Privacy Policy

This policy covers ezcritic.com. There is no app, no SDK and no partner network hiding behind that sentence. One website is the whole surface.

Account

Email address, username and a hashed password. If you sign in with Google or Facebook, we receive your name, email and account ID from them; we never see their passwords.

Profile

Optional things you add: avatar, bio, location, favorite films, an external link. All of it is public.

Activity

Reviews, reactions, watchlists and lists. Published reviews and ratings are public. Your watchlist appears on your public profile.

Guest reviews

A random draft token in your session ties a guest review to your browser. No account data is collected unless you register.

Contact form

Name, email, message, plus your IP address and browser identifier, kept so we can answer you and handle abuse.

Technical

Session records including IP address and browser identifier while you browse, and short-lived server logs for security and debugging. For spam prevention, review submissions store one-way hashes of IP and browser data - these cannot be turned back into the original values.

We do not ask for or intentionally collect sensitive personal data such as health, ethnicity or beliefs. Please do not put it in your bio.

We use this information for exactly four things:

• Running your account and keeping it secure
• Showing your public activity to other users
• Fixing problems when the site misbehaves
• Counting visits so we know what works

That's the complete list. If we ever need more, we'll ask first.

Run the service

(contract) accounts, publishing your reviews, sign-in, email verification, password resets.

Keep it honest

(legitimate interest) spam and multi-account detection, moderation of new accounts, rate limiting, security logs.

Understand usage

(consent) analytics, only if you opt in - see cookies below.

Comply with law

where required.

Service email (verification, password resets, replies to your messages) is always sent. Marketing email, such as newsletters or activity digests, is sent only if you opt in; every such email contains an unsubscribe link, and opting out never affects your account.

Your reviews, ratings and lists are public by design. This is a review site; publishing is the point.

Anonymous reviews show an alias instead of your username. Nobody, including other members, can connect an alias back to your account. What counts as fair conduct is covered in the Community Policy.

Necessary cookies (session, security token) are always on - the site cannot work without them. Everything else is off until you say yes in the cookie banner: analytics loads only after you opt in, and we currently use no marketing cookies. Your choice is stored in your browser and you can change it any time via "Manage choices" in the cookie bar.

Google

Sign-in with Google (if you use it) and Analytics (only with your consent).

Meta (Facebook)

Sign-in with Facebook, if you use it.

Cloudflare

The contact form uses Turnstile to block bots; your IP address is sent to Cloudflare to perform that check. Separately, we store the IP with your contact message, as described above.

DigitalOcean

Hosting and file storage. Uploaded avatars and site images are stored on DigitalOcean servers, which may be located outside the EU; transfers are covered by the standard contractual clauses.

Email provider

Delivers verification, password reset and contact replies.

Film data comes from TMDB and other public sources; nothing about you is sent to them. We use OpenAI services to generate catalog content - your personal data and your reviews are not sent to OpenAI. We do not sell personal data to anyone.

We may disclose personal data where the law requires it, to respond to lawful requests from authorities, or to establish or defend legal claims. If the service is ever sold or merged, personal data may transfer to the buyer, who must keep using it consistently with this policy.

Traffic to EZ Critic is encrypted in transit (HTTPS). Passwords are stored only as one-way hashes - we never see them. Access to personal data is limited to people who need it to run the service. No online service can guarantee absolute security; if you find a vulnerability, please report it via the contact form.

At any time you can:

• Edit or delete your reviews
• Change what your profile shows
• Export a copy of your data
• Delete your account and everything that goes with it

We keep account data while your account exists. Delete the account and personal data goes with it within 30 days.

Backups age out on a fixed schedule. Reviews you chose to publish under an alias remain, with no account attached.

Account data

Until you delete your account.

Sessions

Expire after about two hours of inactivity.

Contact messages

As long as needed to handle the request and any follow-up.

Anti-abuse hashes

Kept while relevant for spam prevention.

Reviews and ratings

Retained after account deletion, with your name removed. Watchlists, history, custom lists and avatars are deleted with the account.

Backups

Deleted data may persist for a short time in routine backups before those expire.

Under the GDPR you can ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest. You can withdraw cookie consent at any time without affecting anything else, and unsubscribe from marketing email via the link in any such message. You can delete your account yourself in profile settings. For anything else, use the contact form - we answer within a month. You can also complain to your local data protection supervisory authority.

EZ Critic is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

If this policy changes in a way that matters, we'll say so on the site before it takes effect. Questions belong in the contact form.