What we store, and how to delete it.
What we store
When you build a list: the movies you picked, the birth year and state you enter (used only to power the site's filters), an optional display name, and a short label for how you got here — whether you came straight to the site, followed someone's published list, or clicked a link we posted somewhere.
If you choose to add an email so you can edit your list from another device: the email address itself, whether you've verified it by clicking a link we sent, and whether you opted in to occasional email from us — a separate, unchecked-by-default choice.
Why
Your picks power the community board. Birth year and state exist only so the board's filters work — we don't use them for anything else. Email exists so a lost browser or a new phone doesn't mean a lost list. That label about how you got here is attached when you start building and stays with your list once you publish, so we can count which routes actually bring people in. We don't store the page you came from, it's never tied to your email, and it has no effect on whether we email you.
How to delete it
Your list stays private to you until you publish it, and your edit link is the only way anyone can change it. If you've added an email, you can remove it at any time from the confirmation page you saw after publishing — look for "Remove my email" under the email backup section. Removing it deletes the address and any pending magic links immediately.
To remove your list entirely, or if you can't find your edit link, reply to any email we've sent you and we'll take care of it.
Personalized poster orders
Draft policy version: poster-privacy-2026-09-draft. Checkout remains disabled until this version is approved.
A poster order is separate from your public list and recovery email. We keep the locked design and list snapshot, proof and print hashes, transaction email, encrypted shipping address, provider identifiers, policy versions, and financial evidence needed to print, support, refund, dispute, and reconcile that order. We do not reuse a recovery email or marketing choice for Checkout.
The proposed launch boundary deletes unpaid private poster objects seven days after Checkout expiry and purges paid custom text, images, email, and address 180 days after the latest shipment, refund, dispute, reshipment, or support closure. PII-free financial and audit records are proposed for seven years. These periods are drafts until the launch policy is approved.