Tenfold is a movie-rating app made by one person. This policy says exactly
what the app collects, where it goes, and what I can and cannot see. It is
written to be read rather than to protect me.
What the app collects
Your email address. You give it when you create an
account. It is how you sign in and the only way to reset a password.
If you continue with Apple. Apple tells Tenfold your
email address, or a private relay address that forwards to you if you
choose Hide My Email, and, the first time only, your name if you share
it. Apple also gives the app a sign-in token. I keep it for one reason:
so deleting your account also cancels your Apple sign-in. Nobody can
read it, and it is deleted with your account.
Your first and last name — optional. Asked once, after
signup, and you can skip it or delete it later. It is shown next to your
username when somebody searches for you and under your username on your
profile, so people can tell you apart.
Your bio — optional. One line about yourself, up to 80
characters, written in Edit profile. Anyone who can see your profile can
read it. Leave it empty and there is nothing to show.
Your library. The movies you rate, all ten scores for
each, the dates, your watchlist, and any lists you generate. This is
the thing the app exists to keep, and it is stored so that it survives
losing any one device.
Movies you import, only if you import some. If you
bring your movies over from Letterboxd, IMDb, another app or a
spreadsheet, the file you choose is read on your phone and is never
uploaded. What comes out of it is saved
like the rest of your library: the movies, your ratings as scores, the
dates you watched them, and, if you leave them ticked, your reviews as
notes (encrypted, like every note) and your watchlist. Each imported
movie also keeps when it was imported and whether you have changed it
since, so Undo takes back only what you haven't touched. Your phone
remembers each import for 30 days, for Undo, and forgets it when you
sign out.
Your notes — encrypted. See below.
An account identifier. A random id created with your
account. Every row you save carries it, which is how the server knows
your library is yours and refuses to hand it to anyone else. It is not
derived from anything about you and it is never shown to another
person.
Your username. Everyone picks one. It is how friends
find you, so it is public: anybody typing the first letters of it can
see it, your photo, your name and your bio, and send you a friend
request. Nobody can browse a list of usernames, and nothing is returned
until at least two letters are typed.
Your profile photo, optional. Before it is uploaded,
the app rebuilds the picture from its pixels, so the location, camera
and date it was taken are removed. It is shown wherever your username
is.
Your friends. Friend requests, who you are friends
with, who you have blocked, and the invite links you make, including
who joined through one.
People you may know. If you let Tenfold see your
contacts, your phone turns each email address in them into a one-way
code and sends only those codes, to check them against Tenfold
accounts. Nothing from your contacts is kept: not the codes, not the
names, not how many there are. The names your contacts are saved under
never leave your phone. What is kept is when you last checked, for a
daily limit, the people you have hidden with ✕, and your "Suggest me to
people I may know" switch. People who have your email in their contacts,
or friends in common with you, can see you suggested; turning that
switch off in Settings stops it. Deleting your account deletes all of
it.
Posts, captions and comments. When you rate a new
movie it is posted to your friends' Feed with the caption you write. A
rating made in a watch party is only posted if you choose to post it
after the reveal. If you leave "Tell your friends" on when you import
movies, one post goes on your friends' Feed saying how many you
imported, from where, and your top three; Undo takes it down. Comments
you leave on a friend's post are saved with your username.
Links to a rating. When you share a movie's card, it
carries a link to that one rating. What is kept is the link, which
movie it is for, and the card's colour. Deleting the movie ends the
link.
What you follow, only if you follow something. The
actors, directors, franchises, genres and studios you follow, so a
notification can tell you when one of their movies opens in cinemas
where you are, and a record of each one sent, so the same movie never
tells you twice. Nobody else sees what you follow.
Watch parties. The parties you host or join, the party
code, who is in each one, the scores you send to a party, and which
friends were invited to it and by whom.
Shared lists. The lists you make with friends or are
added to: each list's name and who typed it, who is in it, and the
movies on it with who added each one.
Votes on a Blend. When someone in a Blend taps
"We can't decide": who started it, the movies in the vote, whether
each person has answered, and each person's top four. Your top four
is kept only until everyone is in; then it is deleted and only the
totals are kept.
Tiebreaks. The Tiebreaks you start or are invited to:
who is in each one, the movies each person put on the wheel, and which
movie the spin picked. A Tiebreak closes a day after it is made and is
deleted the day after that.
Mentions. When you put @ and a friend's username in a
caption or a comment: who mentioned whom, and in which post or comment.
Only friends who can see that post can be mentioned. Deleting the
comment, or the movie it was posted with, deletes the mention.
Notifications, only if you allow them. A token from
Apple for each phone you sign in on, which is the address a notification
is sent to, and your notification switches in Settings. When something
happens that you would be told about, a short record waits until it is
sent: what kind of notice it is, who it is from, and which post, list or
watch party it is about — for a watch party, with the movie's title.
