Privacy and your data

Your browser choices and recommendations

You can use discovery without creating an account. This tab remembers the titles you loved, watched or dismissed, your chosen country, and discovery filters in browser session storage. A bounded recommendation snapshot can be reused for up to 15 minutes when you return from another page; expired results are refreshed with your filters retained. Your theme preference uses local storage on your device. These choices are not a permanent account backup.

To find titles, CastLantern sends your search text to Trakt. To generate recommendations, it processes selected title IDs, actor and genre exclusions, and watched or dismissed feedback. Shared cast and community ratings determine the suggestions. It also requests upcoming episode dates for series you selected.

Catalogue requests do not send your CastLantern account identity to Trakt. The app caches title, cast, rating, artwork, and schedule information. Search text appears in shared metadata-cache keys, so avoid entering personal or sensitive information in the title-search box.

To protect the shared catalogue and watch-room services, CastLantern uses request counters and purpose-specific hashed network identifiers derived from the connecting IP address. The app does not store the raw IP in these counters or use them for advertising. Shared limits can affect several visitors, especially on a shared network.

Choose Your data in the discovery footer to download or clear this tab’s choices. Clearing the tab resets favorites, feedback, search, filters, and country. Theme and account-saved picks have separate controls.

Sharing, actor follows, games and streaming preferences

My Five links contain the title identifiers you deliberately choose to share, with an optional next pick, in a public URL query. Older links use a URL fragment. Anyone with the link can see those choices. Public-query links also let messaging services and search crawlers read the chosen titles and a matching preview image. The link does not contain your account identity, email, watched history, or hidden titles. Downloaded cards are created in your browser; link-preview images are generated by the website. Opening a shared shortlist does not replace your own favorites unless you choose to use it.

Actor follows, follow dates and read-project markers stay in this browser’s local storage. The Following page sends selected actor identifiers to CastLantern to check their public filmographies and announced first-release dates. Updates are checked when you visit or refresh; following does not subscribe you to email or device notifications. Trailer changes and streaming-arrival alerts are not monitored.

The daily puzzle stores the current UTC day’s route, attempts, hint use and reveal state locally. A separate local history keeps up to 400 UTC dates on which you solved a puzzle without revealing the route, to calculate current and best streaks. Hints are allowed; revealed routes do not earn a streak. This history stays on this device until cleared. Sharing a result creates text for you to send; CastLantern does not send it to other people. Streaming preferences store selected service identifiers separately for each country in local storage. When a licensed availability provider is connected, an explicit offer check sends selected title identifiers and country to our server, which resolves public movie identifiers and checks country-specific offers. Your selected-service list and account identity are not sent to that provider. Offer results are cached for up to 24 hours.

Use the Following and daily-puzzle controls to manage those features. Your data in discovery also lets you clear local actor follows, read markers, game progress, streak history and streaming preferences. Theme, account saves and watch-room participation have separate controls.

Private watch-together invitations

Creating or joining a watch room requires confirming that its selected titles will be shared with anyone who has the invitation. Up to six anonymous numbered participants can each add one to five favorites. The server stores those title summaries, anonymous seat numbers, creation/expiry times and hashes of random invitation and editing credentials. It does not require participant names, emails or accounts. The invitation stays in the URL fragment; editing credentials stay in this tab’s session storage and are sent only to the same-origin room API.

Anyone with the invite can view the room’s shared picks and forward the link. Protect it accordingly. Only a participant’s editing credential can change or remove that participant’s picks. Use Remove my picks and leave before discarding access if you want to remove your ballot. Rooms expire after seven days and become eligible for bounded cleanup during later room requests; physical deletion can lag while the service is idle. Lost editing access can prevent self-service removal before expiry. Private room and shared-card URLs and their contents are excluded from visitor analytics; separate optional feature totals are described below.

Usage counts and optional visitor analytics

CastLantern counts watch-guide views, successful recommendation requests, watch-option clicks, and paid-link clicks to understand which parts of CastLantern are used and assess promotion. It stores totals by UTC day and action category, with recognized test or automated activity in a separate bucket.

The basic action-counter records contain no visitor or account identifier, email address, IP address, browser description, search text, selected titles or actors, full URL, or referring website. These totals are separate from the optional visitor measurement below. Hosting still processes ordinary connection information as described below.

If you choose Allow visitor analytics, CastLantern uses a random first-party browser identifier lasting up to 30 days to estimate unique visitors. The identifier is stored in a secure browser cookie. The app stores a hash of it with the UTC dates on which that browser visited; it does not attach individual page paths, titles, accounts, or traffic sources to that hash. Separate aggregate totals record approved public page paths and broad source categories such as Google, Reddit, direct, or other. Actor and movie/series detail visits are grouped as “Actor pages” and “Title pages” before reporting, without actor names, title names or catalogue identifiers. Query strings, page fragments, private alert links, searches, and selected titles are excluded from these reports.

