Privacy Policy - What2Watch

Overview

What2Watch is an MCP (Model Context Protocol) server that provides movie, TV show, and streaming recommendations to AI assistants like ChatGPT and Claude. We are committed to protecting your privacy and being transparent about our data practices.

Privacy by Design

We do NOT store your email address. We only store a cryptographic hash of your email, making it impossible for us to know or recover your actual email. This is a deliberate design choice to protect your privacy.

This means we cannot link your search history or preferences to you as a person. All data is tied only to an anonymous hash - we have no way of knowing who you are, contacting you, or identifying you in any way.

Data We Collect

Data Type	What We Store	Purpose
Email Hash	SHA-256 hash only No PII	Account identification
Search History	Tool calls & responses	Personalization, analytics
Preferences	Liked/disliked content, platforms	Better recommendations
Region	Country code (e.g., "US")	Content availability

Data We Do NOT Collect

Your actual email address (only the hash)
Payment or credit card information
Precise location or GPS data
Device identifiers or fingerprints
Browsing history outside of What2Watch
Contacts, photos, or other personal files

How We Use Your Data

Personalization: Your search history and preferences help us provide better recommendations tailored to your taste.
Service Improvement: Aggregated, anonymized data helps us understand usage patterns and improve our tools.
Content Availability: Your region setting ensures we show you content available in your area.
Analytics: We track tool usage to identify popular features and fix issues.

We never sell your data. We do not share your personal information with advertisers, data brokers, or any third parties for marketing purposes.

Data Retention

We retain your data for as long as your account is active or as needed to provide our services:

Search History: Retained for up to 12 months for personalization
Account Data: Retained until you request deletion
Magic Link Tokens: Automatically deleted after 15 minutes or upon use
Session Tokens: Expire after 24 hours (access) or 365 days (refresh)

Your Rights & Controls

Delete Everything, Anytime

You can delete ALL your data at any time, no questions asked. Simply ask your AI assistant: "Delete all my What2Watch data" or email us. We will immediately and permanently remove all data associated with your anonymous hash.

You have the following rights regarding your data:

Access: Request a copy of the data we have about you
Deletion: Request deletion of your account and all associated data - instant and permanent
Correction: Update your preferences at any time through the AI assistant
Portability: Request your data in a machine-readable format

To exercise any of these rights, just ask your AI assistant or contact us at privacy@what2watch.live

Security

We take security seriously and implement the following measures:

Encryption: All data transmitted over HTTPS/TLS
Hashing: Emails are SHA-256 hashed before storage
Access Control: Database access is restricted and monitored
Rate Limiting: Protection against abuse and brute-force attacks
No Password Storage: We use magic links, so there are no passwords to steal

Third-Party Services

What2Watch integrates with the following services:

MongoDB Atlas: Database hosting (data stored securely in cloud)
SendGrid: Email delivery for magic links (your email is passed only for delivery, not stored by us)
Railway: Application hosting

Each of these services has their own privacy policies governing their handling of data.

GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing

Consent: You provide consent when you authenticate and use our service
Legitimate Interest: We process data to provide and improve our recommendation service
Contract: Processing is necessary to provide the service you requested

Your GDPR Rights

Right to Access: Obtain a copy of your personal data
Right to Rectification: Correct inaccurate personal data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restriction: Limit how we use your data
Right to Data Portability: Receive your data in a machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time

International Data Transfers

Your data may be processed in the United States. We ensure appropriate safeguards are in place for any international transfers, including standard contractual clauses where required.

Supervisory Authority

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

US Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: Request information about the categories and specific pieces of personal information we collect
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the sale or sharing of personal information
Right to Non-Discrimination: Not be discriminated against for exercising your rights

We do NOT sell your personal information. We have not sold personal information in the preceding 12 months and have no intention of doing so.

Virginia, Colorado, Connecticut, and Other State Residents

Residents of states with comprehensive privacy laws (VCDPA, CPA, CTDPA, etc.) have similar rights to access, delete, correct, and opt-out. Contact us to exercise these rights.

Children's Privacy

What2Watch is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.

Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes by updating the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

Email: privacy@what2watch.live
General inquiries: contact@what2watch.live