The words appear on your lock screen. A record is deleted 30 days after it is sent, or a week
after it could not be delivered. Signing out forgets that phone's
token. While you are in a watch party, a second token from Apple for
that party's card on your Lock Screen, so the card stays current with
the app closed; it is deleted when you leave, when the party ends, or a
day after the card was last updated.
Your country and time zone. Sent with your phone's
notification token, so a streaming alert names the services in your
country and arrives in the daytime where you are. If you turn on
"Coming to streaming", Tenfold also keeps which of your lists to watch
and a record of each alert sent, so the same movie never alerts you
twice. Your phone also sends your country when it asks for Trending
this week; Tenfold keeps only which countries have been asked for, not
who asked. Deleting your account deletes all of it.
Your notification center. The list behind the bell on
Home: a friend request, a request accepted, a new friend through your
invite link, a comment or a reply, a mention, being added to a shared list, or
something of yours removed after a report — who did it, and which post
or list it was about. It stores no words: the comment and the list's
name are looked up when you open it, so a comment that is deleted
disappears from it too. It also keeps when you last opened it, which is
how it knows what is new and what number to put on the app icon. Every
entry is deleted after 90 days. It fills whether or not you allow
notifications.
Reports about other people, only if you send one. If
you report a username, name, photo, bio, caption, comment or shared list
name, I keep what you reported and the reason you picked.
Bug reports and ideas, only if you send one. If you
tap the bug button, or "Report a bug or suggest something" in Settings,
the app sends what you typed plus the app version, your operating
system version, your device model, and which screen you were on. It
never attaches your movies, ratings or notes.
How the app is used, counted by Google Analytics. The
app uses Google Analytics for Firebase to count how Tenfold is used:
when the app is opened, how long it stays open, the app version, your
iPhone model and iOS version, and roughly where you are (such as the
city, region and country), which Google works out from your
connection. It also counts which screens you open, by the screen's
name (such as Home or Search), and a few things you do: signing up or
signing in (and whether with Apple or email), finishing the first
steps of a new account, tapping Share (and what kind of thing it was,
such as a movie's card or an invite), finishing an import (and
which app it came from), putting a finished Drop side by side
with your own order, opening a shared rating's link (and
whether it was a friend's, your own, or no longer there), opening the
list of friends who rated a movie (and whether from its page or a
friend's pick), following or unfollowing something (and what kind of
thing it is, never which),
switching the Top 10 page to another country (and which one), and
the app asking for an App Store rating. Each install
gets a random number of its own so visits can be counted. It is not
your account, your email or your phone's advertising identifier, and
Tenfold never gives Google any of those. It never sends a movie, a
rating, a note, a list, a post, a comment or anyone's name.
That is the complete list. There is no advertising and no tracking of any
kind. Google Analytics, above, is the only third-party SDK in the app that
collects anything, and it is set up to collect as little as it can: no
advertising identifier and no ad personalization.
Your notes are encrypted on your device before they are sent, and
I cannot read them. The key is generated on your device and shared
between your own devices through your Apple iCloud Keychain. It is never
sent to my server. What I store is unreadable text.
The honest consequence: if you lose access to every device that holds the
key, your notes cannot be recovered by anyone, including me. That
is what end-to-end encryption actually means, and it is the trade the
feature makes on purpose.
In rare conditions — signing in on a brand-new device before iCloud
Keychain has delivered your key — a note you write is kept on that device
in ordinary text and is deliberately not sent anywhere until it can
be encrypted first.
Who can see what
Your friends see your library: the movies you rated,
the ten scores and your overall score for each, your captions, and when
you rated or posted. They see your username and photo, and the comments
on your posts. They never see your notes or your email. Unfriending or
blocking someone takes all of this away from them at once.
Your friends, compared with you. A friend's profile
shows how much the two of you agree and the movies you are furthest
apart on, and your own profile shows which friends rate most like you.
These are worked out from the scores your friends can already see, and
nothing new is shared to make them. A movie you scored highly can be
suggested to your friends in Discover, the same way.
People in a shared list with you see your username and
photo, the list's name, every movie on it and who added each one. Leave
a list, or be taken out of it, and you stop seeing it. The movies you
added stay on it.
People in a Blend's vote with you see whether you
have answered. Nobody ever sees your top four — only everyone's
totals, once everyone is in.
People in a watch party with you see your username and
photo. Everyone's scores stay sealed until the host reveals them. After
that, everyone in the party sees each person's scores for that movie.
While a party you are in has not been revealed, that movie is hidden
from your friends.
