I'm Watching This
EN FR

Privacy Policy

Last updated: October 4, 2026

I'm Watching This ("the app", "we", "us") is a tracker for TV shows and movies operated by Code Éclair (NEQ 2271379655), based in Québec, Canada. This policy explains what we collect, why, and how we look after it. The short version: we keep what the app needs to work and nothing else, and we don't sell your data or run advertising trackers. Our only analytics are privacy-friendly and anonymous (Plausible, which we self-host, no cookies, can't identify you).

What we collect

  • Account details: your email address, a securely hashed password if you set one, any passkeys you add (their public key; the private key stays on your device), and the language, country and time zone you choose.
  • What you track: the shows and movies you add, their status, your ratings, the dates you watched them, and the episodes you tick off. You add these yourself.
  • Profile and friends: your handle, who you are friends with, and your profile's visibility. A profile is private by default; you can make it visible to your friends or public, and only then can others see it.
  • Imports: when you import a file from another tracker, we keep the rows read from it until the import runs, so you can review them first; they are deleted when the import finishes, fails or is cancelled. A short summary of your five most recent imports stays; older ones are deleted.
  • Notifications: notices for you (such as a season premiere, a movie release or a friend request) wait in an in-app inbox. If you turn on push notifications on a device, we store that browser's push subscription (an endpoint address and its keys) and the browser's user agent.
  • Feedback: a message you send from the Feedback page is stored with your account and emailed to us, with your address as the reply-to so we can answer.
  • A security log: account events such as sign-ins, with the IP address and device. It is kept for up to 90 days (see Data retention).
  • Basic technical data: standard server logs (such as IP address and timestamps) needed to run and secure the service.

For basic web analytics we use Plausible, an open-source, privacy-friendly analytics tool that we host on our own servers, to see aggregate traffic (such as how many people visit and which pages are popular). Because we self-host it, no analytics data is sent to any third-party provider. It is cookieless, collects no personal data, sets no persistent identifiers, and does no cross-site tracking, so it cannot identify you as an individual. We do not use Google Analytics, ad pixels, or advertising trackers, and we do not sell or share your data for advertising. To understand product health we also keep a simple internal dashboard of aggregate counts (e.g. number of users and tracked titles), not individual tracking.

How we use it

  • To provide the app: your library, your progress, Up next, and the calendar.
  • To send essential account emails: email confirmation, a welcome message once your address is confirmed, password resets, sign-in links, and security alerts. Everything else you hear from us is in the in-app inbox, or in a push notification if you turned those on.
  • To keep the service secure and prevent abuse.

We do not sell your data or share it for advertising.

Where the shows and movies come from

Titles, posters, overviews and air dates come from The Movie Database (TMDB). When you search, our server asks TMDB on your behalf: the search text goes out, your account details do not. Poster images are served from our own servers (we keep a copy of the ones the app shows), so your browser does not contact TMDB. The "where to watch" lists come from JustWatch through TMDB and are looked up for the country in your profile. This product uses the TMDB API but is not endorsed or certified by TMDB. Air times come from TVmaze: our server asks it about shows by their public ids only.

Where your data lives

  • Our servers are hosted at OVH, in their Beauharnois (BHS) datacentre in Québec, Canada. So your primary data stays in Québec.
  • Traffic is served through Cloudflare's DNS and a Cloudflare Tunnel (Cloudflare is a US company), so the origin server is not exposed directly to the internet. As a proxy, Cloudflare handles requests in transit at its nearest global edge and keeps limited technical logs (such as IP addresses) for security and performance; it may also cache public files like our app's scripts. Your account and your library are not stored on Cloudflare, they live on our servers at OVH.
  • Backups are encrypted on our server before they leave it, then stored with our backup partner BorgBase, in the United States. BorgBase holds only encrypted data it cannot read. Backups are kept for up to three months.
  • Account emails (confirmation links, password resets, sign-in links, security alerts) are sent through Resend (resend.com), a US email provider. Resend processes your email address and the message content to deliver it, and keeps limited delivery logs.
  • If you turn on push notifications, they are delivered through the push service of your browser's maker (for example Google, Mozilla or Apple), which receives the subscription address and the message. The message content is encrypted for your device, so the push service cannot read it. Turning push off on a device, or deleting your account, removes the subscription.
  • Web analytics are collected by Plausible, which we host ourselves, on the same infrastructure as the rest of our data (OVH, in Québec). No analytics data is sent to any third party: it stays on our servers. Plausible collects only anonymous, cookieless page events (no account or library data, nothing that identifies you).

