Privacy policy

What the site keeps depends on what you use. If you browse without signing in, nothing about you is stored on the server apart from the short-lived security counters described below.

• Account. When you sign in with Google, Discord or Microsoft, that service shares your name, email address, profile picture and an identifier for your account there. UpNext never sees your password, and the access tokens the service issues are discarded right after sign-in. The site also keeps when your account was created and when you last had it open (to within a few minutes).
• Profile picture. If you upload your own picture, it is stored as a small image of at most 50 KB.
• What you watch. The movies and episodes you mark as watched and when, the shows you drop, and your progress through each series.
• Lists. Your watchlists, their names and settings, the people you invite to them, and who added each title.
• Recently viewed. The last 18 titles you opened, for the History page.
• Settings. Your language, country and time zone, so they are the same on every device you sign in on.
• Friends. Friend requests, friendships, list invitations, the notifications about them, and when you last checked your friends' activity.
• Push notifications. If you turn them on, the push address and encryption keys your browser creates for that device, the browser's name and version, and when a notification last arrived or failed. With the bell on the Upcoming page, which titles you want to hear about (or not) and which of their releases you were already told about.
• Announcements. Which site announcements you closed, so they stay closed on every device.
• Browser extension. If you connect it, the name of each access token, a one-way fingerprint of it (never the token itself), and when it was created, last used and expires.
• Feedback. What you send from the Feedback page: your bug report, idea or message, your name if you give it while signed out, and your email address only if you ask for a reply. Unless you turn off “Attach technical details”, it also carries what helps find a bug: the page you were on and the one before it, your browser, operating system, device and screen, language, time zone, network type, display settings, whether notifications and the app's offline support are on, the last pages you opened and errors that happened in that browser tab, and, for an account, when it was created, how you sign in and how many titles, lists, friends and push devices it has.
• Security counters. To keep the site from being abused, requests are counted for a short time: per account, or per IP address for search, ratings and feedback sent while signed out. These counters are deleted within a day.
• Technical logs. Like most websites, the server and Cloudflare keep brief technical logs (IP address, the page requested, the time and any errors) to fix problems and stop attacks. Errors the app itself catches are kept for 30 days, with the page address but without its search terms.

Your data is used only to run UpNext:

• to keep track of your movies, shows, lists and new episodes, and to suggest what to watch;
• to let friends and list members see what you choose to share with them;
• to send the notifications you turned on, about new episodes, releases you asked about, friend requests and invitations;
• to keep the site working and secure, and to understand which features are used (see Analytics);
• to read, track and fix what you report from the Feedback page, tell you when it is done, and answer you if you asked for a reply.

UpNext does not show ads, sell or rent data, build advertising profiles or send you email, apart from my reply when you ask for one.

If a data protection law such as the GDPR applies to you: your data is processed to provide the service you signed up for, and, for analytics and security, on the basis of a legitimate interest in keeping the site safe and improving it.

• Anyone with the link can open your profile page, which shows your name, your picture and your public lists.
• Friends also see the lists you share with friends and your recent activity: the latest movie or episode you watched, series you finished and titles added to lists they can see.
• List members see the list they were invited to, its titles and who added each one.
• Only you see your private lists (apart from people you invite to them), your recently viewed titles and your settings.
• I, who run UpNext, can see account data when running and supporting the site, for example to fix a bug you report or answer a request about your data. Each such look, and anything done to an account, is recorded.

Your email address is never shown to other users. Someone who already knows it can send you a friend request, but the site does not tell them whether the address belongs to an account.

Your data is not shared with anyone else, except the services below that make the site work, or where the law requires it.

