This Privacy Policy (“Policy”) describes how rHater (“rHater”, “we”, “us”, or “our”) collects, protects, uses, and shares Personal Data collected from users (“User”, “you”, or “your”) of the rHater website and its related features (collectively, the “Service”).
This Policy informs you about processing under the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation. Using the Service, accepting our Terms of Service, or acknowledging this Policy does not give general consent to processing. The purposes and legal bases are explained below; consent is requested separately where required.
The Data Controller responsible for processing your Personal Data is:
Andrea Surdo
Via Romolo Gessi 1, Rome (RM) 00153, Italy
Owner Contact Email: andrea.surdo13@gmail.com
Legal Inquiry Email: legal@rhater.com
Among the types of Personal Data that this Application collects, either directly or through trusted third parties, there are:
Age declaration: Our minimum service age is 14. This declaration is not verified proof of age or parental permission, and is separate from any consent required for optional processing. Higher local thresholds and requirements for minors can still apply. See the eligibility section of the Terms.
Review imports: When you choose to import a CSV export, the website reads it in your browser and sends the selected review fields for import. Movie titles and years are sent to TMDB to find matching films; imported ratings and review text are saved in our database. This does not connect to or sign in to your Letterboxd account.
Profile and review visibility: Profiles, ratings and reviews are public by default. You can make your profile private in your profile settings. Your name, avatar and handle remain visible; other profile details, individual ratings and reviews are available only to you and approved followers. Existing followers remain approved when you go private. Going public makes your reviews public again and approves pending follow requests.
Private ratings still contribute to aggregate movie and group statistics. Group awards may identify you by name, and statistics in public groups remain public. Membership of a group does not grant access to private individual ratings or reviews. With few contributors, aggregate statistics may allow a rating to be inferred. Removing a follower revokes access to future requests but cannot withdraw content they have already viewed or saved.
Comments and the identity of people who like a review also follow profile privacy and require access to the review they relate to. Aggregate like totals still include private profiles. Profile banners are delivered through an endpoint that checks profile access; avatars remain public. Previously public banners may remain available briefly while CDN invalidation propagates.
The following services support the current website. Hosting, database and media providers process service data for us; identity providers and external websites may also process data for their own purposes under their own policies. Loading external images or privacy tools sends technical request information to their providers.
Vercel (Vercel Inc.)
Purpose: Website hosting, server-side application functions and content delivery.
Data: Requests and connection information, IP address, browser details, operational logs and the account or content data handled by application functions.
Supabase (Supabase, Inc.)
Purpose: Database and account authentication, email verification and password recovery, and scheduled background work.
Data: Account email, password hashes, authentication identifiers and tokens, profiles, image references, reviews, social interactions, groups, lists, preferences and operational records. The media-cleanup queue contains an account UUID and retry timestamps.
Google sign-in and contact email
Purpose: Optional Google sign-in and delivery of messages sent to the controller’s Gmail contact address.
Data: Name, email address, avatar image URL and sign-in identifiers for Google login; sender information, message contents and attachments when you email our Gmail address.
This login method is optional. Google handles your sign-in; your Google password is not provided to rHater. Google-hosted profile images may be requested directly by the browser.
Cloudinary
Purpose: Storage and delivery of uploaded profile avatars and banners, including image replacement and deletion.
Data: Uploaded images, image identifiers containing an account UUID, asset metadata and technical delivery requests. Avatars are publicly delivered; protected profile banners are served through the website after checking access. Removal requests also invalidate cached copies and are retried after service failures.
The Movie Database (TMDB)
Purpose: Movie search, film metadata, posters and backdrop images.
Data: Our server sends movie search terms, titles, years and movie identifiers to the API. We do not send your account email, personal ratings or review text to TMDB. Your browser requests movie images from TMDB’s image delivery service, which receives technical request information such as your IP address and browser details.
iubenda
Purpose: Embedded privacy tools, hosted legal documents and cookie or privacy-preference management.
Data: Technical requests to load scripts and documents, and preference or consent records handled by the privacy tools. The website loads iubenda scripts; the available privacy choices depend on their configuration.
Other image hosts: If you use an externally hosted image URL, displaying that image can contact its hosting provider directly. Default initial-based avatars are generated within the website.
The current Service is free and does not use payment processing or advertising-network integrations.
Processing Methods. The Owner processes the Data of Users in a proper manner and takes appropriate security measures (encryption, secure databases) to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
Place of Processing. The controller operates in Italy. The services listed above may process data through hosting locations, delivery networks, support teams and subprocessors in other countries, including outside the EEA. A database hosting region does not determine every processing location. Where a transfer outside the EEA requires safeguards, applicable mechanisms include adequacy decisions or standard contractual clauses. Contact the controller for details of processing locations and safeguards applicable to your data.
If you are located in the European Union, EEA, or United Kingdom, you hold the following rights under the GDPR:
You also have the right to lodge a complaint with your local Data Protection Authority.
We respect your right to control your personal data. We offer both automated and manual methods to permanently delete your account and all associated ratings, reviews, and group memberships:
Authentication cookies allow Supabase to maintain your session. Browser session storage caches group information, and local storage can remember your response to the handle reminder. These features support access and preferences rather than advertising profiles.
iubenda provides the embedded cookie and privacy tools. Use “Your Privacy Choices” in the footer to review the choices available in those tools. You can also clear or restrict cookies and browser storage in your browser, although blocking essential storage may prevent sign-in or other requested features.
The website does not integrate an advertising SDK or a separate visitor-analytics SDK. Operational logs and in-app movie statistics serve different purposes from tracking visitors for advertising. Non-essential trackers, if introduced, require an appropriate legal basis and consent where required.
This page describes the website’s current data flows. Cookie information and separately hosted legal documents are also available through iubenda: