Your data,
in plain English

Last updated October 2, 2026

Who is responsible

Montage (montagefilm.app), run from New York, USA, decides how your data is used (the "controller" under EU and UK law). Contact: contact@montagefilm.app.

What we collect

Account. You sign in with Google or with your email address, through Supabase Auth. Either way we receive your email address and a user id. We never see your Google password, and an email password is held by Supabase, not by Montage.

Your film library. With your say-so, Montage imports your Letterboxd data, either by reading your public Letterboxd profile or by processing an export file you upload. That gives us the films you have logged, your ratings, likes and watchlist. Once your account is linked to a Letterboxd profile, Montage also reads its public diary feed once a day, and when you open the app, to add films you have logged since. You can also rate films, add to your watchlist and build a Canon inside Montage itself, and those entries are stored the same way, along with when you made them, so your monthly and yearly Montage can look back at what you watched and how your taste moved. That is a record of your own library actions only, not of how you use the app. If you discover your taste by rating films instead, we store the ratings and answers you give.

Derived taste data. From that library we compute things like your taste vector, archetype, cluster affinities and per-film match scores, plus the generated write-ups shown on your profile and on film pages. We also note which films we suggested to you, where and at what match, and whether you later rated, saved or hid them, so we can tell which suggestions actually work.

Profile you write. Display name, username, bio and avatar image, if you set them.

Social activity. Who you follow, blocks and reports, groups and movie nights you join (including your mood picks and votes), reactions, and any feedback you send us through the app.

Messages and posts. What you write in a group's feed or a movie night's chat (including films you send there, replies and @mentions), and your takes and replies in a film's discussion. For each group feed and movie night chat, we also note how far you have read it, so the app can count what is new for you and show the sender "Read by" (see below).

Usage. We record pageviews, when you leave a page, which buttons and links you tap (never what you type), and in-app actions (for example, opening a film or starting an import) with PostHog, so we can see which features get used and where people get stuck. PostHog runs without cookies and stores nothing on your device, and we do not record your screen or sessions. If you are signed out, PostHog tells visits apart with a one-way code worked out on its servers from your IP address and browser, which changes every day, so it cannot follow you from one day to the next. If you are signed in, events carry your user id, never your email. This is separate from the library history above: it tells us what the app did, not what you think of a film.

Visit counts. Vercel Web Analytics counts page visits in aggregate. It sets no cookies either.

Why we collect it, and our legal bases

To do the one thing the app exists for: read your taste, recommend films, and show you how your taste compares with other people's. Under EU and UK law, each use rests on one of these:

• Account, library, taste data and profile, to run Montage: performance of our agreement with you (the terms).
• Social activity, messages and read receipts, for the follows, groups, chats and movie nights you choose to use: performance of our agreement.
• Usage events, visit counts and suggestion outcomes, to find what is broken or unused and make picks better: our legitimate interest in improving Montage, kept cookieless and minimal.
• The weekly email: our legitimate interest in telling existing users about their picks, with one-click unsubscribe in every email.
• Reports, blocks and photo checks, to keep people safe: legitimate interest and legal obligations.

We do not sell your data, share it for cross-context advertising, or run advertising against it.

Where it is stored

In a Supabase (PostgreSQL) database and, for avatars, Supabase storage. The app itself is hosted on Vercel, which processes ordinary request logs.

The import job that reads your library to build a profile (the raw scan) is deleted after 7 days at most. What the app keeps from it is described above.

International transfers

Our database runs in the United States (Oregon), and our other providers process data in the United States too. Where the law requires, transfers from the EU or UK rely on the providers' Standard Contractual Clauses or the EU-US Data Privacy Framework.

Third parties

Each one does a single job, and none of them gets more than that job needs.

• Google handles sign-in, if you choose it.
• Supabase hosts the database, file storage and authentication.
• Vercel hosts and serves the app, and counts page visits without cookies.
• PostHog receives the usage events described above. It runs cookieless, with session recording off.
• Anthropic writes some of the text on film pages and profiles. Those requests carry the film's details plus taste signals such as your rated films, archetype and genre leanings. Never your email. It also checks each profile or group photo you upload for nudity and sexual content before the photo is saved; only the image is sent.
• OpenAI turns film descriptions (title, year, director, genres and themes) into the numbers we use to find films alike in meaning. Only film text is sent, never your account, ratings or anything about you.
• TMDB supplies film metadata, posters and stills. Those requests carry film data only, never your account.
• Resend delivers the emails Montage sends, such as the weekly picks digest (which you can unsubscribe from), so it receives your email address and the email itself.
• Letterboxd is the source of imported library data. When you ask, Montage reads your public Letterboxd pages, and once your account is linked, your public diary feed each day; it is not affiliated with Letterboxd and sends nothing to them on your behalf.