Your primary data stays in Québec (OVH BHS). Encrypted backups are held in the US (BorgBase sees only ciphertext), traffic is proxied by Cloudflare's global network, and account emails are delivered by Resend in the US. Searches leave our server for TMDB in the US with no account details attached. Push notifications, if you turn them on, go through your browser maker's push service, encrypted for your device. Our web analytics stay on our own servers (self-hosted Plausible), with no transfer to a third party. These transfers are covered by each provider's privacy policy (linked above).

Cookies

We use an essential, secure, httpOnly session cookie that keeps you signed in (and, during a two-step sign-in, a short-lived one that holds your place until you enter the code). We also set a small cookie that remembers your language, so the app opens in it. We don't use advertising or tracking cookies. Your theme choice is kept in your browser's local storage, not on our servers.

How we protect it

  • Your connection is encrypted in transit with HTTPS.
  • Passwords are hashed, not stored in plain text.
  • Two-factor authentication and passkeys are available on any account, and are optional.
  • Rate limiting, a short lockout after repeated failed sign-ins, and revocable login sessions guard against abuse; changing your password signs out your other devices, and "log out everywhere" revokes every session.
  • Servers are locked down and hosted with a reputable provider (OVH).
  • Data is backed up automatically, multiple times a day, encrypted before it leaves our server.

Your choices

  • Export: download your whole library, in JSON and CSV, from Settings at any time. It is yours to take somewhere else.
  • Access & correct: everything you store is visible and editable in-app.
  • Visibility: choose who sees your profile (only you, your friends, or everyone) in Settings.
  • Push: turn push notifications on or off for each device in Settings.
  • Delete: delete your account and its data; residual copies in encrypted backups age out within three months.

Data retention

We keep your data for as long as your account is active. When you delete your account we remove your data from the live service; encrypted backup copies are cycled out within three months.

To protect accounts and investigate abuse, we keep a security log of account events (for example sign-ins, with the IP address and device). It is stored separately from your library, kept for up to 90 days, then deleted. Because its only purpose is to catch an accident or a compromise, this log can briefly outlast the deletion of an account, but no more than 90 days. After that, with backups also cycled out, nothing about a deleted account remains.

Session records (what keeps you signed in between visits, along with the IP address and device they were opened from) expire 14 days after your last visit and are deleted within a day after that.

Notifications you have read are deleted 90 days after you read them; unread ones stay in your inbox. A push subscription is removed when you turn push off on that device, when the browser's push service reports it is no longer valid, or when you delete your account.

The demo is a private sample account. It is deleted, with everything in it, about a day after it starts, unless you keep it by confirming an email address.

We also keep a minimal, non-identifying record of deletions (an internal account identifier and the date, no email or library data) so that, if we ever restore a backup, deleted accounts stay deleted.

Children

I'm Watching This isn't directed at children and isn't intended for anyone under 16.

Changes

We may update this policy from time to time. When we do, we'll change the date at the top of this page.

Person in charge of personal information

Code Éclair is responsible for the personal information I'm Watching This holds. For any question, or to access, correct, or delete your information, contact our person in charge of personal information (privacy officer), Danny Ferguson, at privacy@imwatchingthis.com.

If you're not satisfied with our response, you can file a complaint with Québec's Commission d'accès à l'information.

Contact

Questions about your privacy? Reach us through the Contact page or at privacy@imwatchingthis.com.