Back to unscene

Effective September 27, 2026

Privacy policy

unscene remembers what you watch so you can find something to watch together. This policy explains the information the app uses and who can see it.

Who operates the service

unscene is an independent service operated by JHM, the site owner. It is hosted through OpenAI Sites using Cloudflare infrastructure. It is not operated by IMDb, Stremio, a streaming service or a retailer.

For privacy questions or requests to access, correct or delete your personal information, contact help@unscene.watch. This address also accepts reports about children’s information and other privacy concerns.

Information we receive and store

  • Account information. ChatGPT sign-in supplies an account identifier, verified email address and, when available, a name. Email sign-in uses a separate Cloudflare Worker to verify a single-use code and store an email identity and session. The app stores an internal account identifier, your verified sign-in email, account type, profile name, and creation and update times. Signing in with the same verified email address returns to your existing unscene profile and purchases with either sign-in method. Linking an additional different email address requires proof of both active sessions. ChatGPT-provided email is not copied into the email service as a delivery contact. Your verified sign-in email supports private invitation matching and administration. Authorized administrators can view it, but other watch-party members cannot. We do not receive your ChatGPT password or conversations.
  • Email delivery records. If you choose email sign-in, add a verified contact address, or receive a room invitation by email, the email service stores the delivery address, transactional preferences where applicable, hashed one-time codes, sessions, delivery attempts and status, suppression information, and any scoped keys you deliberately create as the owner. Room invitation messages include a private link and expire after seven days. Account, security and invitation messages use approved templates; marketing campaigns are outside this feature. Provider acceptance does not prove an email reached your inbox.
  • Support requests. Cloudflare Email Routing sends mail to help@unscene.watch to our support Worker. It stores the sender, subject, encrypted text body and routing metadata, then forwards the original email to the operator’s verified inbox. Attachments may be forwarded but are not stored in the Worker database. We use support messages to investigate and answer your request; payment-card and refund handling remains with the payment provider. Do not send passwords, one-time codes, card numbers or another person’s private viewing history.
  • Your library and preferences. Seen and not-seen answers, separate private watched-title recommendation choices (Would recommend, Wouldn’t recommend or no answer), rewatch choices, separate private title-interest choices (Not for me, Willing, Eager, or cleared), season checkoffs, disc ownership, genre and decade selections, discovery mode, selected country and streaming subscriptions. Skip saves a private Not for me choice; it stays out of personal discovery until you Reconsider it in Library. Streaming subscriptions and disc ownership are self-reported; we do not connect to those accounts or verify purchases.
  • Rooms and plans. Room membership, quiz answers and progress, matches, suggestions and notes, interest votes, confirmed private ranked ballots, schedule approvals, proposed dates and times, availability, and hosting choices. Information you enter is associated with your account or room participant.
  • Purchases. We store your account association, the room and selected offer, order and Stripe transaction references, payment status and event receipts, recorded amounts, currencies and tax, and payment and room-extension dates. These records support fulfillment, duplicate-payment handling, reconciliation and support. The app’s payment records do not store full card numbers or security codes.
  • Optional notifications. If you enable Web Push, we store your browser’s subscription endpoint and encryption details, along with short-lived delivery events. These support room updates and test notifications.
  • First-party service measurement. To understand whether adults reach useful steps, Unscene records a small set of page, quiz, room, invitation, planning and purchase milestones in its own Cloudflare D1 database. An event can include a random 30-minute browser-session token, internal account or room identifier, fixed page category, coarse arrival-channel category and time. The event does not include a title, answer, ballot, email, search query, full URL, IP address or browser fingerprint. The operator sees aggregate counts; small groups should not be used to identify people. Admin and supervised teen/kid activity is excluded. Cloudflare processes these records as the host.
  • HeyCatch analytics. On eligible public pages, HeyCatch receives page visits, masked interactions and selected landing, room-start and purchase-intent events after the app checks your measurement choice. A random opaque visitor identifier joins those visits to server-confirmed room creation, a second adult’s first saved answer, Checkout initiation and paid entitlement grants. Server events contain only an opaque room or Checkout identifier and fixed offer or entitlement categories. Page addresses are sent without query strings or fragments. The app sends no names, emails, account identifiers, watch answers, ballots, room content, child activity or payment details to HeyCatch. Private Watch, Family, room, answer and payment screens remain untracked in the browser. Admin and supervised teen/kid accounts, Film Family pages and a browser or account that opted out are excluded from event capture. HeyCatch processes network and device information needed to receive these events.
  • Technical information. Hosting, sign-in and push providers process information needed to deliver and secure the service, which may include IP addresses, browser information and request logs. The app does not include advertising trackers or a last-login tracker.

