Privacy Policy

How ThumbScore handles your data and privacy.

Effective Date: October 29, 2026

Welcome to ThumbScore ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information about you when you visit our website at thumbscore.net.

By using ThumbScore, you agree to the terms of this Privacy Policy.

1. Information We Collect

Browsing ThumbScore needs no account. An account is needed only for the rating and prediction app at thumbscore.net/rate. We collect as little as that app needs.

If You Create an Account

• Account details: your email address and a display name. If you sign up with a password, we store it only as a salted one-way hash (scrypt), never the password itself.
• Sign in with Google: if you choose it, Google shares your name, email address and Google account ID with us (its basic profile can also carry your picture and language, which we do not keep). We request only the basic openid, email and profile permissions and use them only to sign you in.
• Sign in with Apple: if you choose it, Apple shares your email address (or, if you choose Hide My Email, a private address of Apple’s that forwards to yours), an Apple account ID, and your name the first time only. We use them only to sign you in, and the name only to name a new account.
• Movie picks by email (optional): only if you tick the box when you sign up, or say yes on your Account page. We keep the date you said yes; say no there at any time and we stop. Without that yes, your email address is used only to sign you in.
• What you enter: the films you rate, your scores, anything you write about them, the films you save to your Want to watch list, your answers to Compare (which of two films you liked more) and to Seen these? (the films you say you have not seen too), the streaming services you pick to filter your list by, the language you pick for your predictions’ reasons, and the comments you report, plus the predictions and taste profile the app builds from them, and a record of each batch of predictions and each paid model call made for you (its kind and when), which the daily limits count. If you import ratings from another service, we read the file you upload and save only the ratings you confirm; an upload you do not confirm is kept, unsaved, until your next import, the first import anyone makes a day or more later, or the deletion of your account, whichever comes first. While it is kept, Download my data includes it: the ratings in it and the titles it could not match.

Information You Provide Voluntarily

If you contact us via email or a contact form, we will collect the information you provide in that communication solely to respond to your inquiry. The Feedback page sends our own server what you write, your name if you give it, any screenshots you attach, and, so we can see the problem, the page you came from, your browser and device, its screen size and language; reports are kept on our server, with no automatic deletion yet.

Two forms are handled for us by Formspree, a form service, which receives what you type and passes it to us: the form on the Contact page (your message, and your email address if you give it) and the “Get Free Movie Picks” sign-up on the About page (your email address only). The sign-up keeps your address for when ThumbScore starts sending picks by email; nothing has been sent to it yet. To have yours removed, write to us through the Contact page.

Fix My Subtitles

The Fix my subtitles page reads the subtitle file you open there, and the name of a video file if you choose one, in your own browser. Neither the file, nor its words, nor the video’s name is sent to us or to anyone; the fixed file is saved straight to your device. As on every page, the visit itself is counted by our analytics (below).

Information We Collect Automatically

When you visit ThumbScore, we automatically collect certain technical information about your device and visit. This includes:

• Log Data: Your IP address, browser type, operating system, referring URLs, and pages visited.
• Analytics Data: How you interact with our website, such as clicks on movie pages, filtering actions, and time spent on pages. When you press "Pick for me", a "Watch free" button on a list, or a where-to-watch button on a film page (free, paid, rental or tickets), your browser tells our server so with an empty request, which our log records like a page view. The request's address says only which button it was: on a film page, whether its service is free, and whether it was the button shown beside the poster to someone arriving from a service's list. We count these presses and store nothing else about them.

2. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve site performance, secure the website, and analyze our traffic.

Categories of Cookies We Use

• Rating-app Cookies (ThumbScore): set only when you use the rating app, never for tracking or advertising, and never shared. A session cookie keeps you signed in for 30 days from the last time you open a page of the rating app (it renews then, until 180 days after you last sign in), with a readable mark holding only "1" so film pages know to show your own score. Before you sign up, the scores you give films (up to 30) are kept in a cookie in your own browser for three hours. Our server reads it to show your progress and, on the sign-up page, films like the ones you liked; it stores those scores only if you sign up or sign in. Words you write about a film before you sign up stay only in your own browser (its local storage) until you have an account; the first ThumbScore page that then sees you signed in adds them to your rating of that film. A cookie set at sign-in names your account and the films your browser's scores went to (a day), so those words can reach only those films. Clearing your browser's site data removes them. While you sign up, short-lived cookies remember which film you came to rate or the films you picked in the taste test (three hours, as long as your scores wait), and the film you wanted predicted (30 days). "Not yours? Clear them" on the sign-up page removes all of these and leaves a readable mark holding only "1" (three hours) so the site's pages also forget any words kept in your browser. Signing in with Google or Apple uses a one-time code against forged sign-ins (ten minutes); the name Apple sends the first time waits in a cookie for at most five minutes, only to name a new account. Choosing the rating app's language (English or Spanish) keeps that choice in a cookie holding only the language (a year). After you sign in, a signed mark (400 days, holding no email address) lets this browser sign in even when someone else keeps trying wrong passwords for your address.
• Strictly Necessary Cookies (Cloudflare): We use Cloudflare as our Content Delivery Network (CDN) and security provider. Cloudflare places necessary cookies to identify malicious traffic, protect against DDoS attacks, and ensure the website loads quickly. These cookies do not store personally identifiable information. If the sign-up or sign-in form shows Cloudflare's “Verify you are human” check (Turnstile), your browser loads it from Cloudflare, and our server sends Cloudflare your answer with your IP address to check it.
• Analytics Cookies (Google Analytics 4): We use GA4 to understand how users engage with ThumbScore. GA4 collects anonymized data about your session, such as pages viewed, links clicked, what you type into the site's search box (sent once you pause typing), and that a film was rated (never the score you gave it; like every event, it carries the address of the page it happened on, so a rating on a film's own page names that film). Pages also load their fonts from Google Fonts, which, like any site it serves, sees your browser's address. You can opt out of Google Analytics by using the Google Analytics Opt-out Browser Add-on.
• Third-Party Links: ThumbScore does not participate in any affiliate marketing programme and sets no affiliate or advertising cookies. Outbound links to streaming services are plain links and earn us nothing.

