Privacy & disclosures

What we collect (and what we don't)

We try to keep the collection footprint small. The categories below cover everything we can think of. If you find one we missed, please flag it via the community page.

• Server logs. When your browser fetches a page from our hosting provider (Vercel), the request is logged: IP address, user agent, the URL requested, response time, and any error code. These are standard web server logs and are retained for diagnostic purposes.
• Authentication. If you sign in (Google, GitHub, Reddit, etc., via Supabase Auth), Supabase stores your user record (email, OAuth provider, encrypted session). We never see, store, or have access to your provider password.
• Subscriptions. If you opt into the weekly trend report email, we store the email address you provided and a flag indicating which reports you want. You can unsubscribe at any time using the link in the email.
• Community content. Forum threads, comments, chat messages, reactions, polls — content you submit is stored with the user account that posted it. See the User-Generated Content section in our Terms.
• Vote / poll cookies. When you vote in a poll, we set a small cookie (for example voted_xyz) so we do not show you the same poll again. These cookies do not identify you to us.
• Favorites. If you save a character to favorites, we store the relationship between your user account and that character. Available only to signed-in users.
• Analytics (aggregate). See the next section.
• What we do NOT collect: we do not ask for your phone number, address, payment information, or government ID. We do not knowingly collect data from anyone under 13. We do not sell your data to data brokers.

Cookies and tracking technologies

The Site uses cookies and similar browser storage technologies for the following purposes:

• Strictly necessary: Supabase sets an auth cookie when you sign in so your session persists. Required for any logged-in features.
• Preference / state: small cookies record which polls you voted on, which features you have dismissed, and minor UI state. These do not identify you to us.
• Analytics: Vercel Analytics (built into the host) records aggregate pageviews without personally identifying you. Google Analytics 4 may be enabled (toggleable by the operator via NEXT_PUBLIC_GA_MEASUREMENT_ID) — it uses cookies to compute aggregated audience metrics.
• Advertising: when ads are served, Google AdSense and any sub-providers may set advertising cookies and read existing ones. These can be used to serve more relevant ads, measure ad performance, and enforce frequency caps. You can manage Google ad personalization at adssettings.google.com and opt out of personalized ads.

You can clear cookies and local storage at any time from your browser settings. Doing so will sign you out and reset any preference cookies the Site has set.

Third parties that touch your data

The Site is composed from a handful of services. Each has its own privacy policy, linked below.

• Vercel hosts the Site. Server logs, analytics, and edge functions run there. Vercel privacy policy.
• Supabase stores users, content, polls, favorites, and characters. Supabase privacy policy.
• Google AdSense & Google Analytics handle ad serving and aggregate analytics. As a result of ad serving, third parties may place and read cookies on your browser, or use web beacons or IP addresses to collect information. See How Google uses information from sites or apps that use our services.
• Resend sends the optional weekly email if you subscribe. Resend privacy policy is at resend.com.
• Reddit, Brave Search, YouTube are read-only data sources we query to surface public discussion, news, and video about cast members. They do not receive any information about you as a Site visitor.

Affiliate & commercial disclosures

Some outbound links — particularly "Where to Watch" buttons for streaming services and occasional merch links — may be affiliate links. If you sign up or buy through one of those links the Site may earn a commission at no extra cost to you. Affiliate links are labeled clearly at the component level (look for the "Affiliate disclosure" line below each streaming block).

Sponsored content, when present, is labeled Sponsored or Ad at the block level. The Site does not accept paid promotion that is not labeled. Editorial copy (character bios, statistics, the relationship map) is not influenced by sponsors and is not paid placement.

Personalized advertising

The Site may show personalized ads through Google AdSense. We do not direct AdSense to serve ads based on any sensitive categories Google's policy prohibits — health information, sexual orientation, political affiliation, race, religion, financial distress, criminal history, or trade-union membership. If you would prefer to see only non-personalized ads, you can change that setting in your Google account at adssettings.google.com.

Data retention

• Server logs are retained for short diagnostic windows by Vercel under their default policies.
• User accounts and the content you posted are retained until you ask for deletion (see below).
• Email subscriptions are retained until you unsubscribe, with a small post-unsubscribe record to make sure we do not re-mail you.
• Aggregate analytics are retained at the time horizons set by the analytics provider (Vercel / GA4).

Your rights

Regardless of where you live, you can ask us to delete your account, export your community content, or remove your email from our subscription list. EU and UK residents have additional rights under GDPR / UK GDPR (access, rectification, erasure, portability, restriction, objection, and the right to lodge a complaint with a supervisory authority). California residents have additional rights under the CCPA (right to know, right to delete, right to opt-out of sale — we do not sell your data).

To exercise any of these rights, post a request in the community section or send a message through the channel listed on the About page. We will respond within a reasonable time.

Children

The Site is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information through the Site, contact us via the community page and we will delete it.

Changes

This policy may change. Material changes will be reflected by updating the "Last updated" date at the top of this page. If a change is significant, we will note it in the footer for a reasonable period.