Privacy Policy

Information We Collect

We collect information you provide directly when using BackRow:

• Account information: email address, username, and password when you create an account
• Profile information: display name, avatar, and bio that you choose to provide
• Activity data: movie ratings, nominations, reviews, discussion posts, and festival participation
• Club data: clubs you create or join, festival settings, and member interactions
• Communications: messages you send through contact forms or feedback features

Automatically Collected Information

When you access the Service, we may automatically collect:

• Device and browser information (type, version, operating system)
• IP address and approximate location
• Pages visited and features used
• Referring website or source

Third-Party Services

BackRow integrates with the following third-party services:

• The Movie Database (TMDB):We use TMDB's API to provide movie information, posters, and cast details. TMDB's use is governed by their own privacy policy and terms of use.
• Supabase: Our backend infrastructure provider that stores your account data and handles authentication securely.
• Vercel: Our hosting provider that may collect standard web analytics data, subject to your cookie preferences.

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account
• Process your movie ratings, nominations, and festival participation
• Enable club features, discussions, and member interactions
• Send transactional emails (account verification, password resets)
• Respond to your inquiries and support requests
• Monitor and analyze usage to improve the Service
• Detect and prevent fraud, abuse, or security issues

Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication, session management, and core functionality. These cannot be disabled.
• Analytics cookies: Used to understand how visitors interact with the Service. These are only set with your explicit consent via our cookie preferences banner.

You can change your cookie preferences at any time on our cookie settings page. If your browser sends a Global Privacy Control (Sec-GPC: 1) signal, we honor it automatically and leave analytics off without showing the banner.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encrypted connections (HTTPS), secure authentication, row-level security policies on our database, and input sanitization. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Data Retention and Deletion

We retain your personal information for as long as your account is active. You can delete your account at any time through your profile settings.

Deletion is a two-step process: when you confirm, we immediately sign you out, anonymize your profile (email, username, display name, avatar, bio, social links), remove your email from our transactional-email provider (Resend) so you stop receiving system messages, and set your account to the deleted state. Your account is then held for 30 daysin case you want to restore it — contact support during that window to reverse the deletion. After 30 days your account is permanently removed, including ratings, nominations, private notes, notifications, watch history, and club memberships. Content posted on other users’ threads (comments, shared club announcements) is kept with your authorship cleared so the surrounding conversation stays coherent.

Discussion comments you delete from a thread are hidden immediately to preserve the conversation structure, then permanently removed after 30 days.

You can also request a copy of your data at any time — we generate a ZIP containing your profile and every row you authored and email you a private download link that expires in 7 days.

Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data (available via account deletion)
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to processing of your personal data for certain purposes
• Withdraw consent: Withdraw consent for analytics cookies at any time via the cookie preferences banner

To exercise any of these rights, please contact us at the address below.

California Privacy Rights (CCPA)

California residents have the right to opt out of the sale or sharing of personal information under the CCPA. BackRow does not sell personal information, and our only “share” activity under the CCPA’s broad definition is optional analytics. You can opt out in two ways:

• Enable Global Privacy Control in your browser. We honor the signal automatically without showing a banner.
• Manage preferences on our cookie settings page.

See Do Not Sell or Share My Personal Information for the full CCPA disclosure and alternative request methods.

Children's Privacy

BackRow is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@backrow.dev or through our contact page.