The same optional choice allows coarse feature counts: shared shortlists created and opened, rooms reaching a second participant, puzzle play, and a browser returning to play on the next UTC puzzle day. Events contain a fixed category only, with no share link, room credential, title, actor, account or played-date payload. Per-feature, per-day hashes avoid counting the same browser repeatedly; those hashes cannot be joined across features or days. A room stores an operational flag to count its second participant at most once, without putting its identifier in analytics. Puzzle progress can include a local yes/no marker that a play report was accepted for sending while analytics was allowed. That marker is not confirmation that a server count was saved. Next-day return counts require both a current consented play action and a marked previous UTC day; older unmarked or unconsented progress is not backfilled. Missing or cleared progress can leave gaps. These are measurements of consenting browsers, not a complete count of people or a cross-device retention rate. Automated checks, known crawlers, and browser privacy signals are excluded.

Choose Privacy choices to allow or decline visitor analytics. The preference is remembered in a separate cookie for up to 180 days. Declining clears the browser identifier and stops future visitor measurement and basic action reports from this browser. Existing records follow the retention periods below. Visitor analytics starts after allowing it and cannot reconstruct earlier visits.

Analytics respects a browser’s Do Not Track or Global Privacy Control signal when provided. Unique-visitor figures are estimates of consenting browsers, not verified people: using another browser or device, clearing cookies, or identifier expiry can count someone again. Opt-outs, blocked scripts, resource limits, failures, and undetected automation affect the totals. Recognized tests, previews, owner visitor pageviews, and authenticated owner recommendation requests are classified separately. Other internal use may remain in the totals. The counts do not establish purchases or earned commissions.

Separate Google Ads measurement

Allow Google Ads measurement in Privacy choices is a separate, optional permission. An earlier visitor-analytics choice does not grant it. The Google Ads base tag loads only after allowing this purpose and only on the discovery home, About, watch-guide, privacy, terms and watch-options pages in eligible URL contexts. Actor and title detail pages, Following, the daily puzzle, Tonight, private accounts, authentication, email-management and invitation contexts are excluded. Google can receive advertising click information, public page context and standard browser or connection information, and can use advertising attribution cookies. CastLantern does not deliberately send account identities, email addresses, search text, selected titles or private invitation and email links to this tag.

This integration keeps advertising personalization, Google Analytics storage and user-provided advertising data consent denied. It does not enable enhanced conversions or collect email and phone fields for Google. The supplied base tag does not by itself define a recommendation, signup, purchase or affiliate conversion event.

Allowing Google measurement refreshes the page to apply the new permission. Choose Decline Google Ads measurement to stop future loading. If the tag has already loaded in the document, declining updates its consent, clears accessible first-party Google advertising cookies and refreshes the page so it is blocked in the new document. The loaded tag may send a final consent signal before that refresh. CastLantern cannot delete information Google already received or promise to clear cookies controlled by another domain. The separate allow/decline preference lasts up to 180 days. Do Not Track and Global Privacy Control disable this optional measurement when provided. You can use CastLantern without allowing either measurement purpose.

Optional account-saved picks

Saving picks uses ChatGPT sign-in. Hosting supplies a site-specific account identifier and may supply an email address and display name to the server. CastLantern associates your saved titles and save dates with that identifier. It does not publish an account profile or store the sign-in email or display name in saved-picks records.

While signed in, open Your data to download your saved list or deliberately confirm deletion of all saved picks. Remove an individual pick with its Save control. Correct a saved selection by removing it and saving the intended title.

The saved-list download omits your account identifier and sign-in email. Deleting saved picks removes those records from CastLantern’s app database. It does not close your ChatGPT account, clear this tab’s choices, unsubscribe email alerts, or immediately erase provider logs and backups.

Optional new-season email alerts

Email signup is open. Automatic season notifications are paused. Signing in does not subscribe you. You choose series, supply an email address and country, give consent, and confirm the email sent to that address. Confirmation links expire after 24 hours.

CastLantern stores the address, country, selected series, consent, subscription state, and relevant timestamps. It uses this information to confirm your choices, check premieres, send requested notifications, manage delivery, and prevent abuse or duplicate messages. Only new-season email alerts are implemented; actor project updates are available on the website, and other email alert types are planned.

Every alert includes private management and unsubscribe links. Unsubscribing stops future notifications for that subscription, although a message already handed to the email provider cannot be recalled. To change followed series, submit and confirm a new selection with the same address; confirmation replaces previous active choices for that address.

Private-link lookup values and rate-limit identifiers are hashed. Queued email content also contains the recipient address and private management links until that content is cleared. Treat links in your emails as private.

