Legal

Privacy policy

Plain language, no dark patterns. This explains what we store, why, and how to take it with you or delete it.

Last updated: October 2026

1. Who is responsible

The data controller for MaruTime is Ștefan Narcis Cucoranu, Ostuni (BR) (Italy). Contact: elpideus@gmail.com. MaruTime is a non-commercial, community-run service.

2. What we collect and why

Account data (email, username, password hash, display name, optional bio, avatar, cover, social links, favourite character). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Needed to run your account.
Tracking data (the shows and movies you follow, episodes and movies you mark watched, when you watched them, your watchlist, lists, likes, follows, comments and uploaded images). Legal basis: contract. This is the product.
Private check-in details (device type, streaming service, your six-emotion reaction, favourite character and private notes). Legal basis: contract. These are shown to you only. Everyone else sees them exclusively as anonymous totals, and totals are hidden until at least three different people have checked in to the same episode or movie.
Technical data (a pseudonymised hash of your IP address and your browser’s user agent on sessions and failed sign-ins, kept to protect accounts; server logs kept briefly by our hosting provider). Legal basis: legitimate interest in security (Art. 6(1)(f)).
Preferences (theme, chosen lists category, spoiler settings) in cookies and in your account.

We do not run advertising, do not sell data, do not build advertising profiles and do not use third-party analytics or tracking cookies.

3. Where the data lives (processors)

Hosting and compute: Vercel Inc. (serverless functions and static assets) or, for self-hosted instances, the operator named above.
Database: a managed PostgreSQL provider configured by the operator (for example Neon). Backups are stored encrypted in object storage configured by the operator (for example Cloudflare R2).
Images you upload: object storage configured by the operator (for example Cloudflare R2). EXIF metadata, including GPS location, is removed on upload.
Title metadata and artwork: The Movie Database (TMDB) and AniList. Your browser loads poster images directly from their image servers, which see your IP address like any website asset. We never send them your account data.
Email (only if enabled by the operator): a transactional email provider such as Resend, used for verification, password resets and export notices.

Some providers may process data outside the EU/EEA. Where that happens, transfers rely on the European Commission’s Standard Contractual Clauses or adequacy decisions (for example the EU-US Data Privacy Framework).

4. How long we keep it

Account and tracking data: until you delete your account. Deletion is immediate and cascades to everything you created.
Encrypted backups: automatically removed after the retention window (30 days by default). Data you deleted therefore disappears from backups within that window.
Session records: 30 days of inactivity, or until you sign out. Failed sign-in records: 24 hours.
Audit log entries about moderation actions: 12 months.

5. Your rights

You can exercise all GDPR rights directly in the app, no email required:

Access and portability (Art. 15, 20): Settings → Your data → Download JSON or CSV.
Rectification (Art. 16): edit anything in Settings.
Erasure (Art. 17): Settings → Your data → Delete account.
Restriction and objection (Art. 18, 21): set your profile to private, disable activity sharing, or contact us.
Complaint: you may lodge a complaint with your local supervisory authority.

For anything else, write to elpideus@gmail.com. We answer within 30 days.

6. Children

MaruTime is for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has an account, contact us and we will delete it.

7. Security

Passwords are hashed with scrypt. Sessions use random, hashed tokens in secure, HttpOnly cookies. Backups are encrypted with AES-256-GCM when an encryption key is configured. Access to production data is limited to the operator.

8. Changes

If this policy changes materially we will show a notice in the app before the change takes effect.

2. What we collect and why

Account data (email, username, password hash, display name, optional bio, avatar, cover, social links, favourite character). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Needed to run your account.

Tracking data (the shows and movies you follow, episodes and movies you mark watched, when you watched them, your watchlist, lists, likes, follows, comments and uploaded images). Legal basis: contract. This is the product.

Private check-in details (device type, streaming service, your six-emotion reaction, favourite character and private notes). Legal basis: contract. These are shown to you only. Everyone else sees them exclusively as anonymous totals, and totals are hidden until at least three different people have checked in to the same episode or movie.

Technical data (a pseudonymised hash of your IP address and your browser’s user agent on sessions and failed sign-ins, kept to protect accounts; server logs kept briefly by our hosting provider). Legal basis: legitimate interest in security (Art. 6(1)(f)).

Preferences (theme, chosen lists category, spoiler settings) in cookies and in your account.

We do not run advertising, do not sell data, do not build advertising profiles and do not use third-party analytics or tracking cookies.

3. Where the data lives (processors)

Hosting and compute: Vercel Inc. (serverless functions and static assets) or, for self-hosted instances, the operator named above.

Database: a managed PostgreSQL provider configured by the operator (for example Neon). Backups are stored encrypted in object storage configured by the operator (for example Cloudflare R2).

Images you upload: object storage configured by the operator (for example Cloudflare R2). EXIF metadata, including GPS location, is removed on upload.

Title metadata and artwork: The Movie Database (TMDB) and AniList. Your browser loads poster images directly from their image servers, which see your IP address like any website asset. We never send them your account data.

Email (only if enabled by the operator): a transactional email provider such as Resend, used for verification, password resets and export notices.

4. How long we keep it

Account and tracking data: until you delete your account. Deletion is immediate and cascades to everything you created.

Encrypted backups: automatically removed after the retention window (30 days by default). Data you deleted therefore disappears from backups within that window.

Session records: 30 days of inactivity, or until you sign out. Failed sign-in records: 24 hours.

Audit log entries about moderation actions: 12 months.

5. Your rights

You can exercise all GDPR rights directly in the app, no email required:

Access and portability (Art. 15, 20): Settings → Your data → Download JSON or CSV.

Rectification (Art. 16): edit anything in Settings.

Erasure (Art. 17): Settings → Your data → Delete account.

Restriction and objection (Art. 18, 21): set your profile to private, disable activity sharing, or contact us.

Complaint: you may lodge a complaint with your local supervisory authority.

For anything else, write to elpideus@gmail.com. We answer within 30 days.