BLRB Digital LLC runs Shortlist (the apps for iPhone and Android, the shortlist.watch website and The Reel newsletter). This notice is given at or before the point we collect your personal information. Each part is explained in full in the section of this Privacy Policy it names.
What we collect (Section 1): account and contact details (phone number, email address, username, the name Apple or Google gives us), your birthday, your profile, the rankings, lists, reviews and comments you post, device and app information, app performance data, identifiers including advertising identifiers, how you use the apps and the website, and, if you choose, scrambled (hashed) phone numbers from your contacts. We do not collect your precise location.
Why (Section 2): to run Shortlist and its social features, personalize your recommendations, keep the Service safe, send the messages you sign up for, understand how Shortlist is used, and measure our advertising.
Sale and sharing (Sections 3 and 5): we have not sold personal information in the past 12 months. Our apps share identifiers and app activity with Meta and Google to measure our advertising, which may count as "sharing" under California law. We may in the future sell some personal information collected through our website and newsletter (never through our apps), within the limits in Section 5. You can opt out at any time at Do Not Sell or Share My Personal Information, and we honor Global Privacy Control.
How long we keep it (Section 2, Retention, which lists each category): account data for as long as you keep your account, analytics up to 14 months, app performance data up to 60 days, contact hashes up to 30 days, reports up to 12 months, and newsletter data until you unsubscribe.
The full Privacy Policy follows.
This Privacy Policy describes how BLRB Digital LLC ("Shortlist," "we," "us," or "our") collects, uses, shares and sells personal information through the Shortlist apps for iPhone and Android, the shortlist.watch website, our newsletter The Reel, our social media pages and our other activities that link to this Privacy Policy (together, the "Service"). Shortlist is a platform for discovering, ranking and sharing your opinions on movies and TV shows.
Please read it carefully. If you live in a US state with a consumer privacy law, Section 5 explains your rights, including how to opt out of the sale and sharing of your personal information on our Do Not Sell or Share My Personal Information page. If you live in Europe, Section 12 applies to you and controls where it differs from the rest of this policy.
Account and contact data, such as your phone number, email address and password if you sign in with email, the name and email address Apple or Google shares with us if you sign in with them, and your username.
Your birthday, which we ask for when you sign up to confirm you are at least 13 and to apply the protections for teens in Section 9. It is never shown to other users.
Profile data, such as your display name, bio, profile photo, whether your profile is public or private, whether people can find you by your phone number, the accounts you follow, and your genre and title preferences.
Your content, such as your rankings and scores, reviews and notes, lists (with their names, descriptions and cover photos), watchlist, comments, reactions, live event comments, and the reports you send us about content or other users.
Contacts data, only if you use Find Friends: the app sends us scrambled (hashed) versions of the phone numbers in your address book, never names or the numbers themselves, so we can show you which of your contacts use Shortlist.
Newsletter data: your email address and where you signed up, if you subscribe to The Reel on our website or in the app.
Communications data from your messages with us, including through the Service, email or social media.
Promotion data, if you enter a contest or promotion or answer a survey we run.
Device and app data, such as your device model, operating system and app version, language, time zone, the country of your app store, SIM card or device settings, your IP address, push notification token, the identifiers Firebase assigns to your app installation, and a check from Apple or Google that the app is genuine (App Check).
Advertising identifiers: on Android, your device's Google advertising ID; on iPhone, Apple's advertising identifier (IDFA), only if you tap "Allow" in Apple's tracking prompt. These are collected only while ad measurement is on (see Section 4).
App performance data (iPhone app only), collected by Google's Firebase Performance Monitoring: how long the app takes to start and how smoothly its screens draw, how long the app spends in the foreground and background, the web addresses the app connects to (without the query details or the content sent or received), with each request's response code, size and response time, plus your device model, operating system, screen orientation, memory and storage size, CPU usage, mobile carrier and network type (such as Wi-Fi or LTE), language, app version, the country Google works out from your IP address, the Firebase installation ID and a random session ID. It does not include your rankings, searches or anything you type. It is collected only while "Analytics and ad measurement" is on (Section 4); in Europe, only with your consent (Section 12). The Android app does not collect it.
