A clearer picture
of your privacy.

Who is responsible?

CineHunch is operated by Murat Kamci, based in Türkiye. Privacy contact: [email protected]. For other contact options, see our contact page.

Accounts and security.

When you register, we store your name, email address and a hashed password to provide your account. Sessions and security controls can process technical information such as IP addresses, browser details and request timing. We send account verification, welcome and password reset emails through our email provider, Zoho Mail. If you choose Google sign-in, we receive your Google account identifier, name, email address and email verification information to create or connect your account. We do not request access to your Gmail messages, contacts or Drive files, and we do not store Google access or refresh tokens.

Searches and recommendations.

Title searches are sent to TheTVDB. When a fresh recommendation is needed, selected title details, your mood description and chosen filters are sent to OpenAI. We do not deliberately include your account name, email or password in that recommendation request. Do not put sensitive personal information in a mood description.

We store catalogue metadata and generated recommendations so they can be reused. Recommendation requests to OpenAI use the API’s store:false setting; this does not mean the provider has no security or operational retention. The provider’s own terms govern its handling of requests.

To enforce daily search allowances, we store a hashed browser identifier, a daily keyed hash of your IP address, your account ID if signed in, the date, a request identifier and the successful recommendation result. Full input text is not stored in these allowance records; an input hash is used to recognise request retries. These records are scheduled for removal after seven days. A guest’s searches carry over when they sign in on the same browser. We record operational metrics including request status, duration, model, token usage, provider response identifiers and estimated cost. Our activity and recommendation metrics do not store the full mood text. Your current finder inputs are saved in this browser’s session storage so you can return to them.

Browser storage and outside services.

Guest shortlists and the introduction preference are stored locally in your browser. When you sign in, guest shortlist items are merged into your account and the local copy is removed after successful syncing. Account shortlists are stored on our server and are available across devices. Session cookies support login and request protection. See the cookie and storage notice for more detail.

Posters and other images may load from TheTVDB, TMDB and Unsplash. Those providers receive the technical information required to deliver their content, including your IP address. Opening a trailer loads YouTube’s privacy-enhanced player where supported, or takes you to an external video provider. These services have their own privacy practices.

With your permission, Google Analytics measures visits and interactions using cookies and technical information about your browser and device. You can decline or withdraw analytics permission in Cookie settings. Google processes this information under its own privacy policy. We do not send your recommendation prompts or account details as custom analytics events. AdSense is not installed.

Retention.

Recommendation caches normally last 60 days. Cached title searches last around 24 hours; film and series metadata is refreshed on a separate schedule and may remain in our catalogue. A scheduled cleanup is configured to remove activity events older than 90 days and expired cache entries. Recommendation-run and LLM accounting records currently have no automatic deletion schedule.

Account information remains while the account is held, subject to deletion requests and any applicable retention obligations. Browser shortlists remain until removed or browser data is cleared; finder session storage normally lasts for that tab’s session. Cookie preferences expire after six months.

Aggregate traffic counts.

We count successful public page requests by day and page category to estimate site activity, including when optional analytics is declined. Known automated traffic is counted separately using request headers, which this counter does not retain. It stores no IP address, visitor identifier or browsing history and sets no measurement cookie. Repeat visits may count more than once and bot filtering is approximate. These aggregate counts are retained for up to 90 days when scheduled cleanup runs.

Abuse prevention.

When enabled, Cloudflare Turnstile processes browser and network signals to help distinguish legitimate visits from automated abuse. This security check is separate from optional analytics consent.

Your choices and requests.

You can remove account shortlist items using the shortlist controls. Clearing browser storage only removes guest shortlist data; it does not delete your account shortlist. You can also change your password and reopen Cookie settings from the footer. Contact the operator to request access, correction or deletion of personal information; identity verification may be needed. Depending on your location, you may have additional rights, including objection, portability or a complaint to your local data-protection authority.

Purposes, providers and location.

Account and recommendation processing supports the service you request. Security and operational records help protect and maintain it. Optional tracking, if introduced, will have separate controls where consent is required. We use external hosting and API providers, which may process data in other countries. The final provider locations, applicable legal bases and transfer safeguards must be confirmed for the production deployment before launch.