Cinevarium
Sign in

Privacy policy

Last updated: 27 September 2026

Cinevarium (https://test.cinevarium.com) and the Cinevarium mobile app are a non-commercial hobby project run by Ali FINDIK as a private individual ("we"). This policy explains which personal data the website and the app collect, why, and what your rights are. It is also the information notice required by the Turkish Personal Data Protection Law No. 6698 (KVKK); the data controller is Ali FINDIK.

Questions and requests: info@alfion.com.tr.

1. What we collect

  • Account data: your email address, username, display name, password (stored only as a salted hash, never in clear text), the optional "about me" text, the dates you registered and last signed in, and your acceptance of the terms.
  • What you create: the criterion scores you give to films and series (including whether a score came from a suggestion), the reviews you write and the visibility of each, the score suggestions prepared from your reviews, the criteria you add to the shared criteria list, your watchlist and watched list, friend requests and friendships, your visibility settings, the permission you give for your reviews to be used in improving the model and when you gave it, the reports and blocks you make, and the titles the "What should I watch?" strip showed you, which of them you opened, which you put on your watchlist from it, and the likes, reasons and short notes you give the picks.
  • Technical data: your IP address and the request details in the server logs, kept for up to 30 days for security, abuse prevention and error diagnosis; and, for the mobile app, one sign-in session per device (a hashed token with its creation, last-use and expiry times, without device identifiers).
  • Cookies (website only): the sign-in cookie (30 days), your language choice (1 year), your profile view choice (1 year) and a security token against forged requests. There are no analytics, advertising or tracking cookies, and the app contains no third-party tracking or advertising components.

2. Why we use it and on what legal basis

  • To run your account and provide the service (performance of the contract with you, KVKK article 5/2-c): signing you in, saving your scores and lists, showing your profile to the people you allow, letting your friends see what you share, picks for you (computed only from your own scores).
  • To show community averages: your scores are counted in the average of each criterion of a title, without your name. This is the core of the service.
  • To improve the scoring model (our legitimate interest, article 5/2-f): the average and the number of scores per title and criterion, which cannot be linked to you, are used to calibrate and train the model that produces the AI scores. Individual scores are never fed into the model without the separate permission below, account data never is, and no personal data is sent to any AI service; the model is run by us, outside the service.
  • To prepare score suggestions from your review (performance of the contract, article 5/2-c; only when you ask for them): the text of your review, without your name or account data, is given to an open-source language model running on our own computer, and the suggestions come back to you. The text is not sent to any AI company and is not kept on that computer after the suggestions are made.
  • To improve the scoring model and produce AI scores with your reviews (your explicit consent, article 5/1; given in your profile settings, off by default and withdrawable at any time): if you allow it, the text of your reviews and the scores you gave the same titles, whatever their visibility, are used to train and measure the model and to produce AI scores for titles that have no critical-reception summary on Wikipedia. Your name, username and email address are not added to this data, and personal data in the texts, such as contact details, is masked before training. Withdrawing your consent does not affect the lawfulness of the processing before it.
  • To improve the picks (our legitimate interest, article 5/2-f): the record of the picks shown to you and opened, and of the likes, reasons and short notes you give them; your next picks change with them; deleted with your account.
  • Communities (performance of the contract, article 5/2-c): joining or following a community shows to its managers and, as the community sets it, to its members; the announcements you write on its page are public; your scores count, without your name and once at least two members scored, in the criterion averages of the communities you belong to, which you can switch off in your profile settings. Your memberships and follows are deleted with your account; your announcements stay without an author.
  • To keep the service safe (our legitimate interest, article 5/2-f): rate limits, abuse prevention, moderation of reported content, error diagnosis.
  • To contact you about your account (performance of the contract): password reset and verification emails and important notices about the service. We send no marketing emails.

Where your data is stored. The servers run in Amazon Web Services data centres outside Turkey. Under KVKK article 9 we store your data there on the basis of the explicit consent you give when you create your account. You can withdraw it at any time by deleting your account; the service cannot be provided without storing your data on these servers.

3. Who can see your data

  • Other users see your display name, username and "about me" text. Your watched list, watchlist and scores are visible according to the setting you choose for each list: only you, your friends, or everyone (including visitors without an account). Your reviews are visible according to the setting you choose for each review; with everyone, on the title's page, including to visitors without an account. Score suggestions are shown to you only. Your scores always contribute to the community averages without your name.
  • Service providers that process data on our behalf: Amazon Web Services (hosting) and an email delivery service for account emails. When you search for a title that is not in the catalogue yet, the text you type is sent to The Movie Database (TMDB); when you type a new criterion, its name is sent to DeepL for translation. Neither receives your account data. No AI service receives any of your data.
  • YouTube (Google): when you play a trailer, the video is loaded from YouTube (Google); YouTube's own terms apply while it plays.
  • Authorities, when the law requires it.

We do not sell personal data and we do not share it with advertisers.

4. How long we keep it

Your data is kept as long as your account exists. You can delete your account at any time in the app (Settings, Delete account) or on the website at https://test.cinevarium.com/Account/Delete. Deletion removes your account, scores, reviews and their suggestions, lists, friendships, reports, blocks and sessions immediately. You can also delete a single review at any time. Criteria you added remain in the shared criteria list without any link to you. Aggregated statistics derived from your scores (averages and counts per title and criterion) are recomputed at the next model update, at the latest 6 months after the deletion. When you withdraw the model permission, or delete a review or your account, your reviews leave the next model training and the AI score calculation within 6 months at the latest, and AI scores derived from them are recalculated. Backup copies are overwritten within 90 days and server logs are deleted after 30 days.

5. Your rights

Under KVKK article 11 (and the GDPR, where it applies to you) you can ask whether we process your data, request information, correction, deletion or restriction, object to processing, and ask that third parties we shared data with be told about corrections or deletions. Most of this you can do yourself in your profile settings or by deleting your account. For everything else write to the address above; we may ask you to confirm your identity and will answer within 30 days. You can also complain to the Personal Data Protection Authority of Turkey or, in the EU, to your local supervisory authority.

6. Children

Cinevarium is for people aged 16 or older. We do not knowingly collect data from younger children; if we learn of such an account we delete it.

7. Changes

When this policy changes, the new version is published here with its date. If the change is material, we announce it on the website and in the app.