Usage data, such as the screens and features you use, the titles you search for, view, rank and save, when you sign up, open the app or turn on notifications, and how you found the app (for example, the Google Play install referrer or Apple Search Ads campaign that led to your download).
Website data, such as the pages you visit on shortlist.watch, the buttons and links you tap, the site that sent you, your browser type, and an approximate location (such as your city) that Google Analytics works out from your IP address. If you open a referral link, we record that the link was used, with your browser type and a scrambled (hashed) version of your IP address.
Email data, such as whether you opened The Reel and which links you tapped. When you sign up for The Reel on the website, we record which signup form you used, the website address that received it, and a scrambled (hashed) version of your IP address.
We do not collect your precise location: neither app asks for access to your device's location.
From your rankings and activity we work out a taste profile and recommendations, such as your For You feed and the titles and people we suggest. We treat these inferences as personal information.
Sign-in providers: Apple or Google, if you sign in with them.
Other users, for example when they add you to a shared list, mention you, or use Find Friends with your number in their contacts (we receive only a hash of it).
Advertising and measurement partners, such as Apple (Search Ads attribution), Google and Meta, which tell us which of our ads and campaigns led to an install or a visit.
Data providers. We do not buy information about you from data brokers today. We may in the future obtain demographic, interest or contact information about people in the United States from data providers, including data brokers, and combine it with what we hold about website visitors and newsletter subscribers. If we do, we will never combine it with information collected through our apps, and we will not resell it unless you were given explicit notice and the chance to opt out first, as the law requires.
Some of this information is collected with cookies, local storage, software development kits (SDKs) and similar technologies. Our Cookies Notice lists them.
Please do not share someone's contact details with us, or invite them, unless you have their permission.
provide, operate, maintain and improve the Service, including your account, profile, rankings, lists and social features such as follows, comments, reactions, shared lists and Find Friends;
personalize the Service, including your For You feed and recommendations;
send you sign-in codes, security alerts, notices about changes to our terms, and the notifications you turn on;
communicate with you about events, promotions or contests you take part in; and
provide support and respond to your requests and feedback.
We use personal information to understand how Shortlist is used and to improve it and develop new features. We use app performance data to find and fix slow screens, slow app starts and failing network requests. We do not use personal information to train large language models or other generative AI models.
We may also create aggregated or de-identified information (for example, which films our users rank highest) and use, publish, license or sell it. Information is de-identified when it cannot reasonably be used to identify or be linked to you. We keep it that way: we take reasonable measures to make sure it cannot be linked to a person, we commit not to try to re-identify it, and we require anyone we give it to by contract not to re-identify it either.
Email and push marketing. We send The Reel and other updates about Shortlist to people who sign up for them. You can unsubscribe at any time (Section 4).
Ad measurement. To learn which of our ads bring people to Shortlist, the apps use Meta's app events (app installs, app opens and sign-ups), Google Analytics for Firebase with Google's advertising features, Apple Search Ads attribution and Apple's SKAdNetwork, and on Android the Google advertising ID. On iPhone, your advertising identifier is used only if you tap "Allow" in Apple's tracking prompt. Outside Europe this is on by default and you can turn it off in the app (Section 4). In Europe it runs only with your consent (Section 12).
Advertising. Shortlist does not show ads today. We may in the future show ads, including ads based on your interests, and we may share personal information with advertising partners to do that, within the limits in Section 5 and subject to your choices.
comply with applicable laws, lawful requests and legal process;
review reports, moderate content and protect our, your or others' rights, privacy, safety or property;
audit our internal processes for compliance with legal and contractual requirements;
enforce the terms that govern the Service; and
prevent, identify, investigate and deter fraudulent, harmful, unauthorized or illegal activity.
In some cases we ask for your consent to collect, use or share your personal information, such as when the law requires it.
We keep personal information only as long as we reasonably need it for the purposes above:
Account, profile and content: for as long as you keep your account. When you delete your account in the app, we delete your account data and content, including your comments and reactions on other people's posts, right away, and any remaining copies in our systems within 30 days.
Contact hashes from Find Friends: up to 30 days.
Analytics data: up to 14 months.
App performance data: kept by Google, which deletes events tied to an IP address after 30 days and the rest of the performance data after 60 days.
Reports about content and the decisions we take on them: up to 12 months after we receive the report, unless we need them longer for a legal claim or a request from an authority.
