Privacy Policy
Last updated October 3, 2026
Mystonie lets you make artwork for the shows and movies you finish. We collect as little as we can. This page explains what we collect, why, and what you can do about it.
Who we are
Mystonie is run by an independent developer (codenat.me), who is the data controller for the information described here. Contact: privacy@mystonie.com.
Cards you make
Cards are made entirely in your browser. The title you pick, your rating, your review and the date stay on your device and are not sent to us. When you share a card, it goes wherever you send it, under that app's own terms.
Your account
If you create an account, we store your email address, a username (made from your name or email; you can change it), the language and time zone you signed up with, and, if you sign in with a social account (Google, Apple, Facebook, X or Discord), the name and profile picture it shares with us. Profile photo: we keep a copy of that picture, or a photo you upload in Settings, in our storage, cropped and resized to 320 pixels; you can change or remove it in Settings at any time, and it is deleted with your account. Sign-in happens through Supabase Auth: we never see or store a password, and each sign-in code is emailed to you and works once. We use this to run your account and to send you sign-in codes. Your page: while your collection is public (the default), anyone with its link can see your display name, username, profile picture, bio, the cards you shared, your collection totals and what you're watching. You can make it private in Settings; cards you shared stay viewable by their link. A card shows your username and profile photo unless you hide them on it. Totals across everyone include private collections, but never who: how many people finished a title (and what share of everyone on Mystonie had finished it when you did) and what's trending on Mystonie, which lists a title only once at least 3 people logged it that week. The same goes for how many people are in a fandom club or joined a monthly challenge, and what a club's members are on lately. While your collection is public, the clubs you joined and the challenges you completed show on your page, and your finishes of titles that fit a club you joined show on that club's page. While you're signed in, a small cookie remembers your chosen language and theme, and it's removed when you sign out. You can download all your data as a file in Settings (Export my data), and your collection as spreadsheets that import back into Mystonie (Export as CSV). You can delete your account at any time in Settings, which immediately removes your profile and everything you've logged.
What we collect
Waitlist: if you join, we store your email address, the language you used, where you signed up from (for example, from a shared card link) and the time you agreed to be emailed. Searches: the text you type is sent to our server and to the catalogs (TMDB, Google Books, AniList, RAWG) to find titles; we don't store it with anything that identifies you. Imports: an export you import from another app (Letterboxd, Goodreads, MyAnimeList, TV Time) is read on your device. Only the names, years, authors, ISBNs and catalog ids needed to find your titles are sent to our server and the catalogs (TMDB, Google Books, AniList, RAWG), and only what you confirm is saved to your collection. Offline use: so the app works without a connection, the pages you open in it, the posters on them and the titles you looked at lately are kept in your browser's storage on your device, with changes you make while offline until they reach us. Signing out deletes them from the device. Reports: if you report a page or card, we store the reason, your note and, if you're signed in, your account id, and use them only to review the report. Problem reports: if you use Report a problem, we store your message, the page you sent it from, your browser's name and version and, if you're signed in, your account id, and email them to ourselves. We use them only to fix and improve Mystonie and to reply to you, and delete them with your account. Notifications: if you turn on weekly recap notifications in the installed app, we store that device's push address and encryption keys, and delete them when you turn notifications off, sign out, or the device stops accepting them. Abuse protection: to stop automated abuse we count requests per visitor using a one-way, salted hash of your IP address. We never store the IP address itself, and these counters are deleted within a day. Usage and errors: we measure how the site is used (for example, how many cards are made or shared) and collect error reports, without advertising cookies and without building profiles across other sites. Content warnings: if you choose topics to avoid, we store them with your account and only you can see them. Titles are looked up on DoesTheDogDie from our server, never with anything that identifies you. Scene warnings and the warnings quiz: the warnings you add, your votes on them and your quiz answers are stored with your account. Others see the warnings and the totals, never who added or voted. If you delete your account, the warnings you added stay, without your name. Reel of the Day: signed in, your guesses and results are stored with your account (for your streak and stats) and only you can see them; signed out, they stay in your browser. The Journal: signed in, the articles you Stamp or save are stored with your account. Only you see which ones; everyone sees how many Stamps an article has, never who gave them. Tips: if you tip through Buy Me a Coffee, it tells us the email you paid with. If a Mystonie account uses that email, we give it the Supporter sticker; we don't keep the email or anything else about the tip.
How we use it
We use your account data to provide Mystonie to you (performing our agreement with you). We use a waitlist email only to tell you when the Mystonie app launches and about closely related product news, and we'll ask before anything else. The legal basis for waitlist email is your consent, which you can withdraw at any time. We use request counters and error reports to keep the service working and safe (our legitimate interest). We don't sell or rent personal information, and we don't use it for advertising.
Services we rely on
Vercel (hosting), Supabase (database and sign-in), PostHog (privacy-friendly analytics), Sentry (error reports) and Resend (email delivery) process data on our behalf under their data processing terms. Posters and title information come from TMDB (movies and series), AniList (manga), Google Books (books, through our server) and RAWG (games): your browser loads posters, photos of cast and crew, and game art directly from TMDB's, AniList's and RAWG's servers, which see your IP address like any website you visit. If you sign in with Google, Apple, Facebook, X or Discord, that company confirms who you are under its own privacy policy; we ask it only for your name, email address and profile picture (Apple lets you hide your email behind an address it forwards). Notifications you turn on are delivered by your device's push service (Apple, Google, Mozilla or Microsoft); they are encrypted so only your device can read them.
Where data is stored
These services may store and process data in the United States and other countries. Where required, transfers rely on safeguards such as the EU Standard Contractual Clauses.
How long we keep it
Account data is kept until you delete your account (Settings → Delete account), which removes it straight away. Waitlist emails are kept until you unsubscribe or ask us to delete them, or until we stop the waitlist; deleting your account removes a waitlist entry with the same email too. Every marketing email we send has an unsubscribe link. Request counters are deleted within a day. Analytics and error data are kept for a limited period set in those services.
Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, the CCPA or Thailand's PDPA), you can ask to access, correct, delete or export your data, object to or restrict its use, and withdraw consent. Email privacy@mystonie.com and we'll reply within 30 days. You can also complain to your local data protection authority.
Children
Mystonie isn't meant for children under 13. You must be at least 13 (or 16 where local law requires) to create an account or join the waitlist. If you think a child has signed up, contact us and we'll delete it.
Changes
If we change this policy we'll update the date above, and for significant changes to how we use your email we'll tell people on the waitlist first.