Privacy Policy
Short version: no sign-up needed, no tracking cookies, no ads, and by default your watch progress never leaves your device. If you choose to sign in, your progress syncs to your account so it follows you across devices. We use privacy-friendly analytics that can't identify you, so there's no cookie banner to click.
Who we are
Bingerun (this website, bingerun.com) is operated from Norway. For any privacy question,
or to exercise your rights below, contact [email protected].
We are the data controller for the limited processing described here.
What we collect
You can use all of Bingerun without an account, and without giving us your name, email, or any personal information. We do not sell or share personal data. For visitors who don't sign in, the only information processed is the minimum needed to deliver and secure the site (below) and aggregate, non-identifying analytics. If you choose to create an account for cross-device sync, the "Optional accounts" section below describes exactly what that adds.
Your progress is stored on your device
When you tick off entries in a watch/reading order, favourite a franchise, or build a list, that data is
saved in your browser's local storage (keys beginning with iol: and
bru:) on your own device. Unless you sign in, it is never transmitted to us. It stays until
you clear it, use the "Reset progress" button on a page, or clear your browser's site data for Bingerun.
This is a first-party preference you set yourself, so it requires no consent banner.
Optional accounts & cross-device sync
You can optionally sign in with Discord or Google to sync your progress across devices. Sign-in happens at the provider; we never see or store a password. From the provider we receive your email address and basic profile details (such as username and avatar), which identify your account. While signed in, the progress, favourites, and lists described above are also stored server-side in your account so they can follow you between devices.
- Account and sync data are stored with our database provider Supabase (see providers below) and used only to operate your account and sync, never for advertising, and never sold or shared.
- Signing out removes the synced data from that device.
- To delete your account and all synced data, email [email protected] from the account's address and we will erase it.
Our lawful basis for account processing is the performance of a contract: storing this data is what makes the sync feature you signed up for work.
Analytics, privacy-friendly and cookieless
To understand which pages are useful, we use cookieless, aggregate analytics (such as Plausible or Cloudflare Web Analytics). This kind of analytics:
- sets no cookies and stores nothing on your device;
- does not track you across other sites and does not build a profile of you;
- measures traffic in aggregate (page views, referrers, country, device type), it cannot identify you.
Where an IP address is briefly used to count a visit, it is processed in a non-identifying way and not stored. Because nothing is read from or stored on your device, this needs no consent under EU/EEA ePrivacy rules, which is why you don't see a cookie banner. Our lawful basis under the GDPR is our legitimate interest in understanding, in aggregate, how the site is used so we can improve it; this is balanced against your privacy by using a tool that cannot identify you.
Security & server logs
The site is served through a content-delivery and security network. To deliver pages and protect the
site from abuse, that provider transiently processes connection data including your IP address and
request metadata, and may set strictly-necessary cookies (for example Cloudflare's
__cf_bm / cf_clearance) used only to tell humans from bots. These are not used
to track you across sites and, being strictly necessary, require no consent. Such operational/security
logs are minimised and retained only briefly.
Service providers (processors) & international transfers
We rely on Cloudflare (content delivery, DNS, security, and cookieless analytics), a US-based provider, under a data-processing agreement. For optional accounts and sync we rely on Supabase (authentication and database), whose infrastructure for our project is hosted in the United States, also under a data-processing agreement. Any transfer of personal data to the US relies on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.
Advertising
We do not currently show ads, and we use no advertising or marketing cookies or pixels. If we introduce advertising in future, it may use cookies or similar technologies, and we will update this policy and present the appropriate consent controls before any such cookies are set.
Affiliate & outbound links
Some "where to watch/read/play" links may be affiliate links, see our disclaimer. Outbound links lead to third-party sites with their own privacy policies, which we don't control.
Your rights
Under the GDPR you have the right to access, correct, or erase your personal data, to object to or restrict processing, and to data portability. If you don't have an account we hold essentially no identifying data about you; if you do, we will show you, export, or erase your account data on request. You can always reach us at [email protected]. You also have the right to lodge a complaint with your supervisory authority; in Norway that is the Data Protection Authority, Datatilsynet.
Children
This site is general-audience and is not directed at children under 13, and we do not knowingly collect data from them.
Changes & contact
We may update this policy as the site grows; the "last updated" date above will change. Questions? Email [email protected].