Privacy.

Nothing, for most visits. You can run a full check-up, build a stack from scratch, and browse offers without an account. Your answers live in your own browser’s session storage until you close the tab, unless you sign in and save them.

With an account: your email address (used for sign-in links and nothing else unless you opt in), and any check-ups you choose to save.

When you help us: feedback you submit — a thumbs verdict, an optional comment, and the run it judged so we can replay the exact numbers you saw. Feedback works without an account and is stored without one.

Operational signals: when you click an affiliate link or vote on an offer, we record the event with a salted hash of your IP address and browser — enough to count honestly and stop abuse, not enough to identify you. The raw values are never stored.

We do not sell or share your personal information, for money or otherwise. We do not run advertising trackers. Our only analytics is cookieless page-view counting (Vercel Web Analytics): no cookies, no fingerprinting, no personal identifiers, no cross-site tracking — we learn that a page was visited, not who you are. Sign-in tokens are stored only as SHA-256 hashes. And by architecture, not policy: the code that builds your recommendation cannot read our affiliate or payout data — a test in the build fails if anyone ever wires those together.

We set only strictly necessary, first-party cookies: a session cookie when you sign in, and a record of your cookie choice itself. No advertising or analytics cookies exist on the site today. If that ever changes, nothing non-essential will load without your consent — the banner you saw is the switch, and you can change your choice here.

When we link to a streaming provider, the link may earn us a commission. Every such link is labeled at the link. Commissions have no input into what we recommend; rankings are computed before any affiliate decoration is applied, and the recommendation engine is firewalled from revenue data entirely.

Wherever you live, you can ask us to show you what we hold about you, correct it, export it, or delete it — deleting your account removes your saved runs and disconnects your email. We answer every request the same way regardless of jurisdiction.

California — Do Not Sell or Share: we do not sell or share personal information as the CCPA/CPRA defines those terms, so there is nothing to opt out of. This paragraph is the notice.

EU/UK: the lawful bases we rely on are contract (running the service you asked for) and legitimate interest (abuse prevention, the hashed operational signals above). Nothing is profiled for advertising.

To exercise any of these rights, use the feedback box on any results page or the contact address in your account settings, and say it’s a privacy request — those are routed to a human.

Saved check-ups live until you delete them or your account. Feedback rows live until the issue they describe is resolved and regression-tested. Click and vote hashes age out with the operational logs. Nothing is kept for the sake of keeping it.