Watch Roulette Privacy Policy

Watch Roulette works without an account. In local mode, saved picks, watch history, dislikes, spin queues, saved filters, custom shows, profile preferences, explicitly accepted AI memory, review-only metadata proposals, and backup-related app data can remain in this browser's local storage unless you choose to export, restore, share, or sync eligible account data.

Metadata Lab proposals are bounded local review records, expire after 180 days unless exported and restored while still current, and never become catalog facts or source provenance. Clear All removes them from this browser.

You can export a local backup file from the Profile page. That file may contain saved picks, watch history, dislikes, queues, filters, custom shows, profile preferences, explicitly accepted AI memory, review-only metadata proposals, and other local Watch Roulette app data. Backup files are user-controlled, so store and share them only where you are comfortable.

Optional account sync backend endpoints exist for signed-in users. Signed-out users do not sync account data, and public browsing, Spin, Profile, and local backup tools remain available without login.

When signed-in sync is enabled and used, Watch Roulette may store a narrow account sync snapshot with profile preferences, saved episode IDs, and watched history. The current sync MVP does not include custom shows, queues, battle history, saved filters, catalog or import state, provider availability, or Concierge/session state.

Profile provides separate controls for the narrow synced-data deletion endpoint, account export, and non-destructive full-deletion preview. Deleting synced account data is separate from deleting local browser data and downloaded backup files.

Signed-in users can request a short-lived, one-time server account export from Profile. This export is separate from the more complete local backup because Watch Roulette cannot collect local-only browser data without an explicit sync or upload action.

Share buttons, copy actions, and social composer links only run when you choose to use them. If you open a social site, streaming service, search page, or provider link, that destination may receive information from your browser according to its own privacy practices.

Provider links are availability hints. Watch Roulette does not guarantee that a title is available on a provider.

Watch Roulette uses system fonts and may render reviewed poster, backdrop, or episode artwork from TVmaze's external HTTPS image host. That host receives standard browser request metadata. Missing, unavailable, or offline artwork falls back to deterministic generated local visuals.

Watch Roulette does not scrape streaming sites, call the TVmaze metadata API from public browser routes, or expose TMDB, TVmaze, or provider API keys in the browser app.

Watch Roulette does not currently include payments, ads, push notifications, precise location collection, contacts access, health data, or first-party tracking features.

If analytics, crash reporting, provider APIs, broader sync, native telemetry, payments, push notifications, or account changes are added later, this policy and store disclosures should be reviewed before launch.

The optional local Decision Pilot requires explicit consent. It creates a random non-identifying pilot ID and uses only coarse facts derived from completed decisions after that consent boundary. Watch Roulette never sends those facts automatically.

If you choose an explicit JSON export, it contains only the pilot ID, UTC day, coarse timing and eligible-count buckets, result ordinal, accepted mode, fallback flag, terminal action, and application/ruleset versions. It does not contain show or episode identity, intent values, queues, imports, profile or household signals, free text, provider destinations, raw receipts, prompts, or responses.

Ending or resetting consent stops future inclusion and Clear All removes the local pilot state. A file already downloaded remains under your control outside Watch Roulette. Real participant research notes are not entered into or combined with the product export.

Local Watch Roulette data can be removed with Profile's Clear All control or by clearing this site's browser storage. Clearing browser storage removes this site's local app data. Backup files you downloaded are controlled by you and must be deleted wherever you saved or shared them.

Signed-out use does not create a server account. In a deployment with sign-in enabled, Profile can export account data, delete the narrow sync snapshot, and preview categories involved in future full-account deletion. Full user-account deletion is not automated.

If Watch Roulette is hosted publicly, the hosting provider may process standard request logs needed to serve and protect the site.