Newsletter data: until you unsubscribe. After that we keep your email address on a suppression list so we do not email you again.
Privacy requests (including opt-outs) and our responses: 24 months, as the law requires.
Rankings and tier lists you make on the website stay in your own browser until you clear it.
We may keep information longer where the law requires it or to establish or defend legal claims. De-identified and aggregated information can be kept indefinitely.
We share personal information with the following parties, as described in this Privacy Policy or when we collect it:
Service providers that process it for us under contract and only on our instructions: Google (Firebase hosting, database, sign-in, cloud functions, file storage, push notifications, App Check, analytics and app performance monitoring), Apple (Sign in with Apple and push notifications), Resend (email delivery, including sign-in codes and The Reel), Hostinger (website hosting) and Discord (internal alerts that let our team see new sign-ups, new public posts and reports).
Advertising and measurement partners: Meta Platforms and Google receive identifiers (including advertising identifiers) and app activity (such as installs, app opens and sign-ups) from the apps to measure our advertising, and Apple receives what its Search Ads attribution and SKAdNetwork need. Under California law, giving this to Meta and Google may be "sharing" for cross-context behavioral advertising. You can opt out (Section 5).
The Movie Database (TMDB), which provides title information and images. The apps send it your searches, the titles you open and your country, and the apps and the website load images from it, so it receives your IP address. YouTube receives the same when you play a trailer.
Other users and the public: your display name, username, photo and bio, and the rankings, lists, reviews, comments and reactions you post. If your profile is private, your rankings and activity are shown in the app only to people you approve. Public profiles and lists can also be seen on shortlist.watch. Anything public can be seen, copied or stored by others, and we are not responsible for what they do with it.
Third parties you direct us to share with, for example when you share a list or a ranking to another app.
Professional advisors, such as lawyers, auditors, bankers and insurers, where needed for their services.
Authorities and others: law enforcement, government authorities and private parties, where we believe in good faith that it is necessary for the compliance and protection purposes in Section 2.
Business transferees: a buyer or other party in a merger, acquisition, financing, sale of assets or similar transaction, or during the negotiations for one.
Purchasers of personal information: we have not sold personal information in the past 12 months. We may sell some personal information collected through our website and newsletter in the future, as described and limited in Section 5.
When we share personal information with another company, we require it by contract to use it only for the purposes we shared it for and to protect it at least as well as this Privacy Policy does. When we sell or share personal information, the contract also requires the recipient to comply with US state privacy laws, including honoring opt-outs, and lets us stop and fix any use that breaks those terms.
Access or update your information in the app: edit your profile, make it private, or turn off "Discoverable by contacts" in Settings.
Analytics and ad measurement in the app. Turn off "Analytics and ad measurement" in Settings, Privacy choices, which also stops app performance data on iPhone. On iPhone you can also stop apps from asking to track you in your iPhone's Settings, Privacy & Security, Tracking, and on Android you can reset or delete your advertising ID in your device's settings.
Do Not Sell or Share. Opt out of the sale and sharing of your personal information at Do Not Sell or Share My Personal Information, with Global Privacy Control, or by email (Section 5).
Marketing emails. Use the unsubscribe link in any of our emails, turn off Email Updates in Settings, or contact us. You will still get messages about your account, such as sign-in codes.
Text messages. We text you only the codes you need to sign in, never marketing.
Push notifications. Turn them off in the app's Settings or your device's settings.
Cookies. See our Cookies Notice. The "Cookie settings" button at the bottom of every page on shortlist.watch lets you accept or reject analytics on the website.
Do Not Track. We do not respond to "Do Not Track" signals. We do honor Global Privacy Control as an opt-out of sale and sharing (Section 5). When you use the Service, Google (on our website and in our apps) and Meta (in our apps) may collect information about your online activities over time and across different websites and apps.
Delete your account in the app under Settings, Delete Account, or on our account deletion page.
Before we act on a request to access, correct or delete your personal information, we need to confirm it comes from you, usually with a code sent to the email address or phone number on your account. For requests about especially sensitive information we may ask for more, up to a signed declaration under penalty of perjury. We may deny a request we cannot verify to a reasonable degree of certainty. We never ask you to verify your identity to opt out of the sale or sharing of your personal information.
