Privacy Policy

What we collect

Account information

To create an account you sign in one of two ways:

• Sign in with Apple. Apple gives us a stable account identifier and an email address. If you choose to hide your email, Apple provides a private relay address instead of your real one.
• Email one-time code. You enter your email address and we send a single-use code to sign in. We store your email address to identify your account and deliver sign-in codes.

You may also use the app anonymously before signing in; in that case a temporary account holds your activity until you sign in, at which point it migrates onto your real account.

Your film data

The app stores the film activity you create, which may include:

• Your watch history and the films you mark as watched
• Your ratings, your watchlist, and what you're currently watching
• Reviews and notes you write
• Your conversations with Reely, the in-app AI film companion, and the per-film chats you start
• A derived taste profile — vector embeddings that numerically represent your film preferences, generated from the activity above
• Optionally, the films, ratings, diary entries, and reviews from a Letterboxd export that you choose to import or sync

Website forms and film picker

If you subscribe to the newsletter on our website, we collect your email address to keep a mailing list for new taste writing and Intertitle updates. We also collect the signup source, the page path where you signed up and the referring website's hostname. We submit your email address to Resend Contacts as a subscribed contact. The signup analytics we send to PostHog include your email address as an identifier, an event property and a person-profile property, together with those signup details.

You can try the website's film picker without an account. The film-search text you enter is sent to our application server and TMDB to find matching titles. The films you select and films already shown are sent to our server to generate a pick. To write the recommendation note, we may send the selected films' titles and years and the recommended film's title, year and director to Anthropic. The picker can also trigger retrieval of film metadata from TMDB and embeddings of shared film descriptions through Voyage AI.

If you contact support by email, we use the email address and message you send to respond.

Operational data

• Website analytics and browser storage — On intertitle.app, PostHog records website activity such as page visits, page exits, clicks, form changes and submissions, with information such as page and referrer URLs and browser and device details. Download-button events include the source category and button location. PostHog uses generated browser identifiers stored in first-party cookies and local storage to link visits. Its analytics cookie has a 365-day expiry that may be renewed on later visits; local storage has no built-in expiry. Separately, we remember the first source category in the it_source cookie for up to 90 days and in tab session storage so later download clicks retain that source. The URLs recorded by website analytics may include query parameters and fragments, and event details may include campaign tags. PostHog also uses tab session storage for window identifiers.
• Usage, rate-limit and request records — For example, how many AI messages you've sent today or how recently you synced Letterboxd, so we can enforce fair-use limits and bound costs. For public website film searches, picks and download-click requests, we also store the network address with request counters. These are raw network addresses, separate from the one-way hashes used for download attribution. Our application API also records technical request details such as the requested path, method, response status and timing, and can send error and rate-limit events to PostHog and error diagnostics to Sentry.
• Crash and error diagnostics — when something breaks, we capture technical error information (such as the error and where it happened) to fix bugs, via Sentry
• Notification details — if you allow notifications, your device's push token, the app version, and your device's time zone, so we can deliver notifications and keep them quiet at night
• How you found Intertitle — when you start using the app, we record where you came from: the website that linked you and its campaign tag, or, if you installed after tapping an Apple Ads ad, the campaign, ad group and keyword numbers Apple returns when the app asks Apple's AdServices (Apple sends no device identifier and nothing about your activity in other apps). We keep this record with your account and delete it with your account
• Download and shared-link visits — when you tap Download on our site or open a link someone shared, whether or not you then install, we store a one-way hash of the network address the visit came from, so that if the app first opens from that address within 72 hours we can tell the visit led to it. The hash is not tied to any account and is deleted within four days

How we use it

We use the data above to run and improve the app and website, provide the features you request, manage newsletter subscriptions, and understand how people find Intertitle:

• To authenticate you and keep you signed in
• To send you one-time sign-in codes by email
• To keep the newsletter mailing list for new taste writing and Intertitle updates you ask to receive
• To generate your personalized “tonight” recommendations and “more like this” picks
• To power Reely's replies, synthesize reviews from your chats, and build your year-in-review taste archetype
• To store your film journal, show it back to you, and show it on your public page if you have one
• To show you your Activity and send you the notifications you allow
• To keep the service reliable and diagnose problems
• To learn which links and campaigns bring people who stay, so we spend on the right ones

We do not use your data to target ads, and we do not sell or rent your personal information to anyone. The app itself contains no advertising or third-party tracking SDKs. To understand and improve Intertitle and our website, we record product events such as account creation, imports and feature usage on our servers and send them to PostHog tied to your account ID. Our website also sends the website events and browser identifiers described above directly to PostHog. We use these analytics for ourselves, never to target ads or for cross-app tracking. Newsletter signup analytics also include your email address and signup details as described above.