How information is used

We use this information to maintain your profile, avoid repeating questions, personalize discovery, calculate shared matches, show viewing access, coordinate movie nights, send notifications you enable, and troubleshoot the service. The site operator can inspect stored profiles and activity for operating and supporting the app. The app has no feature for selling personal information or targeting advertising.

Authorized owner-issued agent keys can access only the contact, delivery or support operations named in their scopes. The owner can revoke them. A future paid agent API would require separate terms and privacy review before activation; ordinary users’ libraries, ballots and child activity are not exposed through the email service.

What other people can see

Your library is not published as a public directory. Your private Not for me, Willing, Eager and watched-title recommendation choices are not displayed to room members. A room suggestion is a separate action you choose to share. A Not for me choice can remove an uncommitted shared match without showing who made that choice; members may still notice that a room outcome changed. Room participants can see participant names, quiz participation and shared outcomes, suggestions, interest votes and planning details. Watch-option panels can show members’ reported disc ownership, country and streaming services. Your saved watch answers also influence room results, which may reveal whether a title has been seen or is a shared rewatch.

A room link or code lets a signed-in person attempt to join. Admission depends on room availability and capacity, account limits, blocking and applicable family permissions. Links can be forwarded; avoid putting addresses, contact details or other sensitive information in suggestion notes.

Private rankings and shared schedules

Your individual ranked ballot is shown only to you through the room interface. Other participants see how many people have confirmed and the resulting viewing order. Confirmed ballots cannot be edited. A new permitted round creates a separate ballot. Room owners and administrators do not receive other members’ individual rankings through the app, although the service operator can access stored data for support and operation.

The scheduler checks your commitments in other rooms to prevent overlaps. It does not tell this room the other room’s name, title, members, or reason you are unavailable. A confirmed group plan records the chosen title order, dates, attendance and host. Replanning dates requires every current member’s approval. After a night starts, an owner can confirm it was watched together; that title is then added to the watched libraries of recorded participants who are still room members, preserving existing rewatch preferences.

Service providers and external websites

Stripe and Link provide payment services through Stripe Managed Payments. We send Stripe the selected price, an order reference and the return address needed to connect payment to your order. Stripe’s embedded payment form collects payment and billing information directly and may process device and transaction information under Stripe’s privacy policy. We do not send your private ballots, library or planned dates in the Checkout creation request.

OpenAI Sites and Cloudflare provide hosting, authentication, storage and, if you use email sign-in, transactional email delivery. Browser push services help deliver notifications and may process delivery metadata. See OpenAI’s privacy policy and Cloudflare’s privacy policy for their practices.

HeyCatch processes eligible public-page analytics as described above. Its records are separate from the app’s Cloudflare measurement database.

Title searches and metadata requests use external catalog services. Requests can include a search phrase, title identifier, genre, year or selected country. The app does not deliberately include your account identifier or full library in those catalog requests. Remote posters are loaded by your browser, which can disclose your IP address and browser information to the image host.

Shared metadata caches store catalog pages, title details, seasons and viewing offers by title, catalog selection or country, without account or room identifiers in those cache records. Cached metadata can remain after account deletion. Refresh intervals control when details are checked again; they are not deletion deadlines. Personal discovery progress and room-derived selections are separate records.

Following an IMDb, streaming or retailer link takes you to a separate service with its own privacy practices. Its search link may include the title you chose. See our sources and external-link disclosure.

Cookies, your device and notifications

Your browser saves the pending purchase reference and selected offer in local storage so you can resume checkout. Before checkout, the planning form can save its date, time, duration, repetition and hosting choices in session storage so you can return to your draft. These records are scoped to your account and room; returning does not submit a plan. Successful plan submission clears its draft. Account changes prevent another account from restoring these records but do not erase every old browser-storage entry. You can remove them using your browser’s site-data controls.