• Google, Discord and Microsoft handle sign-in. You sign in on their page, where their own privacy policies apply.
• Cloudflare sits in front of the site to protect it and speed it up, so it processes your requests and IP address.
• TMDB (The Movie Database) supplies titles, posters and other details. Requests to it carry nothing about you: posters and images, too, are fetched by this site and passed on to you, so TMDB does not see your IP address.
• YouTube plays trailers in its privacy-enhanced mode (youtube-nocookie.com). The player loads only when you open a trailer, and YouTube's policy applies to it.
• Push services run by your browser's maker (such as Google, Mozilla, Apple or Microsoft) deliver notifications. Each notification is encrypted, so they cannot read it.
• Feedback you send is passed on by Activepieces, an automation tool I host myself at auto.cedigarov.dev. Bug reports and ideas, with their technical details, become tasks in Linear, the task tracker I plan work in. Every submission, messages included, also reaches me as a Telegram message. Your email address goes along only if you asked for a reply. Linear's and Telegram's own privacy policies apply to what they keep.

The app, its database, its analytics and Activepieces run on servers I manage. Some of these services may process data outside your country.

UpNext uses Umami, a privacy-focused analytics tool that I host myself at stats.cedigarov.dev, so visit data is not handed to an analytics company. It sets no cookies and does not store your IP address. It records the pages you visit, the site that sent you, your browser, operating system and device type, and your approximate location (country, region and city, worked out from your IP address, which is then discarded).

Some visits may also be recorded as a session replay or heatmap: page changes, clicks, scrolling and what the page looked like, which can include your name and the titles on screen. Anything you type into a field is masked in your browser before it is sent. Recordings are used only to find bugs and confusing screens.

Blocking stats.cedigarov.dev with a content blocker turns analytics off without affecting the app.

UpNext uses only the cookies it needs to work, which is why there is no cookie banner. None of them are used for advertising or to follow you across other sites.

• Sign-in: a session cookie that keeps you signed in. It expires after 30 days without a visit, or when you sign out.
• Preferences: cookies for your language, region, time zone, start screen, light or dark theme, sidebar layout and display choices, including whether to hide watched titles in watchlists and caught-up shows, so pages arrive already set up the way you like.
• Local storage: your browser also keeps your theme, font size and Wheel of Fortune setup, which prompts you dismissed, and how many pages you have opened, so the offer to install the app waits until you have looked around. This stays in your browser.
• Session storage: each browser tab keeps the last 15 pages you opened and the last 10 errors there, which a bug report includes if you send one. It is deleted when you close the tab.

Clearing your browser's cookies signs you out and resets these preferences.

• Your account and everything in it are kept until you remove them or ask me to delete the account.
• Sign-in sessions end after 30 days without a visit.
• Recently viewed titles are limited to the last 18.
• Declined friend requests are deleted after 30 days.
• Security counters are deleted within a day.
• Server errors are deleted after 30 days.
• Feedback is kept until it is no longer needed, or until you ask me to delete it. Its copies in Linear and Telegram are removed on the same request.
• Push subscriptions are removed when you turn notifications off, or when your browser reports that a subscription no longer works.

When an account is deleted, everything linked to it is deleted too, feedback included. Titles you added to other people's shared lists stay in those lists, without your name.

You can see and change most of your data in the app itself: unmark titles, delete lists, remove friends, clear your history, turn notifications off, and revoke extension tokens in Options.

To get a copy of your data, correct something, or delete your account and everything in it, contact me (see below). I will reply within 30 days.

Depending on where you live, for example in the EU, the UK or California, the law may give you further rights: to access, correct, delete or move your data, to object to or restrict how it is used, and to complain to your data protection authority.

UpNext is not meant for children under 13 (or under 16 where local law requires), and I do not knowingly collect their data. If you believe a child has created an account, contact me and it will be deleted.

The site is served only over HTTPS. The app reaches its database with restricted permissions, sign-in tokens from Google, Discord and Microsoft are not kept, and a strict content security policy limits what can run on the page. No system is perfectly secure, so if a breach ever affects your data, I will let you know.

If this policy changes, the date at the top of this page changes with it. Significant changes will also be announced in the app.