3. Third-Party Links and Streaming Platforms

ThumbScore acts as a directory and search engine for movies. We extensively link to third-party streaming platforms (such as Netflix, HBO Max, Disney+, Hulu, Prime Video, Tubi, and YouTube).

Please note: We do not control these third-party websites. Once you click a link and leave ThumbScore, you are subject to the privacy policy and terms of service of that specific platform. We are not responsible for the privacy practices, tracking, or data collection of these external sites.

4. Third-Party Data Sources

ThumbScore uses the TMDB (The Movie Database) API to fetch movie metadata, posters, and cast information. TMDB has its own privacy practices governing how it handles API requests, but ThumbScore does not pass any user-identifiable information to TMDB when making these requests. Posters we do not keep a copy of are loaded by your browser straight from TMDB's image server, which, like any site, sees your browser's address and which posters it asked for. A film page's trailer button loads YouTube's own player, under YouTube's privacy policy.

How Predictions Are Made

To predict your score for a film, the app sends your ratings (with whether you finished the film and how well you remember it) and what you wrote about them, your answers to Compare, and the taste profile and past predictions it keeps for you (never your email address or name) to Anthropic's Claude API, which returns the predictions. If you write a review, its words may also be sent to Claude to check whether it is detailed; that only decides how soon your list of predictions refreshes itself. Anthropic processes this under its commercial terms, which do not allow it to train its models on that data. We do not send your data to anyone else, do not sell it, and do not use it for advertising.

Google User Data

ThumbScore's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Google is used only to sign you in and is never shared, sold or used for advertising.

5. Your Privacy Rights

Depending on where you live, you may have specific rights regarding your data.

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act, California residents have the right to:

• Know what personal information is being collected.
• Request the deletion of their personal information.
• Opt-out of the "sale" or "sharing" of personal information.
• Note on "Sale/Sharing": ThumbScore does not sell your personal data for money. The site uses Google Analytics; you can disable cookies in your browser settings to opt out. You can disable cookies in your browser settings to opt out.

European Economic Area (EEA) and UK Residents (GDPR)

If you are located in the EEA or UK, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Object to or restrict the processing of your data.

Our lawful basis for processing limited analytical data is our legitimate interest in operating and improving our website securely.

6. Data Storage and Security

Account data, ratings and predictions are stored on our own server and in daily backups (on the server, on our own computer, and an encrypted copy elsewhere), which we also use to test changes to the site before they go live and to build the film pages' public reviews. A deleted account leaves these rolling backups as they are replaced, within two weeks, though our computer's own long-term backup (Time Machine) can hold older copies for longer. The count of an account's paid predictions, which keeps each day's limits, is kept for three days from each prediction and removed at the site's next paid prediction after that, deleted accounts' too, under a one-way code made from its Google or Apple sign-in, or from the account itself for an email account (never a name or an address), so a Google or Apple account deleted and made again keeps that day's limit. Your ratings and what you write are private to your account, with two exceptions you choose. Words you post as a public review (with that rating's score, as it is now), a comment or a reply are shown on that film's page under the public name you pick on your Account page, never your email. You can delete any of them at any time, and links are not allowed in them; a deleted review's words are removed from our database at once, and from the film's public page with the site's daily update (usually within a day: the update checks each review against the app just before it builds the pages). And your taste card, if you make one on your Account page, is a public page of your favourite films and their scores, the directors you trust and where you part company with the crowd, how many films you have rated and your typical score, the genres you lean towards and away from, and how closely ThumbScore's predictions match your scores (never what you wrote, never your email): anyone with its link can see it, it follows your later ratings, and switching it off stops the link at once. To delete your account and everything in it, use Delete my account on your Account page, or email the address below and we will do it within 30 days. The hearts on the public catalogue pages keep their list on your device (localStorage). It is sent to us only when your account keeps a Want to watch list and you are signed in: the hearts then save to that list, and the films that browser had saved are added to it once. Signing out of that browser forgets the account's copy kept there. The site also keeps a few settings in your browser that are never sent to us: the last ten films you opened, the country, language and streaming services you chose on the catalogue, that you closed the cookie notice, and your picks in the taste test while you take it. The feedback button keeps the page you were on and your window's size, which reach us only if you send feedback.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page with a revised "Effective Date."

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Email: [email protected]