Privacy Policy

CineFlixo (“we”, “us”, “our”) operates the website cineflixo.com. This page describes what personal data we process, why we process it, how long we keep it, and the choices you have. We aim to collect the absolute minimum data required to run the catalog.

Summary in One Paragraph

We use lightweight first-party analytics to understand which pages are popular. We anonymize IP addresses, do not run third-party advertising tracking, do not sell or rent data, do not require an account, and store everything on a single server in the European Union. Web push notifications and watchlists are strictly opt-in.

Data We Collect

Visit Analytics (Automatic)

• Page views — the URL of the page you visit and the referrer if any.
• Sessions — a short-lived identifier (cookie or local storage) used to count unique sessions, expiring within 30 minutes of inactivity.
• Anonymized IP — your IP address is truncated (last octet zeroed for IPv4, last 80 bits for IPv6) before storage. We never store the raw IP.
• Approximate country — derived from a local GeoIP lookup on the truncated IP. Used to show region-relevant content rows.
• Browser type and language — read from the User-Agent and Accept-Language headers, kept in aggregate form.

Optional Account Data

• Email and password hash if you create an account. Passwords are stored as salted hashes and never in plaintext.
• Watchlist and viewing history tied to your account, used only to power the watchlist features.
• Comments you post on titles, displayed publicly with your chosen display name.

Push Notifications (Opt-In)

If you accept the push permission prompt, your browser's push subscription endpoint is stored so we can deliver release alerts. You can revoke it at any time in your browser settings or by emailing [email protected].

Things We Do Not Collect

• We do not record raw IP addresses.
• We do not use third-party cross-site tracking pixels.
• We do not collect your real name, postal address or phone number.
• We do not record what you type into search beyond aggregate counts.

How We Use Data

• To operate, secure and improve the catalog.
• To detect abuse, scraping and abnormal traffic patterns.
• To show region-relevant rows (for example, “Trending in India”).
• To deliver web-push alerts that you opted in to receive.
• To respond to your support and privacy requests.

Where We Store Data

All analytics, watchlists and account data are stored in a single SQLite database on one server hosted in the European Union. Backups are encrypted and retained for 30 days. We do not synchronize data with third-party warehouses or analytics SaaS.

Sharing With Third Parties

We do not sell, rent or trade personal data. We may share data only in the following narrow situations:

• With our hosting provider strictly as needed to run the server.
• With law-enforcement or courts in response to a valid, binding legal order in our jurisdiction.
• In aggregate, non-identifiable form (for example, “42% of visitors come from India”) for editorial or marketing communication.

Cookies

We use a small number of strictly functional cookies and one first-party analytics cookie:

• session — keeps you logged in if you create an account; expires when you log out.
• prefs — remembers UI choices like preferred language tab; persists for 12 months.
• _hf_sid — first-party analytics session identifier; expires after 30 minutes of inactivity.

We do not set advertising or social-tracking cookies. Embedded video players from third-party providers may set their own cookies; please consult those providers' policies.

Your Rights (GDPR & Equivalents)

If you are a resident of the European Union, the United Kingdom, or a country with comparable laws (including India's DPDP Act), you have the following rights with respect to your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct data that is inaccurate.
• Right to erasure — ask us to delete your account and associated data.
• Right to portability — receive your data in a structured, machine-readable format.
• Right to object — opt out of any further processing where applicable.
• Right to withdraw consent — for example, by disabling push notifications.

To exercise any of these rights, email [email protected]. We respond within 30 days.

Children's Privacy

CineFlixo is intended for an adult audience. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact [email protected] and we will delete the records.

Security

All connections to cineflixo.com are encrypted with TLS 1.3. Account passwords are hashed with a memory-hard algorithm. Server access is restricted to SSH key authentication. We perform regular security updates of the operating system and application stack.

Changes to This Policy

We may update this policy as the catalog evolves. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be announced on the home page for at least 14 days before they take effect.