The fine print
Privacy
THDB is a free community project, not a business. We collect what the site needs to work and nothing more. This page says exactly what that is.
Last updated
The honest version
- — No ads, no ad tech, no cross-site tracking, no selling or sharing data for money. Ever.
- — No cookie banner because there is nothing to consent to: we only set cookies the site needs to function.
- — Your reviews, lists, and liked movies are public by design. Your watchlist, dislikes, and email are not.
- — Your personal data is never sent to AI models. Scare profiles are generated from movie data, not from you.
Who runs this
THDB (The Horror Database) is a free, non-commercial community project operated from Belgium by Jochem Groeneweg, who is the controller of the data described here. For anything privacy-related — questions, requests, complaints — email [email protected].
What we collect
Account. An email address and a password, or your name, email, and profile picture from Google or X if you sign in with those. Passwords are handled by Supabase, our authentication provider, and stored only in hashed form — we never see or store them readable.
Profile. The username, display name, bio, and avatar you choose, plus your onboarding answers (taste preferences and favorite subgenres).
Contributions. Everything you add on purpose: reviews and ratings, likes and dislikes, your watchlist, lists you create, and scare-profile feedback and corrections.
Searches. What you search for (the query, the search mode, and how many results it returned), linked to your account if you are signed in. We use this only to find catalog gaps and tune search quality — searches by crawlers and bots are not logged.
Watch Together guests. If someone invites you and you have no account, we store just the name you enter and your quiz answers, attached to the invite. Invites expire after 7 days.
Technical. IP addresses are used briefly to rate-limit sign-in attempts and appear in standard hosting logs. If something crashes, an error report (what broke and where, without your identity attached) goes to our error-monitoring service.
What is public
THDB is a community, so contribution is public by design. Your profile page shows your username, display name, bio, avatar, liked movies, reviews, lists, and contribution counts — and you appear in the member directory. Reviews and lists are attributed to your username wherever they appear.
Private and never shown to anyone: your email address, your watchlist, your dislikes, and your onboarding answers. Pick your username knowing the rest is public.
How we use it
To run the site: keeping you signed in, showing your profile and contributions, and counting community consensus on scare profiles. To personalize: your likes, dislikes, and taste answers feed the For you recommendations — that math happens in our own database and nowhere else. To keep the lights on: rate limiting, abuse prevention, error monitoring, and search-quality tuning.
In GDPR terms, we process account and contribution data to provide the service you signed up for (contract), and security, error, analytics, and search-tuning data because a free project has to defend and improve itself (legitimate interest). Nothing here is used for advertising or sold to anyone.
Cookies
Only what the site needs to function — which is why there is no cookie banner. The full inventory:
| Name | What it does | Lifetime |
|---|---|---|
| sb-* | Keeps you signed in (Supabase auth session) | While you stay signed in |
| thdb_region | Remembers the country you picked for streaming availability | 1 year, only set if you pick one |
| thdb_together | Carries your Watch Together quiz answers into signup so you don't answer them twice — only set when you tap “Keep my fear profile” on an invite's results | Until used or the invite expires (max 7 days) |
| thdb:last-search | Carries your last search between search bars — stays in your browser, never sent to us | Current tab only (sessionStorage) |
Site analytics are cookieless (Vercel Analytics): we see visitor counts, page views, referrers, country, and device type, all in aggregate — never a profile of you. Visitors are counted with an anonymous hash that resets daily, so nobody can be followed over time. Trailers load from YouTube's privacy-enhanced player (youtube-nocookie.com) and only after you press play; from that moment YouTube's own policies apply.
Who touches the data
THDB runs on a handful of infrastructure providers that process data on our behalf: Supabase (database, authentication, avatar storage), Vercel (hosting, plus cookieless analytics and speed measurement), Upstash (rate-limit counters), Sentry (error reports — errors only, no session recording), and Voyage AI (turns search text into the vectors that power vibe search). None of them may use your data for their own purposes.
Some of these providers are US-based. Transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.
The AI part
Scare profiles and intensity curves are written by an AI model in advance, from movie data — plot summaries, reviews of the film, metadata. Your personal data plays no part in that and is never sent to AI providers. The one exception worth naming: when you use vibe search, your search text is sent to Voyage AI to compute an embedding, used for that search and our search-quality log, nothing else.
Retention and deletion
We keep your data for as long as you have an account. Email [email protected] to delete yours — deletion removes your profile and all your contributions (reviews, ratings, likes, lists, corrections, watchlist), and your past searches are stripped of any link to you. Community effects that were already applied — say, an axis value your correction helped fix — persist without attribution. Watch Together invites and guest answers expire after 7 days. Backups clear on a short rolling window.
Your rights
Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to processing, and take your data elsewhere. Email [email protected] and we will sort it out. If you are unhappy with how we handled something, you can complain to your local data-protection authority.
Changes
If this policy changes, the date at the top changes with it, and meaningful changes get a notice on the site. We will never quietly turn on the things the top of this page rules out.