Privacy Policy

1. Who is responsible for your data

Kinozine is a free, non-commercial website for tracking films and TV series. It is operated by Safha Halit ALTIN, Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50 Maltepe İstanbul, Türkiye (“we”, “us”, “our”). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the data controller (veri sorumlusu) under Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

General questions: [email protected]. Privacy questions and requests to exercise your rights: [email protected].

If you live in Türkiye, please also read our separate Information Notice under Turkish Law No. 6698 (KVKK), which contains the additional information required by Turkish law.

2. The short version

• We only process the data needed to run the website, your account, your lists and your profile.
• There is no advertising, no third-party analytics, no tracking pixels and no social media plugins.
• All data is stored on our own server, hosted by Hetzner Online GmbH in Germany (EU). We do not sell or rent your data to anyone.
• When you use Kinozine, your browser only talks to our server: fonts are self-hosted, we use no content delivery network (CDN), and film and series data and images from The Movie Database (TMDB) are fetched by our server, not by your browser.
• We only use strictly necessary cookies and browser storage, which is why you do not see a cookie banner.
• You can download your data as a JSON file and delete your account yourself at any time.

3. When you visit the website

When you open a page, your browser automatically sends technical information to our server, such as your IP address, the address of the requested page and your browser's user-agent string. This is technically necessary to deliver the page to you.

IP addresses are not stored in our database. They are processed only temporarily in the server's memory to limit the number of requests (rate limiting) and to prevent abuse, and they are discarded after one hour at the latest. Access logging on our web server (reverse proxy) is disabled.

We count page views per page type and per day (for example, how often film and series pages were viewed on a given day). These counts are anonymous and aggregated: we do not use cookies for them and we do not record your IP address or any identifier. They do not allow anyone to be identified.

4. Using {siteName} without an account

You can use Kinozine without registering. If you use the list features as a guest, your list is stored only in your own browser (localStorage). It is never sent to our server unless you create an account and choose to import it.

When you search for a film or series, our server forwards your search term to TMDB to retrieve results. The search term is sent without any information that identifies you: no IP address, no account details and no cookies. Your recent searches are saved only in your browser.

5. Your account

To create an account, you need to choose a username and provide an email address and a password. Without this information we cannot create an account for you. When registering, you also confirm that you are at least 16 years old and accept our Terms of Use. We process the following account data:

• Username: this is public and appears on your profile and in your profile address.
• Email address: used to verify your account, reset your password, confirm changes to your email address and send you security notices. It is not shown publicly.
• Password: we never store your password itself, only a hash created with the argon2id algorithm. Nobody, including us, can read your password.
• Language and theme preferences.
• Two-factor authentication (optional): if you enable it, we store the secret used to generate your codes (encrypted at rest) and your one-time recovery codes (stored only as hashes).
• Account role: for example, whether an account is a regular user account or an administrator account.
• Timestamps: when your account was created, when you last logged in and when you were last active.
• The date on which you accepted the Terms of Use.

6. Your profile

You can add the following information to your profile, all of it optional: a display name, a bio, a location, links to your social media profiles, an avatar image, favorite titles and profile design choices. You also decide whether your profile and your list are public or private.

A public profile can be viewed by anyone at https://kinozine.com/u/your-username, including people who do not have an account. Please only add information you are comfortable sharing publicly, and keep in mind that anything you make public can be viewed, and potentially copied or saved, by others. Your username is always public.

We do not ask for sensitive information such as health data or religious or political beliefs. Please do not include such information in your profile.

7. Your lists and activity

To provide the tracking features, we store the titles on your list together with the status you choose for each one (watching, completed, on hold, plan to watch or dropped), your personal score from 1 to 10, your episode progress and the times at which entries were added or changed.

If your profile is public, a feed of your recent list activity is shown on it.

8. Login sessions

When you log in, we create a random session token and store it in the “kz_sid” cookie in your browser. On our server we keep only a hash of this token, together with your browser's user-agent string, the time the session was created, when it was last used and when it expires. Sessions expire after 30 days. We use this information to keep you logged in and to protect your account against misuse.

9. Emails

We only send emails that are needed for your account: account verification, password reset, confirmation of email address changes and security notices. We do not send newsletters or advertising.

For each email we send, we keep a log entry with the recipient address, subject, delivery status and time for 90 days, so that we can detect and fix delivery problems and investigate misuse.

If you email us, your message, your email address and any other information you include are stored on our self-hosted mail server in Germany. We use them only to deal with your request and keep them only as long as needed for that purpose and any follow-up.

10. Purposes and legal bases

Under the GDPR, we rely on the following legal bases. For users in Türkiye, the corresponding legal grounds under the KVKK are explained in our KVKK Information Notice.

• Providing the service and your account (registration, login, lists, profile, data export, account emails and answering questions about your account): Art. 6(1)(b) GDPR, because the processing is necessary to perform our agreement with you under the Terms of Use.
• Security and abuse prevention (temporary processing of IP addresses for rate limiting, session data, the mail log and the administrator audit log): Art. 6(1)(f) GDPR. Our legitimate interest is keeping Kinozine secure, available and free of abuse.
• Anonymous page-view statistics: Art. 6(1)(f) GDPR, to the extent personal data is involved at all. Our legitimate interest is understanding which parts of the site are used so that we can improve it. The resulting statistics contain no personal data.
• Answering general enquiries that are not related to an account: Art. 6(1)(f) GDPR. Our legitimate interest is being able to respond to people who contact us.
• Complying with legal obligations, for example answering requests to exercise your data protection rights or lawful requests from authorities: Art. 6(1)(c) GDPR.