What other people can see

When you claim a username, you get a page at app.intertitle.app/u/<username>. Pages are public by default, and you can make yours private at any time in Settings.

• On a public page, anyone, including people who aren't signed in, can see your username, display name, photo and bio, when you joined, your Top Four and loved films, how many films you've logged and loved, your follower and following counts, your top genres and directors, a chart of your ratings, your recent logs and ratings, and the notes on your logs, including reviews you import from a Letterboxd export. Your logs and notes also appear to people who follow you and on the pages of the films you log.
• On a private page, none of this is shown to anyone else, and your notes are visible only to you. People you follow, and people who follow you, can still see your username, display name and photo in their follower and following lists.
• Replies you post on someone's log are visible to anyone who can see that log. If your page is private, only you and the log's owner see your reply, and the owner sees your username with it. The owner of a log can remove any reply on it.
• If your page is public and you've rated enough films, other signed-in members may see a taste-match percentage next to your name: how close their taste is to yours, compared with other members. It doesn't show your ratings. No match percentage is ever shown for a member whose page is private.
• Your conversations with Reely are never public.

Activity

Each member has an Activity inbox in the app that shows what happened to them in the last 90 days. Only that member sees their own Activity.

• When you act on someone. If you follow someone or reply to their log, they see it in their Activity with your username, and with your display name and photo if your page is public. This also applies when your page is private: they see your username, but not your display name or photo. A reply shows its first 80 characters.
• Stubs and likes. When you give a ticket stub to someone's log or like their reply, they see in their Activity for 90 days that it was you (your handle, even if your page is private). This only applies to stubs and likes you give after the app has told you so; earlier ones stay an anonymous count and never show who gave them.
• When you reply after someone. If you reply on a log where another member replied before you, they see your username and the start of your reply in their Activity. This happens only if your page is public.
• What your followers see. If your page is public, people who follow you see in their Activity when you change your Top Four, and when you rate a film on their watchlist 4★ or higher on a public log and they haven't logged it yet, with your rating.
• How items go away. Activity is worked out from what still exists each time it's opened. If you unfollow, delete a reply, take back a stub or like, delete your account, or either of you blocks the other, the items go away. If a log becomes private or is deleted, the Activity items about it go away too. Making your page private removes your Top Four, watchlist and reply-after-you items, but the people you followed, replied to, stubbed or liked still see your username on those items.

Notifications

If you allow notifications, the app can tell you when someone follows you, replies to your log, replies after you on someone else's log, or rates a film on your watchlist 4★ or higher. Stubs, likes and Top Four changes never send a notification; they stay in Activity.

• A notification can appear on your lock screen, depending on your iPhone's notification preview settings. It can include the other member's username, the film's title, a star rating, the username of the log's owner, and, for a reply to your log, the first 80 characters of that reply.
• A notification names only members with public pages who haven't blocked you and whom you haven't blocked. A follow from a member whose page is private sends no notification of its own, though it can be counted in “and 2 others followed you” without being named.
• You get at most three of these a day, including at most one about new followers and one about your watchlist. Between 10 p.m. and 9 a.m. in your device's time zone, they arrive silently in Notification Center and don't light up your screen.
• You can turn each kind off in the app under Settings → Notifications, or turn off all notifications from Intertitle in your iPhone's Settings. A notification already delivered stays on your device until you clear it.

An automatic filter screens new notes and replies for hate speech and spam, and hides what it catches from other people. In the app, you can also report or block another member from their page.

Service providers we share with

Intertitle uses the following service providers to run the app and website, manage newsletter contacts and understand how the service is used. We share information with them for the purposes described below:

• Anthropic — AI
  To produce Reely's replies, recommendation write-ups, review synthesis, and your year-in-review summary, we send the relevant context — including the messages you write to the AI companion and a compact summary of your film taste and library — to Anthropic's API for processing. For the website film picker, we may also send the selected films' titles and years and the recommended film's title, year and director to write the recommendation note.
• Apple — Sign in with Apple, notifications, Apple Ads attribution
  If you use Sign in with Apple, Apple handles that authentication. Notifications are delivered through Apple's push notification service, which receives each notification's text and your device's push token. When the app first opens, it asks Apple's AdServices whether an Apple Ads ad led to the install; Apple answers with details of the ad campaign, never a device identifier. Apple's own privacy policy governs the data it processes in these flows. When our website redirects you to the App Store, the link includes a campaign token derived from the source and campaign tags in the download URL. Apple receives that token with the App Store visit.
• Vercel — website hosting
  Our website runs on Vercel, which handles requests for its pages, assets and forms.
• Render — hosting & database
  Our application server and its managed PostgreSQL database run on Render, where your account and film data are stored. The website sends film-picker and download-attribution requests to this application server, which also stores the IP-based rate-limit counters described above.
• Voyage AI — embeddings
  We send film descriptions and your activity to Voyage AI to generate the vector embeddings that power recommendations and your taste profile. The website film picker can also trigger embeddings of shared film descriptions in our catalog.
• TMDB (The Movie Database) — film metadata
  Film metadata — titles, posters, cast, release dates, and similar — comes from the TMDB API. This product uses the TMDB API but is not endorsed or certified by TMDB. Website film-search text is sent through our application server to TMDB to find titles. The film picker also uses TMDB for film details and where-to-watch information.
• Resend — sign-in email and newsletter contacts
  When you sign in by email, we share your email address with Resend so it can deliver your one-time sign-in code. If you subscribe to the website newsletter, Resend stores your email address as a mailing-list contact.
• Sentry — error diagnostics
  When the app encounters an error, technical diagnostic information is sent to Sentry so we can find and fix bugs. The application API can send these diagnostics for errors triggered by website requests as well.
• PostHog — product and website analytics
  To understand how features are used and improve the product, we send product-analytics events, tied to your account ID, to PostHog. PostHog also receives the website events and browser identifiers described above. This is used only for our own analytics, never to target ads or for cross-app tracking. Newsletter signup analytics additionally include your email address as an identifier, an event property and a person-profile property, together with the signup source, page path and referrer hostname. We also send technical events about website requests to our application API, such as errors and rate-limit responses.

Data retention

We keep your account data for as long as your account exists, so the app can show you your journal and keep your taste profile current. You can delete your account data yourself at any time.

Analytics held by PostHog are separate from account data on our servers. Deleting your account does not automatically delete those analytics or clear browser storage. Clearing browser storage does not delete events already sent. For information about analytics retention or to request deletion, email us at the address below; we will review your request.

Newsletter contacts, support correspondence and operational request and error records are separate from app accounts. Deleting an app account does not automatically remove them or the newsletter signup analytics already sent. To ask about their retention, ask us to stop newsletter messages or request removal, email us at the address below; we will review your request.

The network addresses stored with rate-limit counters are separate from the short-lived attribution hashes. Resetting a counter's counting window does not delete its stored address record, and deleting an app account does not remove these records. For information about their retention or to request deletion, email us at the address below; we will review your request.

We may cache website film-picker recommendations to reuse them for the same film choices. Shared film metadata and embeddings used by the picker remain in our film catalog. These records are separate from app accounts.

We retain moderation reports, including copies of reported content and notes submitted with them, so we can review them. Reports about a member’s logs, replies or profile can also retain their account identifier, username, display name and relevant profile details. Deleting your account does not remove reports you submitted, reports about your content, or those copies.

Your rights

You can access your film data within the app at any time, and you can permanently delete your account data yourself via Settings → Delete Account. If you have questions about your data, want a copy of it, or need help with a privacy request, email us at the address below and we'll help.

Security

We protect your data in transit and at rest using industry-standard measures: connections to the website and app are encrypted over HTTPS, and account and film data on our application server are stored in a managed database with access restricted to the people who operate the service. No system is perfectly secure, but we take reasonable steps to safeguard your information.

International data transfer

Intertitle is operated from Mexico, and our hosting and several of our service providers are based in the United States. If you use the app from outside the United States, your data will be transferred to and processed in the United States and other countries where our providers operate. By using the app, you consent to this transfer.

Children

Intertitle is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. Your continued use of the app after an update means you accept the revised policy.

Contact

Questions about this policy or your data? Email us:

support@intertitle.app