We respond within the time your state's law requires, and otherwise within 45 days of receiving your request, which we may extend by another 45 days where reasonably necessary. If we extend, we will tell you within the first 45 days. We act on opt-outs of sale and sharing within 15 business days.
Requests are free. If a request is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or decline it where the law allows, and we will tell you why. We are not required to answer more than two requests to know your personal information in a 12-month period.
We need some personal information to provide the Service (for example, a phone number or email address to create an account). If you do not provide it, we may not be able to provide that part of the Service.
This section applies to residents of the US states with consumer privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. We give the rights below, including the opt-out, to every US user who asks.
Know and access: what personal information we have about you, what we do with it, and a copy of it, in a portable format where the law provides.
Correct inaccurate personal information.
Delete personal information we have about you.
Opt out of the sale of your personal information, of its sharing for cross-context behavioral advertising, and of its use for targeted advertising.
Opt out of profiling that produces legal or similarly significant effects. We do not do this: our recommendations do not have such effects.
Learn the third parties to whom we have disclosed personal information, where your state's law gives you that right.
Limit the use of sensitive personal information. We use sensitive personal information (such as your account log-in) only to provide the Service, keep it secure and for the other purposes the law permits, and we do not use it to infer characteristics about you, so there is nothing further to limit.
Appeal our decision on any request.
Equal treatment: we will not deny you the Service, charge you a different price or give you a different level of service because you used any of these rights.
In the 12 months before the date at the top of this policy, we have not sold personal information. In that time the apps shared identifiers (advertising identifiers and app identifiers) and internet or other electronic network activity information (app events such as installs, app opens and sign-ups) with Meta Platforms and Google for the ad measurement described in Section 2, which may count as sharing for cross-context behavioral advertising.
We may sell the following personal information collected through our website and newsletter to data providers, marketing partners, advertising companies and other businesses that want to reach people interested in movies and TV: identifiers (your email address and online identifiers), internet or other electronic network activity information (how you use shortlist.watch and The Reel) and inferences about your interests drawn from them. We may also share personal information with advertising partners for cross-context behavioral advertising, as described in Section 2.
Whatever we do, we will never:
sell personal information collected through the Shortlist apps for iPhone or Android. The Google Play User Data policy prohibits selling personal and sensitive user data collected through an app, and the App Store Review Guidelines allow data collected through an app to be shared with third parties only to improve the app or serve advertising. We share app data only for ad measurement and advertising, as described above, and on iPhone we track you across other companies' apps and websites only if you allow it in Apple's prompt;
sell or share personal information of anyone who has opted out, including with Global Privacy Control, or of anyone we know is under 18 (Section 9);
sell or share sensitive personal information (such as your account log-in), your birthday, your contacts data, or precise location (which we do not collect);
sell, rent or otherwise transfer the email address of anyone who has unsubscribed from our emails;
sell personal information we collected before October 25, 2026, the day we first posted our Do Not Sell or Share notice, unless you consent;
disclose information that identifies you together with the specific videos you watched on Shortlist, such as trailers, without your separate written consent;
sell or share personal information of people in Europe (Section 12).
We have no buyer today. Before we sell personal information to anyone, we will name each buyer in this section, as Rhode Island law requires, and update the date at the top of this policy.
Use the form on our Do Not Sell or Share My Personal Information page. You do not need an account, and we will not ask you to verify your identity. Adding the email address or phone number you use with Shortlist lets us apply it to your account and newsletter subscription.
Turn on Global Privacy Control (GPC) in your browser. We treat a GPC signal as a valid request to opt out of sale and sharing (and of targeted advertising), with nothing else to do. It applies to that browser at once. If we know who you are on that browser, because you sign up for our newsletter there or send our opt-out form from it, it also applies to you: to your newsletter subscription, and to any later sale of your information, online or offline. Our apps cannot read a browser's signal, so to cover your app account, use the form with the email address or phone number on your account, or the app setting below. Our Do Not Sell or Share page shows whether we received the signal from your browser.
In the app, turn off "Analytics and ad measurement" in Settings, Privacy choices, which stops the sharing described above on that device.
Email admin@blrbdigital.com with the subject "Do Not Sell or Share".
