Privacy
What Awards Checklist collects, why, and what you can do about it.
The short version
- You can tick off films without an account. That progress stays in your own browser.
- With an account we store your username, email address and checklist so they follow you between devices.
- Google Analytics only runs if you accept it in the cookie banner.
- We don't sell your data or show ads.
- You can download or delete everything from your account page at any time.
Who we are
Awards Checklist (awardschecklist.com) is an independent site run from the UK. We're the data controller for the personal data described here. For any privacy question or request, email hello@awardschecklist.com.
What we collect
If you don't have an account
The films you mark as watched and your view options are saved in your browser's local storage. They never reach our servers. Clearing your browser data removes them. If you then create an account, you can bring that progress with you.
If you create an account
- Account details: your username, email address and password. Passwords are stored hashed, never in plain text.
- Signing in with Google: Google shares your email address with us so we can create or find your account. We don't get your Google password, and we don't get access to anything else in your Google account.
- Your checklist: the films you've watched (and when), your watchlist, predictions and favourites, and how you've ordered or hidden categories.
- Settings: your avatar colours, whether you appear in friend search, and whether your username appears on the stats leaderboards.
- Friends: the friend requests you send and accept. If you invite someone by email, we store their address and send them one invitation email on your behalf.
Analytics (only with your consent)
If you accept analytics cookies, Google Analytics records how the site is used. That includes the pages you visit, roughly where you are, and what device and browser you use. It doesn't include your name, email address or checklist. Decline, and Google Analytics never loads.
Error reports
When something breaks, we send an error report to Sentry so we can fix it. A report contains technical details like the page, your browser and what went wrong. It doesn't contain your email address or password.
Why we use it
UK data protection law requires a lawful basis for every use of personal data. Ours are:
- To provide the service you signed up for: running your account, saving your checklist, friends, and account emails such as confirming your address or resetting your password.
- Our legitimate interests: keeping the site secure, fixing errors, and sending an invitation when a member asks us to.
- Your consent: Google Analytics. You can withdraw consent at any time (see Cookies).
Who can see your data
- Your friends can see your checklist, including watched films, predictions and favourites, once you've both accepted the friend request.
- Other members can find you by username in friend search, unless you turn on "Hide me from friend search" in your account.
- Everyone can see your username on the stats leaderboards, but only if you turn on "Show my username in leaderboards". It's off by default. Site-wide stats otherwise use anonymous totals.
Your email address is never shown to other members.
Services we use
The companies below process data for us so the site can run. Each one only gets what it needs for its job.
- Railway
- Hosts the website and the database that holds accounts and checklists.
- Resend
- Sends account emails and friend invitations.
- Handles "Sign in with Google" and, if you consent, Google Analytics.
- Sentry
- Receives error reports. Our Sentry data is stored in the EU.
- Gravatar
- Provides your profile picture if you have one. Your browser requests it using a one-way hash of your email address, not the address itself.
- TMDB and JustWatch
- Provide film posters, details and "where to watch" information. Posters load straight from TMDB's servers, so TMDB sees your IP address just as any website you load an image from would.
Some of these providers are based in, or store data in, the United States. Where data leaves the UK, it's covered by the safeguards UK law requires, such as the UK–US data bridge or the ICO's standard contract clauses.
How long we keep it
We keep your account and checklist for as long as your account exists. When you delete your account, we delete your account details, everything you've tracked and any invitations you've sent straight away.
Google Analytics keeps its detailed data for 2 months. Error reports are kept for up to 90 days. Both are then deleted automatically.
Your rights
Under UK data protection law you have the right to:
- Get a copy of your data. Use "Download my data" on your account page for a copy in JSON format.
- Correct it. Most of it you can edit yourself. For anything else, email us.
- Delete it. Use "Delete my account" on your account page.
- Object to or restrict how we use it, and withdraw consent for analytics.
For anything you can't do yourself, email hello@awardschecklist.com. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.
Children
Awards Checklist isn't intended for children under 13, and we don't knowingly create accounts for them. If you think a child has signed up, let us know and we'll delete the account.
Changes to this policy
If we change how we handle your data, we'll update this page and the date at the top.