Privacy / Datenschutz

Who is responsible?

Horrorverse is a film discovery project operated by the following controller under the GDPR (DSGVO):

For questions about your account or personal data, email the address above. You can use the same contact to exercise your privacy rights.

Hosting & security

Horrorverse runs on a virtual server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner provides the infrastructure used to store and process account, feedback and visit data.

To deliver pages and protect the service, the server processes your IP address, request time, requested URL, response status, browser information and referring URL when sent by your browser. Access and application logs are retained for up to seven days. Short-lived abuse counters protect login, registration and feedback endpoints.

The legal basis is our legitimate interest in providing a reliable, secure website (Art. 6(1)(f) GDPR). Hosting is a processing service under Art. 28 GDPR.

Your account & film library

Creating an account stores your username, display name, creation date, a salted password hash and a hashed recovery code. Sign-in creates a secure session. We store your ratings, watched-film records, watchlist, films you mark “Not for me”, settings and profile modification times so you can use them across devices.

Your account data stays until you delete your account. Daily operational backups expire within seven days. Sign-in sessions expire after 14 days or when revoked. Pending account edits are stored on your device for reliable saving and expire after seven days when the app next checks them. You can export your film library, change your password and delete your account in account settings.

Account and library processing fulfils the service you request (Art. 6(1)(b) GDPR). Providing these details is necessary to create and use an account. Discovery also works without an account.

How personalisation uses your data

Recommendation requests send your film ratings, watched-film and hidden-film identifiers, recent exposure identifiers, mood text and filters to Horrorverse’s server. The server uses these inputs with its film recommendation model to rank possible films. Your ratings update your personal recommendations; account feedback is kept in your own profile.

This preference profiling supports your requested personalised film recommendations (Art. 6(1)(b) GDPR). For anonymous discovery, we process your current request to provide the selected films. Suggestions have no legal or similarly significant effect. You can remove individual ratings, mark films “Not for me” or delete your account.

Movie night chat

When you use the chat on Movie night, your messages, the current plan for your night (its slots, moods and chosen films) and facts about the films being considered are sent to Groq, a US company, which runs the language model that reads your request and writes the replies. Your ratings, film library and account details are not sent. Horrorverse does not store your chat messages; they stay in the open page and are gone when you leave it.

Groq processes these requests on our behalf (Art. 28 GDPR) and by default does not retain them. It may keep them for up to 30 days to troubleshoot failures or investigate abuse. Processing takes place in the United States, with standard contractual clauses as the transfer safeguard. We process your messages to provide the chat you ask for (Art. 6(1)(b) GDPR). Movie night works without the chat.

Cookies & device storage

The essential __Host-horrorverse-session cookie keeps you signed in for up to 14 days. The horrorverse_privacy_v1 cookie remembers your choices for six months, including when you made the choice and the notice version. These controls and reliable account saving use necessary storage under §25(2) TDDDG; the GDPR bases are Art. 6(1)(b) for account functionality and Art. 6(1)(f) for respecting your privacy choice.

If you allow preference storage, this browser remembers recent recommendations for up to 90 days, atlas position and trail, display preferences, and feedback reminders. Atlas and display preferences stay until you clear browser storage or withdraw permission. A dismissed feedback invitation is remembered for 30 days; a submitted one for 90 days. Optional storage and analytics use consent (Art. 6(1)(a) GDPR and §25(1) TDDDG).

You can allow either purpose separately, reject both, or withdraw permission at any time. Withdrawal applies to future optional processing and clears the corresponding optional browser storage. It is as easy as accepting.

Optional visitor measurement

Only with analytics permission, Horrorverse measures visits to Movie night and The atlas. A random browser identifier is stored for the current UTC day and replaced on a later day. The server stores a daily pseudonymous identifier, page, referring domain, event identifiers and time to count visitors and page views. Records expire after 90 days. The owner can see aggregate counts in a protected monitor.

Measurement is hosted on the same Horrorverse server. Film ratings and account identifiers are kept separate from measurement. Do Not Track and Global Privacy Control are respected, and the owner’s signed-in visits are excluded. Withdrawing analytics consent stops measurement and clears the browser identifier. Already aggregated totals can remain until their retention period ends.

Film information, images & trailers

Horrorverse retrieves film information and streaming availability from The Movie Database (TMDB) on the server. Streaming availability is supplied by JustWatch through TMDB. Film images and the TMDB credit logo load directly from TMDB image servers when you browse. These servers receive your IP address and technical request information, including the site origin if your browser sends it. We use these images to make the film catalogue usable and recognisable (Art. 6(1)(f) GDPR).

A YouTube player loads only after you choose Play on a trailer. That action consents to connecting to Google / YouTube for this playback (Art. 6(1)(a) GDPR; §25(1) TDDDG where device storage is used). Google receives your IP address, player requests and page information and may use cookies or similar technologies. In the EEA, Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See Google’s privacy policy. Close the film panel or leave the page to stop the embedded connection.

External media providers operate independently and may process data outside the EEA, including in the United States. Their privacy policies describe recipients, retention and applicable transfer safeguards, such as the EU-US Data Privacy Framework for certified recipients and standard contractual clauses. You can open films and trailers on their external websites using the provided links.

Sending feedback

When you send feedback, we store your text, current app section, submission time and a reference number privately for up to 90 days. Daily backups expire within a further seven days. A keyed daily IP hash supports temporary submission limits. The message is stored as plain text and is read by the operator to improve the project (Art. 6(1)(f) GDPR). Please avoid including sensitive personal information. Quote your reference number if you want us to find or delete your message.

Letterboxd imports & personal connection

Signed-in users can upload their own Letterboxd export ZIP or CSV files. The server reads watched films, ratings, diary entries and watchlist records, matches them to the film catalogue and returns a preview. Confirming the import saves those film records in your account. Your Horrorverse ratings take priority. Imported records remain until you remove them or delete your account, and are included in your account export.

Uploads are processed in memory. The uploaded ZIP or CSV is not retained, and reviews, comments, account details and unrelated files are ignored. Matching an export uses the local film catalogue and does not contact Letterboxd. This processing provides the import you request (Art. 6(1)(b) GDPR). Export imports are snapshots: upload a fresh export to update them.

The site owner also has a personal automatic Letterboxd connection. Only that account can ask the server to retrieve public watched films, ratings, diary and watchlist. Cached public data expires after seven days of inactivity. Letterboxd may receive the server’s IP address during that sync; Letterboxd images may receive the browser’s IP address. See Letterboxd’s privacy policy.

Your choices & rights

Under the GDPR, you may request access, correction, erasure, restriction and a portable copy of your data, subject to the applicable conditions. You may object to processing based on legitimate interests, particularly for reasons relating to your situation, and withdraw consent at any time. Withdrawing consent leaves earlier lawful processing unaffected.

Email johannes@roth24.de with your request. We may ask for proportionate identity verification to protect your account. You can also complain to a data protection supervisory authority, including the authority in your place of residence, work or the alleged infringement. The German supervisory authority directory lists regional contacts.