11. What we do not do

• We do not show advertising and do not use third-party analytics, tracking pixels or social media plugins.
• We do not load Google Fonts or use a content delivery network (CDN); all files are delivered from our own server.
• We do not sell or rent your data or share it for marketing purposes.
• We do not request special categories of personal data (such as health data or religious or political beliefs).
• We do not use automated decision-making, including profiling, that has legal or similarly significant effects on you.

12. Hosting and other recipients

Our server, including our self-hosted email server, is operated by Hetzner Online GmbH in Germany. Hetzner processes data only on our behalf and according to our instructions as a processor, on the basis of a data processing agreement under Art. 28 GDPR. We do not use any other processors.

The film and series information and images on Kinozine come from The Movie Database (TMDB). TMDB does not receive your personal data: our server retrieves the data, and search terms are forwarded without any identifier. TMDB only sees requests coming from our server.

We disclose personal data to authorities or courts only where we are legally required to do so.

Information you make public on your profile can be seen by anyone. Profiles may contain links to external websites (for example, social media links added by users). If you follow such a link, the privacy policy of that website applies.

13. Where your data is stored

All data of Kinozine, including emails, is stored on our server in Germany, within the European Union.

For users in Türkiye, storing data in Germany is a transfer of personal data abroad under Article 9 of the KVKK (as amended in 2024). For this transfer, we rely on appropriate safeguards in the form of a standard contract. More details are given in our KVKK Information Notice.

Apart from this, your data is not transferred to countries outside the European Union and Türkiye.

14. How long we keep your data

We keep personal data only as long as necessary for the purposes described above:

• Account, profile and list data: until you delete your account. Deletion from our live database happens immediately. Our encrypted server backups are rotated, so any remaining copies are deleted within 7 days.
• Login sessions: 30 days.
• Verification links: 48 hours. Password reset links: 1 hour.
• IP addresses (in server memory only): at most 1 hour.
• Mail log: 90 days.
• Administrator audit log (a record of actions taken by administrators, which may refer to the affected account): 1 year.
• Emails you send us: as long as needed to handle your request and any follow-up.
• Data stored in your browser (guest list, preferences, recent searches): until it is deleted from your browser.
• Anonymous aggregated statistics: indefinitely, as they are not personal data.
• Exceptions: if we are legally required to keep certain data for longer, or need it to establish, exercise or defend legal claims, we keep only that data and only as long as necessary.

15. How we protect your data

We use technical and organizational measures appropriate to the risk. The most important ones are listed below. No system is completely secure, so we also recommend using a strong, unique password and enabling two-factor authentication.

• Encrypted connections (HTTPS) across the entire website
• Password hashing with argon2id
• Two-factor authentication, optional for all users and mandatory for administrators
• Rate limiting to slow down attacks such as password guessing
• Protection against cross-site request forgery (CSRF) and a strict Content Security Policy
• Encrypted backups
• Administrative access limited to what is necessary (least privilege), with an audit log of administrator actions

16. Your rights

Under the GDPR you have the rights listed below. Users in Türkiye have the rights set out in Article 11 of the KVKK, which are explained in our KVKK Information Notice.

To exercise your rights, email [email protected], ideally from the email address linked to your account. We may ask for additional information to confirm your identity. We respond free of charge as a rule, within one month (within 30 days for applications under the KVKK).

• Access (Art. 15 GDPR): you can ask whether we process your data and request a copy of it.
• Rectification (Art. 16 GDPR): you can have incorrect data corrected. You can change most of your data yourself in your settings.
• Erasure (Art. 17 GDPR): you can have your data deleted. You can delete your account yourself at any time in your settings.
• Restriction of processing (Art. 18 GDPR): in certain cases you can ask us to restrict the processing of your data.
• Objection (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests.
• Data portability (Art. 20 GDPR): you can download your data yourself in the machine-readable JSON format in Settings.
• Withdrawal of consent (Art. 7(3) GDPR): where processing is based on your consent, you can withdraw it at any time with effect for the future.
• Complaint (Art. 77 GDPR): you can lodge a complaint with a data protection supervisory authority, in particular the authority of the EU country where you live. In Türkiye, the competent authority is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

17. Minimum age

Kinozine is intended for people aged 16 and over. When registering, you must confirm that you are at least 16 years old. If we learn that an account belongs to someone younger, we will delete it. If you believe that a child under 16 has registered, please contact us at [email protected].

18. Cookies and browser storage

We only use cookies and browser storage that are strictly necessary to provide the website or to remember settings you have chosen. You can find the full list and instructions for deleting them in our Cookie Policy.

19. Changes to this policy

We will update this Privacy Policy when our service or the legal requirements change. The date of the latest update is shown on this page. If we make material changes, we will inform registered users in advance by email or through a notice on the website.

20. Contact

For any questions about privacy at Kinozine, email [email protected] or write to Safha Halit ALTIN, Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50 Maltepe İstanbul, Türkiye.