MyMedia
Sign up

Privacy Policy

Last updated 19 October 2026

This Privacy Policy explains how MyMedia ("MyMedia", "we", "us" or "our") collects, uses and shares personal data when you use the website at mymedia.page (the "Service"), and sets out the rights available to you in relation to that data. MyMedia is operated by Jessica Gaspar, an independent developer based in Portugal, who is the controller of your personal data under the EU General Data Protection Regulation (the "GDPR"). Any question or request concerning your personal data may be sent to privacy@mymedia.page.

1. Publicly available information

MyMedia is a public diary. Your profile, diary, library, entries, ratings, reviews, favorites and lists are publicly accessible, including to visitors without an account and to search engines. You can ask search engines not to list your profile, diary, library, entries and lists by turning off "Show my profile in search engines" when editing your profile. Those pages stay public, search engines decide whether to follow the request, and pages they already listed can take some time to drop out; title pages are not affected. Your logs, library titles and ratings also appear with your username on each title's page, alongside other members', and count towards the ratings shown there and in Discover. The accounts you follow and the accounts that follow you are public too, listed on your profile, as are the comments you post, which appear with your name under the entry or list you commented on. When you like an entry or a list, its owner is told that it was you; everyone else sees only the number of likes. The accounts you block are visible only to you. Ideas you submit to the roadmap are displayed together with your username once they have been approved.

2. Personal data we collect

  • Account information: your name, username, email address and a hashed form of your password (the password itself is never stored). If you enable two-factor authentication, we also store its secret and recovery codes in encrypted form.
  • Profile information: your display name, pronouns, biography, profile picture, social links, selected theme and the media categories you choose to display.
  • Activity data: the titles you log or add to your library, the dates on which you log them, and your ratings, reviews, favorites and lists; the accounts you follow and block; your likes; the comments you post; and when you last opened your notifications.
  • Submissions: roadmap votes and ideas, issue reports (including any page link you provide), and reports concerning other users' content.
  • Supporter subscription, if you become a Supporter: the identifiers Polar gives your customer record and your subscription, the subscription's status, and the date it renews or ends. We never receive your payment details.
  • Session data: while you are logged in, your IP address and browser information are stored with your session for security purposes.
  • Security log: sign-ins and failed sign-in attempts; changes to your password, email address, username or two-factor settings; account deletion; rate-limit events; and administrative actions. These events are recorded with your account identifier and IP address. The log never contains passwords or other secrets, and for a failed sign-in it records only a hashed form of the email address entered.
  • Technical monitoring data: for requests to the Service, background tasks and errors, the page address, timing and error details, your IP address and, if you are logged in, your account identifier and username. It never includes form contents or passwords.

3. How we use your data and our legal bases

We process your personal data for the following purposes:

  • to provide your account and display your page, as requested when you register (performance of a contract, Art. 6(1)(b) GDPR);
  • to provide Supporter benefits by checking the status of your Supporter subscription with Polar (performance of a contract, Art. 6(1)(b) GDPR);
  • to keep the Service secure, including secure authentication, the prevention of abuse and the handling of reports, bans and hidden content (legitimate interests, Art. 6(1)(f) GDPR);
  • to detect and fix errors and keep the Service running reliably (legitimate interests, Art. 6(1)(f) GDPR);
  • to send service emails relating to your account, such as email verification and password reset messages (performance of a contract, Art. 6(1)(b) GDPR).

We do not display advertising, we do not use analytics or tracking scripts, and we never sell your personal data.

4. Service providers and third parties

  • Hosting: the Service and its database are hosted by Laravel Cloud (Frankfurt, Germany), which processes data on our behalf. Profile pictures are stored in the European Union with Cloudflare R2, Laravel Cloud's file storage.
  • Backups: an encrypted copy of the database is made every day and stored in the European Union with Cloudflare R2, separately from our hosting, so that the Service can be restored after a failure. Cloudflare cannot read these copies.
  • Monitoring: Laravel Nightwatch receives the security log and the technical monitoring data described in section 2, so that we can detect and fix errors and investigate security incidents. This data is stored in Frankfurt, Germany.
  • Email: account emails (email verification and password resets) are sent through Resend, which receives your email address and the content of the message. Emails are sent from Ireland, and Resend keeps its records of them in the United States.
  • Payments: the Supporter subscription is sold by Polar (Polar Software Inc., United States) as merchant of record, which processes the payment (through Stripe) and handles taxes, receipts, cancellations and refunds. When you start a checkout, we send Polar your name, email address and account number, so that the subscription is linked to your account. What you enter at checkout is covered by Polar's privacy policy. We receive only the subscription information described in section 2.
  • Media databases (TheTVDB, IGDB, Open Library and TheAudioDB; see Credits): when you search for a title, our server sends these services only your search terms, never your account details. Cover images are loaded from their servers, so your browser connects to them directly when it displays a cover, as it would when visiting any website.
  • DiceBear: where a user has no profile picture, an initials image is loaded from DiceBear, which receives the name displayed on that profile.

Some of these providers are located outside the European Union. Where personal data is transferred outside the EU, the transfer is subject to the safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses.

5. Cookies and local storage

The Service uses only cookies that are strictly necessary for it to function, and for this reason does not display a cookie consent banner. These are:

  • a session cookie and a security (CSRF) token, which keep you logged in and protect forms from forgery;
  • a "remember me" cookie, set only if you select that option when logging in;
  • your light or dark appearance preference, stored in a cookie and in your browser's local storage so that pages do not briefly display in the wrong colours.

6. Data retention

  • We retain your personal data for as long as your account exists.
  • When you delete your account (Settings → Account), your profile, entries, favorites, lists, follows, blocks, likes, comments, votes and issue reports are deleted immediately, together with the likes and comments other people left on your entries and lists. Roadmap ideas you submitted remain on the board without your name. If you are a Supporter, your subscription is cancelled at the same time, and your customer record at Polar is deleted and anonymised; Polar keeps the records of past payments that tax law requires.
  • When you change your username, your previous username is reserved for you for 30 days, so that no one else can claim it immediately.
  • Backups of the database are deleted after 31 days, so data deleted from the Service, including a deleted account, is gone from every backup within 31 days.
  • Security log entries and technical monitoring data are deleted after 90 days.
  • Reports and moderation decisions may be retained where necessary to address repeated abuse.

7. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you and receive a copy of it in a portable format (rights of access and data portability);
  • have inaccurate data corrected (right to rectification); you can edit most of your data yourself in Settings and on your profile;
  • have your data erased (right to erasure); you can delete your account yourself at any time;
  • object to, or request the restriction of, the processing of your data;
  • lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or with the supervisory authority in your country of residence.

To exercise any of these rights, please contact privacy@mymedia.page. We will respond within one month of receiving your request.

8. Minimum age

You must be at least 13 years of age to use the Service. If we become aware that an account belongs to a person under 13, we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will give notice on the Service before they take effect. This policy should be read together with our Terms of Service.