Privacy policy
Last updated:
This policy explains how we handle personal data when you browse the site, create an account, rate items, contact us or use the paid API. It is written to meet the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The service operator is the data controller for the data described here. For any privacy question or request, use the contact form (choose "Questions"). We answer requests within 15 days.
2. Data we collect
Account: name, email, nickname, password (stored only as a one-way hash), sign-in method (email/password, Google, passkeys), two-factor settings and the date you scheduled a deletion, if any.
Activity: your ratings (six categories, 0–100), item status, lists, follows and profile privacy choice.
Technical: IP address and browser user agent attached to active sessions, and short-lived counters used to block abuse (rate limiting and bot protection).
Contact messages: the name, email, subject and text you send us.
API and billing: API key metadata (we store only a hash of the key), request counts, plan, credits and invoices. Card and PIX payment data are handled by Stripe and AbacatePay; we never see or store full card numbers.
3. Why we use it (legal bases)
To provide the service you asked for — account, ratings, API access and billing (performance of a contract).
To keep the service secure, prevent fraud, spam and bots, and compute community scores (legitimate interest).
To load optional third-party video embeds, only after you allow them (consent, which you can withdraw at any time).
To keep billing records required by tax law (legal obligation).
4. Cookies
We only use essential cookies: the session cookie that keeps you logged in, short-lived two-factor and trusted-device cookies, and preference cookies for theme, language and your cookie choice. We use no advertising or cross-site tracking cookies.
Traffic statistics are collected without cookies (Vercel Web Analytics), in aggregate. Trailers are served from youtube-nocookie.com and only load after you allow embeds in the cookie banner.
When you follow an affiliate link to Amazon or Mercado Livre you leave our site; those stores set their own cookies under their own policies.
5. Who we share data with
We do not sell personal data. We share it only with providers that process it on our behalf: Vercel (hosting, bot protection, analytics), Neon (database), Upstash (rate limiting), Resend (transactional email), Stripe and AbacatePay (payments) and Google (only if you choose "Continue with Google").
Some of these providers are located outside your country, including in the United States. Transfers rely on the safeguards allowed by the LGPD and GDPR, such as standard contractual clauses.
6. How long we keep it
Account data is kept while your account exists. When you delete your account, it enters a 30-day grace period during which you can log in and cancel. After that, your name, email, nickname, sessions, sign-in methods and two-factor data are erased and the account is anonymized.
Your ratings are kept after deletion without any link to your identity, as "Deleted user", so community scores are not distorted.
Contact messages are kept for up to 2 years; billing records for as long as tax law requires (currently 5 years in Brazil); security logs for up to 30 days.
7. Your rights
Under the LGPD (art. 18) and the GDPR you can: confirm whether we process your data; access it; correct it; request anonymization, blocking or deletion; receive it in a portable format; know who we share it with; object to processing based on legitimate interest; and withdraw consent.
You can edit your name, password, two-factor settings, passkeys and profile privacy, and delete your account, directly in your profile. For anything else, use the contact form. You may also complain to the Brazilian data protection authority (ANPD) or to your local supervisory authority.
8. Security
Passwords are hashed, all traffic uses HTTPS, sessions use HttpOnly cookies, and you can protect your account with two-factor authentication and passkeys. No system is perfectly secure; if we learn of an incident that affects you, we will notify you and the authorities as the law requires.
9. Children
The service is not directed to children. You must be at least 13 years old — or the minimum age for digital consent in your country, if higher — to create an account.
10. Changes
We will update this page when our practices change and change the date above. Material changes are announced on the site or by email before they take effect.