Privacy Policy

Who is responsible

GeekTrade OÜ, registered in Estonia, is the data controller for EZ Critic and its sister site Boo Critic (boocritic.com). Both sites share one account system and one database. Reach us via the contact form.

What we collect

Account

email address, username, and a hashed password. If you sign in with Google or Facebook, we receive your name, email, and account ID from them; we never see their passwords.

Profile (optional)

avatar image, bio, location, favorite genres and films, an external link. Profiles are public.

Your activity

reviews, ratings, reactions, watchlists, watch history, and custom lists. Published reviews and ratings are public. Your watchlist and custom lists appear on your public profile, along with counts of films watched.

Guest reviews

a random draft token in your session ties a guest review to your browser. No account data is collected unless you register.

Contact form

name, email, message, plus your IP address and browser identifier, kept so we can answer you and handle abuse.

Technical

session records (including IP address and browser identifier) while you browse. Like most websites, our servers also keep short-lived technical logs for security and debugging. For spam prevention, review submissions store one-way hashes of IP and browser data - these cannot be turned back into the original values.

We do not ask for or intentionally collect sensitive personal data such as health, ethnicity, or beliefs.

Why we process it

Run the service

(contract) accounts, publishing your reviews, sign-in, email verification, password resets.

Keep it honest

(legitimate interest) spam and multi-account detection, moderation of new accounts, rate limiting, security logs.

Understand usage

(consent) analytics, only if you opt in - see cookies below.

Comply with law

where required.

Service email (verification, password resets, replies to your messages) is always sent. Marketing email, such as newsletters or activity digests, is sent only if you opt in (consent); every such email contains an unsubscribe link, and opting out never affects your account.

Cookies

Necessary cookies (session, security token) are always on - the site cannot work without them. Everything else is off until you say yes in the cookie banner: analytics (Google Analytics) loads only after you opt in, and we currently use no marketing cookies. Your choice is stored in your browser and you can change it any time via "Manage choices" in the cookie bar.

Who else touches your data

Google

sign-in with Google (if you use it) and Analytics (only with your consent).

Meta (Facebook)

sign-in with Facebook, if you use it.

Cloudflare

the contact form uses Turnstile to block bots; your IP address is sent to Cloudflare to perform that check. Separately, we store the IP with your contact message, as described above.

DigitalOcean

hosting and file storage. Uploaded avatars and site images are stored on DigitalOcean servers, which may be located outside the EU; transfers are covered by the provider's standard contractual clauses.

Email provider

delivers verification, password reset, and contact replies.

Film data comes from TMDB and other public sources; nothing about you is sent to them. We use OpenAI services to generate catalog content - your personal data and your reviews are not sent to OpenAI. We do not sell personal data to anyone.

We may disclose personal data where the law requires it, to respond to lawful requests from authorities, or to establish or defend legal claims. If the service is ever sold or merged, personal data may transfer to the buyer, who must keep using it consistently with this policy.

How we protect it

Traffic to EZ Critic is encrypted in transit (HTTPS). Passwords are stored only as one-way hashes - we never see them. Access to personal data is limited to people who need it to run the service. No online service can guarantee absolute security; if you find a vulnerability, please report it via the contact form.

How long we keep it

Account data

until you delete your account.

Sessions

expire after about two hours of inactivity.

Contact messages

as long as needed to handle the request and any follow-up.

Anti-abuse hashes

kept while relevant for spam prevention.

Reviews and ratings

retained after account deletion, with your name removed. Watchlists, history, custom lists, and avatars are deleted with the account.

Backups

deleted data may persist for a short time in routine backups before those expire.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest. You can withdraw cookie consent at any time without affecting anything else, and unsubscribe from marketing email via the link in any such message. You can delete your account yourself in profile settings. For anything else, use the contact form - we answer within a month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

Age limit

EZ Critic is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes

If this policy changes in a way that matters, we will announce it on the site. The date at the top always reflects the current version.