Tenfold is a movie-rating app made by one person. This policy says exactly
what the app collects, where it goes, and what I can and cannot see. It is
written to be read rather than to protect me.
What the app collects
Your email address. You give it when you create an
account. It is how you sign in and the only way to reset a password.
Your first and last name — optional. Asked once, after
signup, and you can skip it or delete it later. It is only ever shown
back to you.
Your library. The movies you rate, all ten scores for
each, the dates, your watchlist, and any lists you generate. This is
the thing the app exists to keep, and it is stored so that it survives
losing any one device.
Your notes — encrypted. See below.
An account identifier. A random id created with your
account. Every row you save carries it, which is how the server knows
your library is yours and refuses to hand it to anyone else. It is not
derived from anything about you and it is never shown to another
person.
Your username. Everyone picks one. It is how friends
find you, so it is public: anyone who types your exact username can see
it, your photo, and send you a friend request. Nobody can browse a list
of usernames.
Your profile photo, optional. Before it is uploaded,
the app rebuilds the picture from its pixels, so the location, camera
and date it was taken are removed. It is shown wherever your username
is.
Your friends. Friend requests, who you are friends
with, who you have blocked, and the invite links you make, including
who joined through one.
Posts, captions and comments. When you rate a new
movie it is posted to your friends' Feed with the caption you write. A
rating made in a watch party is only posted if you choose to post it
after the reveal. Comments you leave on a friend's post are saved with
your username.
Watch parties. The parties you host or join, the party
code, who is in each one, and the scores you send to a party.
Reports about other people, only if you send one. If
you report a username, photo, caption or comment, I keep what you
reported and the reason you picked.
Bug reports and ideas, only if you send one. If you
tap the bug button, or "Report a bug or suggest something" in Settings,
the app sends what you typed plus the app version, your operating
system version, your device model, and which screen you were on. It
never attaches your movies, ratings or notes.
That is the complete list. There is no analytics, no advertising, no
tracking of any kind, and no third-party SDK collecting anything in the
background.
Your notes are encrypted on your device before they are sent, and
I cannot read them. The key is generated on your device and shared
between your own devices through your Apple iCloud Keychain. It is never
sent to my server. What I store is unreadable text.
The honest consequence: if you lose access to every device that holds the
key, your notes cannot be recovered by anyone, including me. That
is what end-to-end encryption actually means, and it is the trade the
feature makes on purpose.
In rare conditions — signing in on a brand-new device before iCloud
Keychain has delivered your key — a note you write is kept on that device
in ordinary text and is deliberately not sent anywhere until it can
be encrypted first.
Who can see what
Your friends see your library: the movies you rated,
the ten scores and your overall score for each, your captions, and when
you rated or posted. They see your username and photo, and the comments
on your posts. They never see your notes, your email or your name.
Unfriending or blocking someone takes all of this away from them at
once.
People in a watch party with you see your username and
photo. Everyone's scores stay sealed until the host reveals them. After
that, everyone in the party sees each person's scores for that movie.
While a party you are in has not been revealed, that movie is hidden
from your friends.
Anyone else sees only your username and photo, and only
by typing your exact username.
Me. I read reports people send about usernames, photos,
captions and comments, and I can remove the ones that break the rules.
I read the bug reports and ideas you send.
Where it goes
Supabase hosts the database and the accounts. They are
a service provider storing the data on my behalf; they do not use it for
anything of their own. Row-level security means each account can only
ever read its own rows — this is enforced by the database, not by the
app being polite.
TMDB (themoviedb.org) receives movie titles when you
search for a movie or look for a poster, so it can answer. It receives
nothing about you — no account, no email, no identifier. Posters are
cached on your device and are never sent anywhere.
Apple iCloud Keychain carries your notes encryption key
between your own devices. This is Apple's infrastructure and I have no
access to it.
Discord receives a copy of each bug report and idea you
send, posted to a private channel only I read, so I see it right away.
The copy has what you wrote, your username, and the app and device
details listed above. It never has your email.
Discord also receives each report about someone, in a
second private channel only I read, so I can deal with it quickly. The
copy says what kind of thing was reported and why, the username of the
account reported, and for a caption, comment or username, the words
that were reported. It never says who sent the report, and it never
includes a photo or anyone's email.
Nobody else receives anything. Your data is never sold, never shared for
advertising, and never used to train anything.
What the app does on your device alone
Movie suggestions are generated by Apple's on-device model. The prompt and
your taste never leave the device. Poster colours, search and every screen are
computed locally.
Deleting everything
Settings → Account → Delete my account. It removes your
account, every movie, rating, date and note, from the device and from the
server, including records already deleted but not yet purged. It is
immediate, permanent, and not recoverable — by you or by me.
It also removes your username and photo, your friends, requests and
blocks, your invite links, your posts and every comment you wrote, and your
place and scores in every watch party. There are three things to know:
A watch party you hosted is handed to the person who has been in it
longest, so their record of that night stays. If you were the only one
in it, it is deleted.
A report you sent about someone else is kept without your name, so
harmful content can still be dealt with. Reports about you are deleted
with your account.
A copy of a bug report or idea already posted to Discord stays there
until you ask me to delete it. So does a copy of a report about your
account.
Watch parties that were never revealed are deleted automatically after 30
days.
You can also export everything first: Settings → Account → Export my
library, which produces a spreadsheet with your notes decrypted and readable.
Children
Tenfold is not directed at children and I do not knowingly collect data
from anyone under 13. If you believe a child has created an account, contact
me and I will delete it.
Changes
If this policy changes, the date at the top changes with it. Anything that
materially affects what is collected will also be said inside the app.