Privacy

Last updated: September 19, 2026

This policy is for Binged at this deployment (currently binged-ecru.vercel.app). It uses Auth.js (NextAuth) and Prisma Postgres. It is not the older recommendation app on www.binged.app, which uses a different stack (Supabase).

What we store

• Account: email, username, display name, an optional profile picture, and a hashed password. We cannot read your raw password.
• Findability: a one-way code of your email (unless you turn that off) and, if you add one, a one-way code of your phone. We do not store your raw phone number.
• Activity: episode ratings, optional short reviews, binge nights, watched marks, favorite shows, ranked lists, watchlist items, and who you follow.
• Catalog: TV titles and artwork fetched from TMDB when a server-side API key is configured.

What is public

Binged is public by default. Usernames, display names, bios, profile pictures, ratings, reviews, watched counts, favorites, lists, watchlists, and follower lists are visible to anyone with the profile link. Email addresses and password hashes are not shown on profiles.

Finding friends

When you choose contacts on Find friends, emails and phone numbers are turned into one-way codes on your device. Only those codes are sent to Binged so we can see who already has an account. We do not save your address book, contact names, or the list you picked. Matching uses the same follow graph as People and Search — we do not keep a second friends list.

Invite links use a short public code on your account (/join/…). They are not a secret (usernames are already public). Someone who opens your link sees that you invited them. If they join, you follow each other.

How we authenticate

Sign-in uses Auth.js with email and password. Sessions are stored in an HTTP-only cookie. There is no Supabase Auth in this app, and this codebase does not load a Supabase anonymous key in the browser.

Analytics and third parties

This app does not embed product analytics SDKs. Hosting (Vercel) and the database provider may process request logs needed to run the service. Show artwork and titles may be requested from TMDB.

Your choices

You can change your password while signed in at /account. To correct or delete your account data, contact the operator of this deployment. Self-serve account deletion is not built yet.