Privacy Policy
This Privacy Policy explains how Rollit ("Rollit", "we", "us") collects, uses, and shares information when you use rollit.site and its features (the "Service"). Rollit is a community site for rating and discussing movies and TV shows.
1. Information we collect
Information you provide
- Account details — a username, an email address, and (for email sign-up) a password. Passwords are never stored by us in readable form; they are hashed and managed by our authentication provider.
- Google sign-in — if you choose "Continue with Google", Google shares your name, email address, and profile identifier with us so we can create or match your account. We do not receive your Google password.
- Profile content — an optional profile picture (avatar) and your privacy setting.
- Content you create — ratings and scores, written "hot takes" and reviews, predictions, Frames (posts), comments, reactions, lists, watchlists, watched/rewatch history, calendar events and tracked shows, watch-party invitations, versus/duel picks, and who you follow.
Information collected automatically
- Technical data — when you load the Service, our hosting and security provider (Cloudflare) automatically receives your IP address, browser type, and request metadata to serve the site and protect it from abuse.
- Device storage — we store a login session token and some preferences and cached data in your browser (see Cookies & local storage).
We do not knowingly collect government IDs, payment card numbers, or precise geolocation, and the Service takes no payments.
2. How we use it
- To create and operate your account and keep you signed in.
- To store and display your ratings, posts, lists, and other content, and to power aggregate scores, rankings, and recommendations.
- To enable social features — following, comments, reactions, watch parties, and notifications.
- To maintain the integrity of scores (e.g. detecting manipulation) and to moderate content and enforce our Terms.
- To communicate with you about your account, such as sign-up confirmation and password resets.
- To secure, debug, and improve the Service.
We do not sell your personal information, and we do not use it for third-party advertising.
3. Legal bases (for users in the EEA/UK)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the account and features you request); legitimate interests (to secure the Service, prevent abuse, and keep scores honest); consent (where required, e.g. optional features you turn on); and legal obligation where applicable.
4. How we share it
We share information only in these situations:
- With other users — content you make public (see section 7) is visible to others and, for public profiles, to anyone on the internet.
- With service providers that operate the Service on our behalf (section 5), under their terms and privacy policies.
- For legal reasons — if required by law, or to protect the rights, safety, or property of Rollit, our users, or the public.
- Business transfer — if the project is transferred to another operator, your data may transfer with it, subject to this Policy.
5. Third-party services
The Service relies on the following third parties. Each has its own privacy policy.
| Provider | Purpose | What it may receive |
|---|---|---|
| Supabase | Database, authentication, and file storage (accounts, content, avatars) | Your account data and content, IP for auth requests |
| Cloudflare | Website hosting, CDN, and security | IP address, request metadata |
| Optional "Sign in with Google" | Handled by Google when you choose it | |
| TMDB (The Movie Database) | Movie/TV metadata, posters, and trailers | Title identifiers only — no account data |
| YouTube / Google | Embedded trailer playback | Your IP and cookies when a trailer loads |
| Wikidata | Awards data lookups | A public title/person identifier — no account data |
| Google Fonts & jsDelivr | Fonts and icons | Your IP when these assets load |
6. Cookies & local storage
Rollit itself does not use advertising or cross-site tracking cookies. We use your browser's storage for essential functions:
- Login session — a token kept in local storage so you stay signed in.
- Preferences — such as your light/dark theme choice and onboarding progress.
- Caching — temporary movie/TV data cached to reduce load times.
Third-party providers listed above may set their own cookies when their content loads. Clearing your browser storage will sign you out and remove cached data.
7. Public content & your privacy controls
Rollit is a social service, so some information is visible to others by design:
- Your username and profile, and your public posts, lists, and comments.
- Your ratings — each rating can be marked public or private. Private ratings are hidden from other users but still count toward aggregate scores in a way that does not identify you.
- Your account privacy setting (public/private) controls whether your profile and activity are broadly visible. Predictions and Frames inherit your account privacy.
You can change your privacy setting and edit or delete your content at any time from your settings and profile.
8. Data retention
We keep your account and content until you delete them or delete your account. When you delete your account, we remove your personal profile and content from our active database. Backups and provider logs may persist for a limited period before being overwritten, and fully anonymized/aggregated data (which no longer identifies you) may be retained.
9. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these directly:
- Access & correction — view and edit your profile, username, email, and content in-app.
- Deletion — delete your account from Settings, which removes your profile and content.
- Other requests — email privacy@rollit.site and we will respond within a reasonable time.
EEA/UK users may also lodge a complaint with their local data protection authority.
10. Security
We use reputable providers, encrypted connections (HTTPS), hashed passwords, and database access rules that restrict each user to their own data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11. Children
The Service is not directed to children under 13 (or the minimum age required in your country, such as 16 in parts of the EEA). We do not knowingly collect personal data from children below that age. If you believe a child has provided us data, contact us and we will delete it.
12. International transfers
Our providers may process and store data on servers located outside your country, including outside the EEA. Where required, such transfers rely on appropriate safeguards (such as the providers' standard contractual clauses).
13. Changes to this Policy
We may update this Policy from time to time. We will change the "Last updated" date above and, for material changes, provide a more prominent notice. Continued use of the Service after changes take effect means you accept the updated Policy.
14. Contact
Questions or requests: privacy@rollit.site.