We act on an opt-out within 15 business days. If we sold or shared your personal information after you asked us to stop and before we acted on your request, we tell the companies that received it and direct them to stop too. We will not ask you to opt back in for at least 12 months.
Email admin@blrbdigital.com, or use our Do Not Sell or Share My Personal Information page for opt-outs. We verify requests other than opt-outs as described in Section 4 and respond within the times stated there.
Authorized agents. You may use an authorized agent to make a request for you. We may ask the agent for your signed permission, and for requests other than opt-outs, ask you to verify your identity with us directly.
If we decline to act on your request, you may appeal by emailing admin@blrbdigital.com with the subject "Privacy appeal" within 30 days of our response. We will answer within the time your state's law requires (generally 45 to 60 days). If we deny your appeal, you may contact your state's attorney general, and we will tell you how when we answer.
This part adds what the California Consumer Privacy Act requires. In the past 12 months we collected the following categories of personal information:
Identifiers: name, username, phone number, email address, IP address, app and device identifiers, advertising identifiers. Disclosed to our service providers. Shared with advertising partners (Meta and Google): advertising and app identifiers. Not sold.
Customer records (Cal. Civ. Code 1798.80(e)): name, phone number, email address. Disclosed to our service providers. Not sold or shared.
Protected classification characteristics: your age, from your birthday. Disclosed to our service providers. Not sold or shared.
Internet or other electronic network activity: how you use the apps and the website, searches, email opens and clicks. Disclosed to our service providers. Shared with advertising partners (Meta and Google): app events. Not sold.
Approximate location: country from your app store, SIM or device settings, and an approximate location from your IP address. Disclosed to our service providers. Not sold or shared.
Audio, electronic or visual information: profile and list photos you upload. Disclosed to our service providers and shown as you choose. Not sold or shared.
Inferences: your taste profile and recommendations. Disclosed to our service providers. Not sold or shared.
Sensitive personal information: your account log-in (email address or phone number with your password or sign-in code), and hashed phone numbers of your contacts if you use Find Friends. Disclosed to our service providers. Not sold or shared.
We collect these categories from the sources, for the purposes, and keep them for the periods described in Sections 1 and 2. We disclose them for business purposes to the categories of recipients in Section 3. We do not offer financial incentives for personal information.
Consumers under 16. We do not sell the personal information of consumers we know are under 16. Outside Europe, the apps' ad measurement, which may count as sharing, currently also runs for users aged 13 to 15 unless it is turned off. We are changing the apps so that it is off for anyone we know is under 18 (Section 9).
California Civil Code Section 1798.83 lets California residents ask about our disclosure of personal information to third parties for their own direct marketing purposes. We have not made such disclosures. To ask, email admin@blrbdigital.com.
The Service may link to websites, apps and other services run by others, such as streaming services and TMDB. We do not control them and are not responsible for what they do. Please read their privacy policies.
We use technical, organizational and physical safeguards designed to protect personal information. No security is perfect, and we cannot guarantee the security of your personal information.
We are based in the United States, and our service providers process data mainly in the United States. Your personal information may be transferred to and processed in places whose privacy laws are less protective than where you live. Users in Europe should read Section 12.
Shortlist is not for children under 13. The apps ask for your birthday when you sign up and do not let anyone continue with a birthday under 13. We do not knowingly collect personal information from children under 13, and we never sell or share it. If you are a parent or guardian and believe your child under 13 has given us personal information, contact us at admin@blrbdigital.com and we will delete it.
We do not sell the personal information of anyone we know is under 18. In Europe, the apps never use analytics or ad measurement for anyone under 18. Outside Europe, the apps' ad measurement (Section 2) currently runs for users aged 13 to 17 as it does for adults unless it is turned off in Settings, Privacy choices. We are changing the apps so that it is off for anyone we know is under 18. A teen, or a parent, can turn it off now, or use our Do Not Sell or Share page.
We review this Privacy Policy at least once a year and may change it. We will post the new version here and update the date at the top. If we make a material change, such as starting to sell a category of personal information, we will tell you in the app or by email before it takes effect, and where the law requires your consent for a new use, we will ask for it.
PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE A LAWSUIT IN COURT AND YOUR RIGHT TO A JURY TRIAL.
Nothing in this section waives or limits a right you have under a state privacy law that cannot be waived by agreement (for example, California Civil Code Section 1798.192), or your right to complain to a government authority.
