Privacy Policy

Last updated: 4 May 2025

This policy explains what personal data Nitpickr collects, how it is used, and your rights under UK GDPR and the Data Protection Act 2018. Please read it carefully. By using Nitpickr you agree to the practices described here.

1. Who We Are

Nitpickr is operated as a personal project. For data protection enquiries, contact us at [email protected].

2. Data We Collect

Account data. When you register, we collect your username, email address, and a hashed password. You may optionally provide a first name, last name, and profile photo.

Content you post. Nitpicks, replies, and votes you submit are stored in our database and associated with your account.

Technical data. We log your IP address for rate-limiting and security purposes. Your browser may send standard request headers (user-agent, referrer) which our web server logs temporarily.

Cookies and analytics. We use a session cookie to keep you signed in. With your consent, we load Google Analytics (GA4) to understand how visitors use the site. GA4 sets its own cookies and sends anonymised usage data to Google. You can withdraw analytics consent at any time via the cookie banner.

3. How We Use Your Data

To operate your account and display your public profile and contributions.
To send a one-time email verification when you register.
To enforce rate limits and protect against abuse.
To analyse aggregate site usage through Google Analytics (only if you consent).
To moderate content and enforce our Terms & Conditions.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

Contract: processing your account data and posted content is necessary to provide the service you signed up for.
Legitimate interests: security logging and rate-limiting protect the site and its users.
Consent: analytics cookies are only set if you click "Accept cookies".

5. Data Retention

Account data is retained for as long as your account is active. Deleted nitpicks and replies are soft-deleted (body replaced with a removal notice) and may be permanently removed after a reasonable period. Server access logs are retained for up to 30 days. You can request deletion of your account and associated data by contacting us.

6. Third-Party Services

Google Analytics: usage data is sent to Google's servers if you consent. See Google's Privacy Policy.
TMDB: movie posters and metadata are fetched from The Movie Database. We do not send any of your personal data to TMDB.

7. Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure ("right to be forgotten").
Restrict or object to processing.
Withdraw consent for analytics at any time via the cookie banner.
Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, email [email protected].

8. Security

Passwords are stored as bcrypt hashes and are never readable by staff. All connections use HTTPS. We take reasonable technical and organisational measures to protect your data, though no system is completely secure.

9. Children

Nitpickr is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has registered, please contact us and we will delete the account promptly.

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of Nitpickr after changes constitutes acceptance of the revised policy.

Questions? Email [email protected].