Anyone else sees your username, your photo, your name
if you gave one, and your bio if you wrote one. Typing the first letters
of a username or a name is enough to find you — it no longer has to be
the whole username. That is all they see. Not a movie, not a score, not
a caption, and nothing at all about your library, unless you accept
their friend request or send them a rating's link. Somebody you have
blocked cannot find you, and neither can somebody who has blocked
you.
Anyone with a rating's link you shared, including
people without Tenfold, sees that one rating: your username and photo,
the movie, your score, the ten scores and your caption. Never your
notes, when you watched it, or anything else in your library. Deleting
the movie ends the link, and somebody you have blocked, or who has
blocked you, cannot open it in the app.
Everybody, but only as a number. Your score for a movie
is counted into the two averages on that movie's page: what your friends
gave it, and what everyone on Tenfold gave it. Those are an average and
a count and nothing else — they never say who rated a movie or what any
one person gave it, and the everyone number only appears once somebody
outside your friends has rated it. Your notes are never part of it.
Me. I read reports people send about usernames, photos,
names, bios, captions, comments and shared list names, and I can remove
the ones that break the rules.
I read the bug reports and ideas you send.
Where it goes
Supabase hosts the database and the accounts. They are
a service provider storing the data on my behalf; they do not use it for
anything of their own. Row-level security means each account can only
ever read its own rows — this is enforced by the database, not by the
app being polite.
TMDB (themoviedb.org) receives movie titles when you
search for a movie or look for a poster, so it can answer, and, when
you import, each movie's title and year, or its IMDb or TMDB number, so
it can find the movie. It receives
nothing about you — no account, no email, no identifier. Posters are
cached on your device and are never sent anywhere.
Apple iCloud Keychain carries your notes encryption key
between your own devices. This is Apple's infrastructure and I have no
access to it.
Apple Push Notification service receives each
notification to deliver it to your phone: the phone's token, the
words on the notification, such as "marco added you to a shared list",
and the number for the app icon. A notification never names a movie or
a list.
Discord receives a copy of each bug report and idea you
send, posted to a private channel only I read, so I see it right away.
The copy has what you wrote, your username, and the app and device
details listed above. It never has your email.
Discord also receives each report about someone, in a
second private channel only I read, so I can deal with it quickly. The
copy says what kind of thing was reported and why, the username of the
account reported, and for a caption, comment, username, name, bio or
shared list name, the words that were reported. It never says who sent the report, and it never
includes a photo or anyone's email.
Google receives the usage counts described above
(Google Analytics for Firebase), so I can see how many people use
Tenfold and how. They are not tied to your account, and the app tells
Google not to use them for advertising. Google keeps the detailed
records for the time set in Google Analytics (two months unless I
change it) and only totals after that.
Nobody else receives anything. Your data is never sold, never shared for
advertising, and never used to train anything.
What the app does on your device alone
Movie suggestions are generated by Apple's on-device model. The prompt and
your taste never leave the device. Poster colours, search and every screen are
computed locally.
Deleting everything
Settings → Account → Delete my account. It removes your
account, every movie, rating, date and note, from the device and from the
server, including records already deleted but not yet purged. It is
immediate, permanent, and not recoverable — by you or by me.
It also removes your username and photo, your friends, requests and
blocks, your invite links, the links to your ratings, what you follow, your posts and every comment you wrote, and your
place and scores in every watch party. There are three things to know:
A watch party you hosted is handed to the person who has been in it
longest, so their record of that night stays. If you were the only one
in it, it is deleted.
A shared list you made is handed to the person who has been in it
longest. If you were the only one in it, it is deleted. You are taken
out of every other list, a list name you typed is cleared, and movies
you added stay on other people's lists without your name. Your part in
any vote on a Blend is deleted, and so are the votes you started. Your phones'
tokens, your notification switches and any notice waiting for you are
deleted, and so is your notification center, along with every entry in
anyone else's that came from you.
A report you sent about someone else is kept without your name, so
harmful content can still be dealt with. Reports about you are deleted
with your account.
A copy of a bug report or idea already posted to Discord stays there
until you ask me to delete it. So does a copy of a report about your
account.
Google Analytics' counts are not tied to your account, so there is
nothing of yours there to find. Google deletes the detailed records
after the time set in Google Analytics and keeps only totals.
Watch parties that were never revealed are deleted automatically after 30
days.
If you want a copy of your movies and ratings first, ask me through
Support and I will send it to you. Your notes can't be in it: they are
encrypted on your phone and I cannot read them.
Children
Tenfold is not directed at children and I do not knowingly collect data
from anyone under 13. If you believe a child has created an account, contact
me and I will delete it.
Changes
If this policy changes, the date at the top changes with it. Anything that
materially affects what is collected will also be said inside the app.