Before starting any legal proceeding, you agree to contact us at admin@blrbdigital.com and describe the dispute in reasonable detail. We will try to resolve it informally within 30 days. If we cannot, either party may proceed to arbitration as described below.
Except as set forth below, all disputes, claims, or controversies arising out of or relating to this Privacy Policy, the Service, or your personal information (collectively, "Disputes") shall be resolved by binding arbitration administered by JAMS (jamsadr.com) under its Streamlined Arbitration Rules and Procedures, as modified by this section. The arbitrator shall have exclusive authority to resolve all Disputes, including any claim that all or any part of this arbitration agreement is void or voidable. The arbitration shall be conducted in English, in Delaware, unless the parties agree otherwise. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. The Federal Arbitration Act governs the interpretation and enforcement of this section.
YOU AND SHORTLIST EACH AGREE THAT ANY DISPUTE RESOLUTION PROCEEDINGS WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. If for any reason a Dispute proceeds in court rather than through arbitration, you and Shortlist each waive any right to a jury trial and agree that such proceedings shall be brought exclusively in the state or federal courts located in Delaware, and you consent to personal jurisdiction in those courts.
Either party may bring an individual action in small claims court, and either party may seek injunctive or other equitable relief in court to protect intellectual property rights or to prevent immediate, irreparable harm.
You may opt out of this arbitration agreement by notifying us in writing within 30 days of first using the Service. Opting out of arbitration does not affect any other part of this Privacy Policy.
To the extent the law allows, any Dispute must be filed within one (1) year after the date on which the party asserting the claim first knew or reasonably should have known of the act, omission, or default giving rise to the claim.
This Privacy Policy and any Disputes are governed by the laws of the State of Delaware, without regard to its conflict-of-law provisions, except that the Federal Arbitration Act governs the arbitration agreement, and except that the privacy law of the state where you live applies to your rights under it.
This section applies to you if you live in the European Economic Area (EEA), the United Kingdom, Switzerland, or another European country where we offer the Service (Albania, Bosnia and Herzegovina, Kosovo, Moldova, Montenegro, North Macedonia, Serbia and Ukraine). In this section these places are called "Europe." Where this section conflicts with any other part of this Privacy Policy, this section controls for users in Europe.
The controller of your personal information is BLRB Digital LLC, 377 Main St, West Haven, Connecticut 06516-4311, United States. You can reach us at admin@blrbdigital.com.
If you are in Europe, we do not sell your personal information, rent or license it to data brokers, data marketplaces or data aggregators, buy information about you from data brokers, share it for cross-context behavioral advertising, or build consumer profiles about you to sell or share. The parts of this Privacy Policy that describe those activities, including the future sales described in Section 5, do not apply to you. We rely only on the legal bases listed below.
The Shortlist app does not access your device's location. We do not send you marketing text messages; we text you only the codes you need to sign in.
To provide the Service (your account, profile, rankings, lists, reviews, comments, reactions, follows, recommendations and the notifications you turn on): performance of our contract with you.
Recommendations and personalization (your For You feed, taste profile, title and people suggestions, built from your rankings and activity): performance of our contract with you. These features do not produce legal or similarly significant effects on you.
Find Friends: if you choose to look for friends from your contacts, the app sends us scrambled (hashed) versions of the phone numbers in your address book, never names or the numbers themselves. We match them against users who have chosen to be discoverable, and we keep the hashes for up to 30 days so we can tell you when a contact joins. Our legal basis is our legitimate interest, and yours, in helping you find people you already know. Whether others can find you this way is controlled by "Discoverable by contacts" in Settings.
Analytics and ad measurement: only if you tap "Allow" when the app asks, we use Google Analytics for Firebase to understand which features people use, Firebase Performance Monitoring to measure how fast the app starts, how its screens draw and how long its network requests take, and Meta's app events (and, if you also allow tracking in Apple's prompt, your device's advertising identifier) to measure which of our ads brought people to Shortlist. Legal basis: your consent. You can withdraw it at any time in the app under Settings, Privacy choices, which stops this collection right away. On shortlist.watch, analytics cookies are used only if you accept them in the cookie banner, and you can change your choice with the "Cookie settings" button at the bottom of every page on shortlist.watch. If you are under 18, we do not ask for this consent and do not use analytics or ad measurement for you in the app.
