Privacy

What Bingr keeps about you, why it keeps it, and what it never does with it. Written from the database rather than from a template — every claim here is one you could check.

Last updated August 23, 2026

Not settled yet

5 things these pages cannot answer honestly. They are decisions rather than facts about the code, so they are listed here instead of guessed at.

Who is the data controller, and at what address?
Bingr has no company behind it yet, and the answer is a legal decision — not something the code can be read for.
Which lawful basis covers each of these uses?
Consent, contract and legitimate interest do not cover the same things, and picking one is not an engineering call.
How long do backups keep a deleted account?
Deletion from the live database is immediate and verified. What a provider's backup retains after that has not been established.
How old do you have to be to hold an account?
Nothing in the code asks, and the answer decides both an age rating and which consent rules apply.
Which law governs these terms, and what liability is disclaimed?
Both follow from where the service is established, which is the first question on this list.

The unusual part, first

Where you are in a show is the most personal thing Bingr holds, and it is also how Bingr works. It decides what the server sends you: an episode past your point is not hidden in your browser — its title, its summary and its image never leave the machine. And it decides what other people are allowed to see of you.

So your reading position is not a by-product of using this app. It is the thing the app is built out of. That is worth knowing before the list below, because it is the reason the list is as long as it is.

Your account

You sign in with an email address. There is no password to choose and none to lose — we email you a code, you type it, and that is the whole of it.

Your address is held by Supabase, who authenticate you. None of our own tables has a column for it: your profile row carries a handle, a display name, a photo, a time zone and your visibility settings, and that is all. The first time you sign in, the handle and the name are made up for you from your address — you can change both, and most people do.

Your address is used for one thing: sending you a sign-in code. There is no newsletter, no product announcement, no digest, and no code in this application that could send one. If you continue with Apple or Google instead, we receive the name and profile picture they hand over, and nothing else.

Your browser tells the server which time zone it is in, and we keep it, because “watched last night” has to mean your night rather than the server's. It also tells us which region to check streaming availability for; that one is used and thrown away.

What sits on your device

A cookie that says whether you are probably signed in. It holds a single character and no token — it exists so the server can render the app instead of the sales pitch.
A cookie of about forty bytes — a date and a number — that helps diagnose sign-in trouble. The server never reads it.
Your session token, your theme choice, and a small sign-in log, all in your browser's storage. The log records the names of storage keys and never their contents, and nothing sends it anywhere.
Scroll positions, for the length of the tab, so going back lands where you left.

What you watch

Every episode you tick, and every one you untick, is kept as an event — with the date and the hour where you were, and how far that was from UTC. That is more than it sounds like: it is a record of when you watch, which is a record of your evenings. It is kept because your own statistics are built from it, and a plain UTC timestamp stops being yours the moment you travel.

From those events we keep a running picture per show — how far you are, how many episodes, how many minutes — plus your ratings, your rewatch passes and which shows you are following.

Who sees any of it is yours to set, in Settings. Out of the box your profile page can be opened by anyone, while your numbers and your shows are limited to people who follow you. How far you are in a show is never shown to anyone, at any setting. The leaderboard is the one thing you have to switch on yourself: nobody is on it by default.

History you bring with you

If you import a history file, the file itself is not stored. It is read, and the rows we recognised are kept — so that an import can be replayed when the catalogue improves, and so that you can export those rows back out. Rows we failed to match are kept too, with the reason, because that is the only way to fix a file by hand.

Nothing expires them. They stay until you delete that import from your history, or delete your account.

Notifications

Only if you turn them on. Doing so stores one address per device — the one your browser gives us — along with the two keys used to encrypt what we send there. Delivery goes through your browser vendor's push service, which learns that a message is on its way to that device, though not what it says.

Notifications are anchored like everything else: “someone finished Severance” is a spoiler if you have not, so it does not reach you.

Reports

A report keeps the reason, what was reported, and who reported it. It is never public and is never shown to the person reported — nobody is told who reported them. What happens next is in the community guidelines.

A report outlives your account. If you leave, the report stays with moderation and your identifier is removed from it — otherwise closing an account would erase the evidence against it.

What we count

Two counters, and they are worth describing exactly, because “we collect analytics” usually means something much larger than this.

The first counts how far people get through the welcome tour: which panel, reached or skipped, on which day. The second counts arrivals on a show page by where they came from — one of five words: search, social, direct, internal, other.

Between them they are five columns and an integer. There is no identifier, no session, no IP address, no user agent and no referring URL in either table — the page you came from is reduced to one of those five words before anything is written, and the words are all that exist to write. Nothing is placed on your device to make this work, and no script runs in your browser for it. We count arrivals, not people: reloading counts twice, and we would rather have that than know who reloaded.

Crawlers and link previews are left out, since counting them would make the numbers flattering and wrong on day one. Beyond those two counters there is no analytics in this application at all — no third-party tag, no session recording, no error-reporting service. Our server writes the path of a request and any error message to its own log; addresses and identifiers are not part of it.

Who else touches it

Bingr is one small application, so most of this list is infrastructure rather than partners. Nothing here buys data from us, and nothing here is paid in data.

Fly.io · London
Runs the server that renders every page.
Your device talks to it directly.
Supabase · AWS eu-west-1, Ireland
Holds the database, the sign-in identity, and uploaded profile photos.
Your device talks to it directly.
Resend · eu-west-1
Delivers the sign-in email, and nothing else.
Only our server talks to it.
TMDB
Show data, and every poster and still your browser loads.
Your device talks to it directly.
TheTVDB
Episode ordering, when TMDB gets a series wrong.
Only our server talks to it.
WorldShareHub
Where a series can be watched from, country by country.
Only our server talks to it.
Your browser vendor
Delivers push notifications, only if you turn them on.
Your device talks to it directly.

One of those deserves a sentence of its own. Posters and stills are loaded straight from TMDB by your browser — we do not put them behind our own address. TMDB therefore sees the network address of every device that displays one, signed in or not. It is the only party your browser reaches that is not us, and proxying every image would be the way to change that.

The server runs in London and the database is in Ireland. Sign-in email is sent from a European region too. Nothing is deliberately routed outside Europe, though a request that crosses the public internet does not promise where it has been.

Leaving

Deleting your account happens immediately. There is no grace period and no way back.

The button is in Settings, behind typing your own handle. It removes your sign-in identity first, then your profile and everything attached to it: your events, your progress, your ratings, your messages, your follows, your blocks, your imports and any photo you uploaded. Removing the identity first is deliberate — if the second half failed, what would be left is an unreachable profile rather than a working login onto emptied data.

Two things survive on purpose. Reports you filed stay with moderation, without your identifier. And the two counters above keep their totals, since they never knew you were in them.

Before you go: there is no one-click export of everything yet, and pretending otherwise would be the wrong thing to write here. What can be exported today is the rows an import brought in, from your import history.

Asking

Questions about any of this, or about your own data, go to hello@bingr.watch. If something on this page turns out not to match what the app does, that is a defect and it will be treated as one.