Kolme

Last updated

Privacy Notice

This notice describes the data the service processes and the rights available to you today. The last-updated date appears above.

Your profile is private by default: no public page, no sharing unless you choose it, your taste profile is never sold, and no sensitive trait is ever inferred from what you watch.

What we collect and why

  • Email, hashed password and name: for the account, sign-in and security.
  • Interface language, market and platforms: for display and availability only, never for taste.
  • What you marked as watched or not watched, and your list: to build triads, recommendations and the availability value.
  • Ranking rounds and their replacements: to train your own taste model.
  • Recommendations shown to you and what came of them: to close the loop and evaluate quality; aggregated after 24 months.
  • Consents and privacy requests: a compliance record that stays, reduced to a trace without personal data after deletion.
  • Audit log and server logs: for security and abuse prevention; server logs are kept for 30 days.

What we neither collect nor infer

No precise location, no device fingerprints or tracking cookies, no third-party advertising identifiers, no biometric or health data. And we never infer religion, politics, sexual orientation or health from what you watch or how you rank; this is a hard ban enforced in the explanation rules, the trait vocabulary and review.

Consents

  • Terms and privacy notice: at registration; required to use the service.
  • Storing what you watched: at registration; required for the service to work.
  • Your own taste model: at registration; required for the service to work; used for your profile only.
  • Contributing to the shared model: optional, chosen at registration and never pre-set; your pseudonymous rankings, never attributed to you, help a shared model that improves triads and recommendations for everyone. Withdrawing it excludes your profile from the next retrain and does not affect your personal model. Anyone registered before this version is not assumed to have given a consent they did not give.
  • Product analytics: optional, chosen at registration and never pre-set; operational events on our own systems only, no third party and no advertising.
  • Import processing: asked when you import a list; the raw file is deleted after parsing.

Your rights

  • Wipe the taste profile: available now from your profile; deletes rounds, marks and the model and keeps the account.
  • Withdraw the optional consents: available now from your profile.
  • Access and export: available now from your profile; after confirming your password, you can download a portable JSON copy of your account, profiles and privacy requests.
  • Deletion: available now from your profile after confirming your password. The request pauses processing for your profiles and sets an execution date after a safety period; you can cancel until that date, and deletion cannot be undone after it runs.
  • Correction: source data through the request form in your profile; taste corrections through a new ranking round, since originals are never edited in place.
  • Objecting to automated decisions: recommendations are suggestions, and nothing is withheld from you by an automated decision. Any other objection to processing goes through the request form in your profile.

Who else processes data

We use a language-model provider to describe films and rephrase explanations; only film evidence is sent: no user ids, emails, rankings, preferences, watch history or profile text.

Film data and availability providers receive content data, not personal data, with one exception we state plainly: film posters are fetched by your browser straight from TMDB (image.tmdb.org) and never pass through our servers, so TMDB sees your IP address and your browser type, as any site you open does. It is not told who you are: a poster URL carries no identifier of yours, and the image is requested with no-referrer, so no page address goes with it. In the few places the same image is painted as a CSS backdrop, the browser’s own default sends our domain name and never the page path.

We did not put an image proxy on our own domain because that would make us the ones redistributing TMDB’s images, a licensing question that is not settled. We will revisit it when it is.

Hosting is Railway (servers and database in EU West) behind Cloudflare, with encrypted backups in a private European bucket.

Security

Encryption in transit and at rest, object-level authorization on every profile route, rate limits, an audit trail for every administrative action, and isolation of the model service from identity.

Retention

Account and taste data stay until deletion or a wipe. Recommendations shown, their outcomes and analytics events: 24 months, then counted and deleted by a daily sweep. After 12 months an audit entry loses anything that could point to a person. Server logs: 30 days. Consents and privacy requests stay as a compliance record without personal data after deletion; a request’s text and reply address are cleared 30 days after it is closed.

Contact

Privacy and rights requests go through the request form in your profile (access, correction, erasure, objection, content rights); a person replies within seven business days through your account. Without an account, use the request form on the sources and rights page, with an address for the reply. The team’s privacy owner answers them.