The app uses necessary room-session cookies; the hosting and sign-in services may also use cookies for authentication and security. Email sign-in uses a secure, HttpOnly session cookie shared with the email-service subdomain and checked on each app request. Email codes expire after five minutes and are single-use. First-party measurement uses a random, HttpOnly 30-minute session cookie for deduplication; a separate cookie remembers an off choice on this browser. After the measurement check allows HeyCatch, its SDK can save an analytics identifier in browser storage. A separate random, HttpOnly visitor cookie lasts up to 62 days and joins eligible public visits to the limited server milestones described above. The app remembers only that opaque measurement identifier locally; it does not send your account identity to HeyCatch. The service worker supports notifications and app installation. It does not cache private API responses or your library for offline use.

Notifications are optional. Use “Disable on this device” to remove the current subscription from the app and browser. You can also revoke permission in browser settings; revoking permission alone may leave a server subscription record until it expires or is removed. Notification previews may appear on a locked screen. A different domain or browser requires its own notification permission.

Retention and your choices

Raw first-party measurement events are eligible for deletion after 62 days through scheduled cleanup; daily totals without account or room identifiers are kept for up to 400 days. In Settings → Privacy & account data, you can turn off account-linked measurement and this browser’s measurement cookie. This removes your retained account-linked rows in the app database and stops new HeyCatch event capture on this browser. An earlier anonymous visit on the same browser can share a short-lived first-party session token with later signed-in activity; anonymous rows expire on schedule. Browser Global Privacy Control and Do Not Track signals are honored for new events. Account exports include retained account-linked events in the app database, but not HeyCatch provider records. Deleting an account also removes its retained account-linked rows in the app database. For requests about HeyCatch records, contact help@unscene.watch. These statistics are not sold or exposed through the planned paid agent API.

Profiles, library records and preferences remain stored to support returning users until you delete your account; there is no automatic inactivity-deletion schedule. You can edit your name, preferences, viewing details and answers in the app. Marking something “not seen” changes its status and does not delete the record.

New ordinary Starter rooms have 30 days from creation. Some room and account types are exempt, and existing rooms retain their stored lifetime. Expiry restricts room activity but does not delete the room. Existing members can see retained expired rooms, and eligible adult members can purchase restoration. Explicitly closed or deleted rooms cannot be restored through payment. Closing a room does not guarantee immediate database deletion. Notification events are eligible for cleanup after one day when delivery processing runs. Hosting providers may retain operational logs and backups under their own policies. Support records are retained as needed to handle requests; there is no automatic support-record deletion schedule.

Open Settings, then Privacy & account data, to export your account-linked data as a JSON file or permanently delete your unscene account. The export includes your profile, viewing records, preferences, discovery progress, notification records, retained account-linked measurement events, your payment orders and associated event receipts, any linked email identity reference, and attributable contributions to retained rooms, including expired rooms. It excludes other users’ private records and service-provider logs or backups. Email identities have separate contact and delivery records: confirmed account deletion removes those active records after app-data deletion. If that second step fails, the sign-out page gives you a retry. You can also email the operator for help, subject to identity verification.

Payment orders and event receipts have no automatic deletion schedule. Account deletion removes their direct account link, but retains transaction, room and provider references, amounts, status and fulfillment records; this does not guarantee anonymity. Deleting your account does not itself refund a purchase, cancel a payment at Stripe or delete Stripe-held records. Stripe and Link handle their own information requests under their privacy policy.

Reward invitations record the inviting account, accepted referral agreement, room instance, qualifying join, and any single founding referral beneficiary. Referring partners see their own earnings and aggregate network counts, with small counts suppressed; they do not see a descendant tree, other people’s names or individual purchases. Payout onboarding sends your verified email, display name, recipient type and bank country to Stripe; Stripe collects bank details directly. Invite emails include an unsubscribe link independent of email sign-in.

