# Privacy Policy **Effective Date: June 5, 2026** **Last Updated: June 25, 2026** MovieTQ (also known as "Movie Trailer Quiz") is operated by **Caellum LLC**, a Maryland limited liability company ("Company," "we," "us," or "our"). We respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use and share it, and the rights you have regarding your information when you use our website located at `movietq.com` and related services (collectively, the "Service"). --- ## 1. Scope of This Policy This policy applies to all visitors, registered players, and guest players of MovieTQ. It does not apply to the practices of third-party platforms, websites, or services that we do not own or control (such as Discord, YouTube, or Google). --- ## 2. Information We Collect We collect information you provide directly, data generated during gameplay, and technical data collected automatically from your device. ### A. Information Provided Directly by You * **Account Registration**: To register an account, you must provide a unique **username** and a **password** (which is stored in a secure hashed format). Providing an **email address** is entirely optional. * **Profile Customization**: If you choose to personalize your profile, we collect your display name, biography text, and equipped virtual cosmetics (such as avatars, backgrounds, and titles). * **Contact & Support**: If you submit a query through our contact form, we collect the subject, category, message content, and associate it with a snapshot of your account profile details (such as level, Popcorn balance, and role status). ### B. Automatically Collected Data * **Network & Device Data**: When you interact with the Service, our servers automatically log your **IP address**, web browser type, operating system, referrer URL, pages visited, and date/time stamps. * **Cookies**: We use cookies to enable core functions: * *Essential Session Cookies*: We set an HttpOnly `token` cookie containing a JSON Web Token (JWT) to authenticate your account and maintain your login state. * *Preference Cookies*: We use local storage to save user preferences, such as game volume settings and dismissed pop-ups. * **Third-Party Cookies**: We load trailer embeds using YouTube's privacy-enhanced ("no-cookie") mode (`youtube-nocookie.com`), which is designed to defer YouTube's cookies until you actually play a video. When you play an embedded movie trailer, **YouTube (Google)** may still set cookies on your browser and receive your IP address, as the embed and video host, in accordance with their privacy policies. * **First-Party Telemetry**: We collect technical telemetry events to analyze usage, system latency, and game performance. This includes the duration of actions (such as response times), page/screen views, specific interactions with game features, and minimal performance/device metrics. Telemetry is collected directly by our own servers (first-party) and is **never** sold or disclosed to third-party ad networks or analytics platforms. If your browser transmits a Global Privacy Control (GPC) signal, we automatically anonymize or discard these telemetry events. ### C. User-Generated Content (UGC) and Telemetry * **In-Game Chats**: We log and display lobby chat messages, match chat, reports, and player moderation actions. * **Direct Messages**: Direct messages sent between players are stored in our database and may appear in moderation logs or administrative moderation tools. Direct messages are **not end-to-end encrypted**. Authorized administrators and moderators may access direct messages when needed for moderation, safety, abuse prevention, user reports, support, or legal compliance. * **Gameplay Analytics**: We track game participation, round statistics, correct/incorrect guesses, levels, achievements, and XP progression. ### D. Social Providers (Discord OAuth) If you log in via Discord, we receive your public Discord username and account ID. We use this to establish your profile. We do not obtain your Discord password. --- ## 3. Sources of Information We collect information: 1. **Directly from you** when you register, chat, update your profile, or submit contact forms. 2. **Automatically from your browser or device** via cookies and server logs. 3. **From third parties** including Discord (OAuth profile metadata). --- ## 4. Purposes of Processing We process your data to: * Provide, operate, and maintain the game lobbies and matchmaking. * Save your level, achievements, cosmetics, and Popcorn currency balances. * Log system events, detect cheating, prevent bots, block offensive terms, and investigate security incidents. * Moderate public chats, direct messages, profiles, reports, and other user-generated content to enforce our rules and protect players. * Respond to customer support and feedback submissions. * Comply with legal obligations, enforce our Terms of Service, and cooperate with law enforcement. We do **not** sell your personal information or share it with advertisers for targeted cross-contextual marketing. --- ## 5. Disclosures of Information We share your personal information only in the following limited circumstances: * **Service Providers**: We disclose technical data, user IDs, and profile details to Supabase (hosting, authentication, and database), Cloudflare (DNS and network proxying), and Render (server API hosting) to operate our Service infrastructure. * **YouTube/Google Embeds**: We embed trailers using YouTube's privacy-enhanced ("no-cookie") mode. When a trailer plays, YouTube (Google) receives your IP address and may set player cookies as the video host. * **Legal Compliance**: We may disclose information if required to do so by a subpoena, court order, or search warrant, or to protect the safety, rights, or property of Caellum LLC, our players, or the public. * **Business Transfers**: In the event of a merger, acquisition, financing, or transfer of assets, user data may be transferred to the acquiring entity. --- ## 