Privacy Policy
Last updated
Who runs BeStats
BeStats is a free, non commercial personal project run by kris1027 in Poland. kris1027 is the data controller for the personal data described here, which this policy calls “we”. You can reach us at kris1027.dev@gmail.com.
What we collect
- Account data: your email address, the username you choose, and your password, which Supabase Auth stores only as a hash. Your username is shown only to you.
- Tracking data: your watchlist entries, the movies and episodes you mark watched with the dates you watched them, your 1 to 10 ratings, and the TV shows you track.
- Technical data: your IP address, your browser’s user agent and the request logs our hosting and sign in providers keep. The sign in events BeStats logs itself carry no email address, password or token.
Nothing else. We collect no payment data, no contacts, and no location beyond what an IP address implies.
On a title page, the approximate country Vercel derives from your connection picks the region for where to watch and the age rating. It is not stored.
Why we use it
- To provide your account and keep your tracking data. The legal basis is performing the contract you accept when you sign up (GDPR Art. 6(1)(b)).
- To keep the service secure and stop abuse, for example through rate limits and logs. The legal basis is our legitimate interest in a safe service (GDPR Art. 6(1)(f)).
We send no marketing emails, show no ads, run no analytics, do no profiling and make no automated decisions about you. We never sell your data.
Cookies
BeStats sets only strictly necessary cookies: the Supabase session cookies that keep you signed in. They are set when you sign in, are HttpOnly so page scripts cannot read them, and are removed when you sign out.
There are no analytics, advertising or third party tracking cookies, so there is no consent banner. Fonts are served from BeStats itself, not loaded from another site.
A trailer plays in YouTube’s privacy enhanced player, which loads only after you press Trailer. From then on YouTube’s own privacy policy applies to that player.
Who processes your data
These providers process personal data on our behalf:
- Supabase: Stores your account and tracking data and handles sign in.
- Vercel: Hosts the website, delivers catalog images, and keeps request logs.
- YouTube: Plays a title's trailer, only after you press Trailer on its page.
Catalog details come from TMDB, which receives no personal data from you: our server makes the catalog requests, and our host delivers the images.
Transfers outside the EEA
Your data is stored and processed in the EU: the database in Frankfurt, Germany, and the app’s server functions in the matching Vercel region.
Supabase and Vercel are United States companies. Where their staff access your data for support and operations, that access is covered by the EU Standard Contractual Clauses.
How long we keep it
Your account and tracking data stay until you ask us to delete your account. We then delete them within 30 days. Logs kept by our providers follow those providers’ own retention periods.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data erased;
- restrict how we process it;
- data portability, which means a copy of your tracking data on request;
- object to processing based on our legitimate interests.
Email kris1027.dev@gmail.com to use any of these rights. We answer within one month. Account deletion works by email request today.
Complaints
You can complain to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or to the data protection authority where you live.
Children
BeStats is not for anyone under 16. If we learn that an account belongs to someone younger, we delete it.
Security
Row Level Security in the database limits each account to its own data, session cookies are HttpOnly, and Supabase stores passwords only as hashes. No system is perfectly secure, but we work to keep yours safe.
Changes to this policy
We post any material change on this page with a new Last updated date. The Terms of Service set out the rules for using BeStats.