Owner acquisition invitations record the creating account and generation, private campaign label, on/off state, use limit, and each accepted new-account registration outcome. A qualifying registration consumes one place and creates the recipient’s banked welcome gift and notice without requiring room membership or creating a financial beneficiary. The creator sees aggregate consumed and remaining places, not recipient identities in the link manager. Account exports include only your own campaign settings or acceptance and rewards. Minimum opaque acceptance and consumed-count records remain after deletion to prevent duplicate claims and preserve the link’s use limit; other recipients’ records are not included in your export.

Your account export includes your own referral progress, grants, notices and financial summaries. We retain minimum opaque referral beneficiaries, obligations, receipt adjustments and payout records for accounting and required retention after program exit or account deletion. A verified payment-agreement cancellation also retains account-generation and hashed linked-identity fences to enforce that decision after recreation. Export, support, appeal, billing management and privacy requests remain available; cancellation does not erase records.

Account deletion removes your profile, viewing records, preferences, discovery progress, push subscriptions and account-linked room contributions from the app’s active database. Affected rooms remove your membership and private contributions. Remaining members keep the decided schedule and aggregate results; future nights you hosted need replanning. Empty rooms are removed. Voluntarily leaving now removes your room membership, private votes, authored contributions and direct contributor links, along with associated room invitations and queued notifications. Remaining members keep shared aggregate results and confirmed plans without your attendance; these are not recalculated as a new vote. Rooms with no remaining members are deleted. Personal libraries, financial records and ongoing family supervision are separate. Earlier departures and owner removals without shared-history deletion can retain account-to-contribution links for export, explicit historical removal or account deletion. In Settings → Privacy & account data → Retained room contributions, you can review and remove attributable past contributions without rejoining a room. This preserves your library, financial records, shared outcomes and unrelated current activity; plans that still assign you as host need replanning. Text without reliable authorship and every past influence on shared selections cannot always be removed. A notification already sent to a provider cannot be recalled. Legacy contributions that no longer have a reliable account link cannot be reliably attributed. Other people’s saved copies, already-delivered notifications and infrastructure-provider logs or backups are outside the app’s deletion controls. Deleting unscene does not delete your ChatGPT account. A new unscene account is created only when you explicitly start again.

Film Family and account controls

These details form part of this privacy policy and apply whenever Film Family is used.

Who can use each profile

Adults confirm that they are at least 18 and are the parent or legal guardian. Teens use their own eligible ChatGPT or verified email sign-in, must meet the applicable minimum age, and accept family supervision before linking. ChatGPT’s separate account rules apply when it is the chosen sign-in method. Do not share sign-in credentials or one-time codes.

Under-13 kid profiles are operated by the parent only. The parent supplies the nickname and viewing information and performs every interaction. There is no independent child login or child device session. A checkbox does not establish verified parental consent for independent child access. That access will require a compatible authentication and verifiable parental consent process before it can be enabled.

What the family feature stores

We store the family name, owner and co-guardian account identifiers, linked profile identifiers and roles, invitations hashed by normalized email, adult acceptance times and privacy-notice versions, revocation times, parental relationships, and each profile’s controls. A revoked adult’s internal identifier remains in a room-access exclusion record while old Family rooms exist. We also store viewing answers, rewatch choices, disc ownership, and other viewing details actually entered. Parent controls include allowed age ratings, allowed and blocked genres, explicit title approvals, search and title-submission permissions, movie-night creation permission, and how new invitations are handled.

Signed-in accounts privately store their verified email on the profile for account linking, invitation matching and administration. Parent-operated kid profiles do not have a child email. Invitations and email-based blocks use a one-way hash of the normalized email; hashes still count as account-related data and are not anonymous. Emails are not shown to watch-party members. A room owner can email an invitation link through our transactional email service; the email address and delivery record are held in that service. Family alerts record new-party requests, approval decisions and joins. Registered account names, verified emails, roles, creation times and saved-title counts are visible to authorized site administrators.

Parent visibility and control

The family owner and current co-guardians can review controls, see movie-night join requests and notifications, operate a restricted watch view, export a supervised profile’s retained data, and delete the profile. Restricted profiles cannot remove their own supervision, promote their account type, or use ordinary account deletion to evade family controls. They cannot block a current guardian or other members of the same Film Family.