Anthropic and OpenAI are used through their business APIs, with our accounts set so they do not train their models on this data.

Cookies and local storage

Montage sets no advertising or tracking cookies, and none of its analytics store anything on your device, which is why there is no cookie banner. What the app does keep in your browser's local storage is there so the app works:

• Your sign-in, held by Supabase so you stay signed in between visits.
• Your profile on this device: which profile and import are yours, a random key that lets a signed-out profile save ratings, and a copy of your result, your film list and your watchlist so they open instantly.
• Work in progress, such as a half-finished set of ratings, ratings and films you want to watch saved before you signed up, the handle you picked, or an invite link you followed, so a reload or a sign-in in a new tab does not lose them.
• Small preferences: recent searches, the last tab you had open, whether you left your full profile open, which tips and prompts you have already seen, how many times you have opened the site (so a tip can wait for a second visit), and when you last checked your activity. When you are signed in, these (except the visit count) are also saved to your account, so every device you sign into remembers them.
• A sign-up note: where you started signing up, and a flag once your new account has been counted, so it is counted once.

None of it is sent to anyone for tracking. Clearing your browser's site data removes all of it; you will need to sign in again.

Who else can see it

Your profile is either public (discoverable and viewable by anyone with the link) or unlisted (only reachable by someone who has the link). New profiles default to unlisted until claimed by an account. Either way, your email address is never shown on your profile. You can hide your Canon from your public profile in the app.

Friends. People you follow who follow you back see the films you rate and watch, in their Social tab and their weekly email. Your watchlist is never shown. Turn this off in Edit profile under Share my activity with friends. With it off, your watch logs also leave your groups' feeds, and your takes in a film's discussion are shown only to you.

Blocking and reports. Blocking someone removes any follow between you and hides you from each other in search, suggestions, feeds and invites; they are not told. A report is sent to us privately, with the reason you pick and any note you add.

Groups and movie nights. Members see your handle, mood picks, votes and how your taste fits the group. In a group's feed or a movie night's chat they see your messages, the films you send, your reactions and, in a group, your watch logs (unless Share my activity with friends is off). They also see read receipts: under the newest message they sent, "Read by" and the names of the members who have opened the chat past it. Nobody you have blocked, or who has blocked you, sees yours.

Film discussions. Your take on a film is shown to your friends (people you follow who follow you back), who can react and reply. A reply you write on a friend's take is seen by everyone who can see that take, which can include their friends you do not know. With Share my activity with friends off, your takes are shown only to you.

When the law requires it. We disclose data if we must by law, or to protect someone's safety.

Retention

We keep your library, taste data and profile for as long as your account exists, because the app needs them to work. Delete your account and the rows listed below go with it. Our database backups rotate out after 7 days, and provider logs may keep copies for a short period.

If you rate films without creating an account, your result, and the note of which films we suggested, are kept for 30 days so you can come back and claim it, then deleted.

Messages in a group's feed stay until you delete them (the group's creator can also remove any message), or until your account is deleted.

A movie night's chat, and the reactions on it, are deleted 30 days after the night, along with how far each person had read it. The night itself (the film, who was there and how they rated it) stays with your account. A message someone reports is kept with the report until we have dealt with it.

Your rights

Wherever you live, you can ask us to:

• See what we hold about you, and get a copy in a common format (JSON);
• Correct it (most of it you can edit yourself in the app);
• Delete it (Settings, then Delete account, or ask us);
• Object to or limit a use based on our legitimate interests, such as usage analytics;
• Stop marketing email, with the unsubscribe link in every email.

Email contact@montagefilm.app. We answer within 30 days (45 for California requests) and may ask you to confirm the request comes from your account's email. In the EU or UK you can also complain to your data protection authority.

California residents

In the last 12 months we collected the categories above: identifiers (email, user id), your library and ratings, inferences about your taste, and usage data, for the purposes above. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics. You have the right to know, delete and correct, and we will not treat you differently for using them.

Security

Data is encrypted in transit, and tables can only be read by the server. The browser never holds a key that can read other people's data. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

Deleting your data

Open the profile menu, go to Settings and choose Delete account. You will be asked to type DELETE to confirm. That removes your ratings, watchlist, Canon, removals, public profile and photo, derived taste and match data, the record of what we suggested to you, follows and activity rows, group memberships, movie-night seats and votes, your messages in group feeds and movie night chats, your takes and replies in film discussions, the reactions you gave, your read receipts, and feedback you sent, and then deletes your sign-in account itself. Groups you created pass to their longest-standing other member. It cannot be undone. Usage events already sent to PostHog carry only your old user id, which no longer points to any account; ask us and we will delete those too.

Age

Montage is for people 16 and older. If we learn an account belongs to someone younger, we delete it and its data.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect, and update the date above.

Contact

Questions, corrections, or a request to see what we hold on you: contact@montagefilm.app.