How long information stays

• Browser choices: session choices remain in the tab’s browser storage until cleared or the browser ends that session. Browser session restoration can preserve them. Theme remains until changed or cleared from device storage.
• Local engagement preferences: actor follows and streaming-service choices remain until removed or browser storage is cleared. The latest saved puzzle progress remains until later play replaces it or you clear it. Streak history retains up to 400 completed UTC dates until cleared. Watch-room data expires after seven days and is cleaned in bounded batches on later room requests.
• Saved picks: kept until removed or you confirm saved-list deletion. There is no automatic account inactivity expiry.
• Active email subscriptions: kept while confirmed and active. Unconfirmed records become eligible for cleanup after seven days. Unsubscribed records become eligible after 30 days.
• Email delivery data: message content for unsubscribed records is cleared during later season checks. Terminal delivery-message content becomes eligible for clearing after 90 days. Hashed rate-limit records become eligible after 48 hours. Delivery status, identifiers, event information, and timestamps can remain as operational history without automatic expiry.
• Aggregate usage counts: become eligible for bounded cleanup after 90 days. Cleanup happens during later counter writes and can lag when the service is idle. The ingestion endpoint also uses shared, non-personal request quotas that become eligible for cleanup after 48 hours.
• Visitor and feature analytics: the visitor cookie expires after 30 days and the separate allow/decline preference after 180 days. Hashed daily visitor and feature-deduplication records become eligible for cleanup after 31 days. Page, source and feature aggregate totals become eligible after 90 days, and shared analytics request quotas after 48 hours. Cleanup is bounded and happens on later analytics writes, so stored records can remain longer while the service is idle or cleanup is catching up.
• Google Ads measurement: the separate browser allow/decline preference expires after 180 days. Attribution cookies and information Google receives follow Google’s settings and retention practices; declining future loading does not erase past provider records.
• Discovery request counters: become eligible for bounded cleanup after 48 hours. Cleanup happens on later requests and can lag when the service is idle.
• Catalogue and artwork: metadata expiry controls freshness. Expired records are removed in bounded batches during later cache fills, so expiry does not promise immediate deletion of search text. Artwork source records and cached images have no automatic app-level expiry.

Email cleanup runs with season checks and can be delayed if checks fail or stop. Unsubscribe is not immediate erasure. Contact the Privacy Officer for help with deletion beyond self-service controls. Hosting and provider logs or backups have separate retention.

Service providers and international processing

OpenAI Sites and ChatGPT sign-in, with Cloudflare hosting/storage: operate the website, protect access, and store app records and cached artwork. Hosting and sign-in can process connection details, IP addresses, request information, account data, and essential cookies. See OpenAI’s privacy policy and Cloudflare’s privacy policy.

Trakt: receives title searches and metadata requests and supplies the catalogue, cast, ratings, artwork, and episode dates. Posters and actor images are delivered through CastLantern’s cache; fonts are self-hosted.

Resend: processes recipient addresses, message content, and email delivery events. Resend states that its primary processing is in the United States, email and log data on Free, Pro, and Scale plans is retained for 30 days, and backups persist for seven days. These periods differ from CastLantern’s app retention. See Resend’s processing and retention information.

JustWatch: selecting a watch-option link opens a country-specific search containing the title. JustWatch receives that search and connection information normally supplied when visiting its website, under its own privacy practices. These links currently earn no commission. Read how watch links and referrals work.

Movie of the Night: if configured, receives public title identifiers and a country to supply streaming availability. This integration is inactive without its runtime credentials. It does not receive the CastLantern account identity or the locally selected-service list.

Google Ads: provides the optional advertising measurement described above after separate permission. Google processes that information under its own privacy practices, which may include processing outside your country. See Google’s privacy policy and how Google uses information from sites that use its services.

Providers may process information outside your country. CastLantern does not promise Canada-only or EU-only storage. Account-specific locations and retention of hosting logs and backups have not yet been verified; self-service app deletion does not promise their immediate removal.

Advertising, analytics, and future changes

CastLantern uses clearly labeled affiliate links, which may send a provider tracking ID when you choose to visit. Providers may use cookies and measure qualifying actions under their own privacy practices. CastLantern’s own aggregate usage counts and optional visitor analytics run in the existing website and database. The Google Ads base tag has a separate optional permission as described above; it does not display advertising on CastLantern or establish earned commissions. Essential hosting and sign-in processing and email delivery records still apply. We will update this notice and provide applicable choices before adding new data uses.

The service is not intended for children below the applicable age of digital consent. Contact the Privacy Officer if you believe a child’s personal information was submitted.

Privacy requests and complaints

The CastLantern Privacy Officer handles questions, access or correction requests, deletion requests, and privacy complaints. Depending on the law that applies to you, you may also have rights to portability, restriction, objection, or withdrawal of consent. Email consent can be withdrawn through the private unsubscribe link.

Contact privacy@castlantern.com. Include the action you need and any safe error message. Do not send passwords, sign-in codes, identity documents, or private alert links.

For saved-list requests, first sign in and use Your data. An email address alone does not identify the site account that owns a saved list. We need to verify ownership before providing account-specific assistance and will request only information needed for that purpose.

You can also contact the relevant privacy authority, including the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or your local data-protection authority.