“Require approval” blocks joining until the parent approves. “Allow and notify” permits a join and records a notification; it is a less restrictive choice. Alerts appear in the parent dashboard whether or not push notifications are enabled. Browser delivery is optional and is subject to device and network settings.

Approved content and limited delivery

Restricted profiles receive a separate watch interface. The server checks every supported action and sends only approved title information. Disabled search, creation and submission interfaces are not included in that profile’s page. Existing public pages and previously downloaded files cannot be remotely erased from a device.

IMDb scores are audience ratings, not age classifications. Titles without a known age classification are denied by default. Parents may explicitly approve such titles for their own family. A classified title still has to match the permitted age ratings, and blocked genres always apply. US classification labels may differ from classifications elsewhere. Source classifications can be incomplete or incorrect, so parents should check suitability themselves.

The app’s ordinary title sources, hosting and sign-in providers still apply. Remote poster hosts receive ordinary browser request information. We do not add advertising, behavioral tracking or independent under-13 data collection through this feature.

Sharing in movie nights

When a restricted profile joins a permitted movie night, participants can see its nickname, participation and shared watch outcomes. Its saved answers influence matches. Parents should approve only parties they consider appropriate. Shared queues are filtered to meet the restrictions of all participating family profiles. Restricted push messages use generic update text rather than title names.

Family decisions and peers rooms

A kid profile has one Family-room slot. A supervised teen can have one Family room and, when the parent enables it, one peers room. Family adults have one Family-room slot in addition to two general rooms. Family and peers rooms require an allowed content-rating selection; a title without a known classification does not enter these shared rooms even if it is explicitly approved for a personal quiz. A teen room owner can narrow parent-approved genres and ratings but cannot expand them.

Family decision rounds use private confirmed rankings. Parent votes have weight 1.75, with parent preferences used to resolve tied results. A ranking cannot be edited after confirmation; a permitted revote is a new ballot. Current guardians who operate supervised profiles can access that profile’s own records, including its ballot in an export. Shared schedules, availability, hosting, cancellation, and group watch confirmations work as described in the general privacy policy. Other-room commitments are used only to prevent scheduling overlaps.

Retention, exports and deletion

Family records remain in the active database while needed for the family relationship. A revoked co-guardian loses access to child profiles, Family rooms and notices; existing room seats may remain in stored room history until cleanup, but do not grant access. Unaccepted invitations expire after seven days and are eligible for deletion during account activity. Family alerts are retained for up to 90 days and cleaned during family-dashboard activity. Profiles and viewing data remain until the parent deletes them; parents should remove profiles they no longer need. Expired room records may remain for gathering history.

Parents can export a supervised profile in JSON from Film Family. Deleting a supervised profile removes its account-linked active records and contributions to retained rooms. Deleting the family owner account also deletes its supervised profiles and family records. A co-guardian’s separate account and personal library remain, without family authority. Other participants’ personal libraries remain. Data already copied by others, delivered notifications, and provider logs or backups are outside the app’s deletion controls. Legacy room content with no account link cannot always be attributed.

Teens and parents operating a supervised profile can also open More options → Retained room contributions in the solo watch view to review and explicitly remove attributable contributions from rooms the profile no longer belongs to. This does not end supervision or delete the personal library or payment records. Shared outcomes and other members’ records remain; plans assigning that profile as host need replanning. Older text without reliable authorship may remain.

After a parent deliberately deletes a linked teen’s unscene profile, the family relationship ends. The teen’s separate sign-in identity remains unless the teen deletes it. This site cannot prevent someone from using a different account or another service.

Children, security and changes

Independent use is not available to children under 13. Parents may operate kid profiles themselves under the Film Family notice. Users must meet the age requirements of their chosen sign-in method and applicable local minimums. If you believe a child under 13 has supplied personal information, notify the site operator so it can be investigated and removed where required.

We use authenticated accounts, access checks and encrypted connections, but no internet service can promise absolute security. Information may be processed in countries where our infrastructure providers operate. Applicable privacy rights depend on your location; this policy does not limit those rights.

Changes will be posted on this page with a revised effective date. An app-update notice signals a new release; it does not by itself constitute consent to new uses of personal information.