist forms (Turnstile), and forwarding emails sent to privacy@cinapp.co.uk
What it seesYour IP address and browser details when you use those forms. Emails you send to privacy@cinapp.co.uk, which are forwarded to my personal email inbox.

Some of these companies are based in the US, so your data may be processed outside the UK. They protect it with the safeguards UK law requires for international transfers, such as the UK's approved contract clauses.

How your data is protected

  • Everything between your browser and CinAPP, and between CinAPP and the services above, is encrypted in transit (HTTPS).
  • CinAPP's database is encrypted at rest.
  • Database rules mean each person can only read and change their own data, and automated checks against the live database make sure those rules are in place.
  • Secret keys stay on CinAPP's server and never reach your browser.
  • The admin pages are limited to my account.
  • The accounts I use to run CinAPP are protected with two-factor sign-in.

If there's ever a data breach that puts you at risk, I'll tell you and the ICO without undue delay.

How long it's kept

  • Your account and everything in "Your taste" and "Your sessions": until you delete your account.
  • Usage records: 13 months, then they're deleted automatically. If you delete your account sooner, the records from before then stay until they reach 13 months, with nothing that links them to you, because CinAPP's cost totals depend on them.
  • Hashed IP addresses: one day.
  • Waitlist entries: until you're invited or ask to be removed.

Your rights

  • See your data: Your Setup → Your data → Download my data gives you everything above as a JSON file.
  • Correct it: change your answers, services and ratings in the app, or remove things CinAPP has learned on Your Setup.
  • Delete it: Your Setup → Your data → Delete my account. Your account and data are deleted straight away, and your email comes off the invite list and the waitlist. It can't be undone.
  • Object or ask anything else: email privacy@cinapp.co.uk. You'll get an answer within a month, and usually much sooner.
  • Complain: if you're unhappy with how your data is handled, you can complain to the Information Commissioner's Office (ico.org.uk). Please get in touch first so I can put it right.

Age

CinAPP is for people aged 18 and over. You confirm this when you sign up. If you're under 18, please don't use it. If I learn that an account belongs to someone under 18, I'll delete it.

Changes

If I change this page in a way that affects you, I'll email you before the change takes effect. The date at the top shows when it last changed.