Newsletter and marketing emails (such as The Reel): your consent, which you can withdraw with the unsubscribe link in every email or in Settings.
Safety, moderation and security (reviewing reports, removing illegal or rule-breaking content, preventing fraud and abuse, protecting accounts): our legitimate interests in keeping the Service and its users safe, and our legal obligations, including under the EU Digital Services Act and the UK Online Safety Act.
Service messages (sign-in codes, security alerts, changes to our terms): performance of our contract and our legitimate interests.
Legal compliance (responding to lawful requests, keeping records the law requires, establishing or defending legal claims): our legal obligations and legitimate interests.
Where we rely on legitimate interests, you can object, as explained below. Providing your phone number or email address is needed to create an account; everything else is optional.
Other users and the public: your display name, username, photo, bio, and the rankings, lists, reviews, comments and reactions you post, as described in Section 3. If your profile is private, your rankings and activity are shown in the app only to people you approve. Your email address, phone number, birthday and device details are never shown to other users.
Service providers that process data for us under contract: Google (Firebase hosting, database, sign-in, cloud functions, file storage, push notifications and, with consent, analytics and app performance monitoring), Apple (Sign in with Apple, push notifications and, with consent, Apple Search Ads attribution), Meta Platforms (with consent, ad measurement), Resend (email delivery), Hostinger (website hosting), and Discord (internal alerts that let our team review reports and new public posts). When you browse titles, the app loads title information and images from The Movie Database (TMDB), which receives your device's IP address.
Authorities and others, where the law requires it or to protect people from harm, and a buyer of our business, as described in Section 3.
We are based in the United States and our service providers process data mainly in the United States. When personal information from Europe is transferred to a service provider outside Europe, we rely on the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. Data Privacy Framework) where that provider is certified, or on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments, built into that provider's data processing terms. You can ask us for a copy of the relevant safeguards.
Account, profile and content: for as long as you keep your account. When you delete your account in the app, we delete your account data and your content, including your comments and reactions on other people's posts, right away, and any remaining copies in our systems within 30 days.
Contact hashes from Find Friends: up to 30 days.
Analytics data: up to 14 months.
App performance data: Google deletes events tied to an IP address after 30 days and the rest after 60 days.
Reports about content and the decisions we take on them: up to 12 months after we receive the report, unless we need them longer for a legal claim or a request from an authority.
If you unsubscribe from emails, we keep your email address on a suppression list so we do not email you again.
You have the right to access your personal information, to correct it, to have it deleted, to restrict how we use it, to receive the data you gave us in a portable format, to object to our use of it based on legitimate interests, and to withdraw any consent you gave at any time (this does not affect what we did before you withdrew it). Many of these you can do yourself in the app: edit your profile, change Privacy choices and "Discoverable by contacts" in Settings, make your profile private, or delete your account. For anything else, email admin@blrbdigital.com. We will respond within one month, which we may extend by two more months for complex requests, and we will tell you if we do. Requests are free. We will ask only for the information we need to confirm the request comes from you, such as a code sent to the email address or phone number on your account. The paragraphs in Section 4 about signed declarations, fees for repeat requests, and the 45-day response time do not apply to you.
You also have the right to complain to a data protection authority, in particular in the country where you live or work, or where you think your rights were infringed: in the EEA, your national data protection authority (listed at edpb.europa.eu); in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch); in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; and in the other countries listed above, the national data protection authority. We would appreciate the chance to sort out your concern first, so please contact us.
You must be at least 13 years old to use Shortlist. If you are under 18 and in Europe, your profile starts private, you are not discoverable by contacts unless you turn it on, and the app does not use analytics or ad measurement for you.
We will tell you about material changes to this Privacy Policy in the app or by email before they take effect. Section 11 (binding arbitration, class action waiver, jury waiver, the one-year time limit, and Delaware law and courts) does not apply to users in Europe to the extent it would take away protections you have under the laws of the country where you live. You may bring a claim in the courts of your country of residence.
Email: admin@blrbdigital.com
Mail: BLRB Digital LLC, 377 Main St, West Haven, Connecticut 06516-4311, United States
Website: shortlist.watch