6. Retention of Data We retain personal data only as long as necessary to fulfill the purposes described in this policy: * **Registered User Accounts**: All account credentials, profile configurations, stats, and inventories are stored until you delete your account. * **Account Deletion Grace Period**: When you request account deletion, your data is scheduled for deletion and enters a 14-day grace period. During this time, your data remains in the database but you cannot play. If you do not cancel the request within 14 days, all associated tables (profiles, stats, messages, friendships, and auth rows) are permanently deleted. * **Guest Play Accounts**: Guest account records and their associated gameplay data, settings, and login tokens are automatically pruned from our live database **48 hours** after creation. * **Lobby, Match, and Direct Chats**: Chat messages, match messages, and lobby logs associated with active matches are archived and pruned from our live database **14 days** after the match is completed. * **System Event Logs**: IP addresses and activity records logged in `system_logs` are archived and pruned from our live database after **30 days**. * **First-Party Telemetry**: Session telemetry events (including navigation timing, route response times, and feature interactions) are archived and pruned from our live database after **60 days**. Telemetry is anonymized/discarded if the Global Privacy Control (GPC) signal is active. * **Audit Logs**: Security and administrative audit logs of critical actions (such as moderator bans, mutes, account deletions, settings changes, or credential updates) are retained to ensure system security and accountability. For accountability, these records may retain the **username** of the staff member or actor who performed the action, and the **account identifier (and, for actions such as bans, mutes, or deletions, the username) of the user the action was taken against**, even after either account is later deleted. This limited retention is based on our legitimate interest in maintaining a tamper-evident security record. --- ## 7. Children's Privacy (COPPA) The Service is not intended for or directed to children under the age of thirteen (13). We do not knowingly collect or solicit personal information from children under 13. Registration requires users to confirm that they are at least 13 years old. If we learn that a registered user is under 13 โ€” or that we have inadvertently collected personal information from a child under 13 โ€” we will promptly disable and delete that account along with the associated personal information. If you believe a child under 13 has registered an account, please notify us at `legal@movietq.com`. --- ## 8. International Data Transfers Our databases and hosting servers are located in the **United States**. If you access the Service from the European Economic Area (EEA), United Kingdom, Canada, or other international regions, please be aware that your personal information will be transferred to and processed in the United States, where privacy protections may differ from your home country. --- ## 9. Your Rights and Choices Depending on your jurisdiction, you may have rights under applicable consumer privacy laws: * **Access and Portability**: You may request a copy of the personal information we hold about you. * **Correction**: You can correct or update your username, password, email, display name, and bio in your Profile settings at any time. * **Deletion**: You can request permanent account deletion via your settings. * **Opt-Out**: Since we do not sell your data or use it for targeted behavioral ads, opt-out requests for sales/sharing do not apply. To exercise any of these rights, or to appeal a request decision, please contact us at `legal@movietq.com`. We will verify your identity before processing your request. **California Residents โ€” "Shine the Light."** California Civil Code ยง 1798.83 ("Shine the Light") permits California residents to request information about a business's disclosure of personal information to third parties for those third parties' own direct-marketing purposes. **We do not disclose your personal information to third parties for their direct marketing**, so there is nothing to report under this law. You may still contact us at `legal@movietq.com` with any questions. **"Do Not Track" and Global Privacy Control signals.** Some browsers offer a "Do Not Track" (DNT) or Global Privacy Control (GPC) setting. We do **not** track your activity across third-party websites or services, do **not** serve targeted/behavioral advertising, and do **not** share user data with third-party advertising or analytics networks. We honor the **Global Privacy Control (GPC)** signal: if your browser transmits a GPC signal, we automatically anonymize or discard first-party telemetry events associated with your session. We do not respond differently to standard "Do Not Track" (DNT) headers. The third-party YouTube embeds you choose to play are governed by Google's own policies. --- ## 10. Security Safeguards We implement administrative, technical, and physical safeguards to protect your personal data. Passwords are stored in hashed form, database access is restricted, and data is transmitted using HTTPS/TLS between users, our web/API infrastructure, and supported third-party service APIs where applicable. However, direct messages and chat messages are not end-to-end encrypted, and authorized administrators and moderators may access them as described above. No database, application, or internet transmission can be guaranteed to be 100% secure. --- ## 11. Changes to This Policy We may update this Privacy Policy as our features, practices, or legal requirements change. When updates occur, we will post the revised policy with a new "Last Updated" date. For material changes, we will provide notice through an in-product alert on login. We encourage you to review this policy periodically. --- ## 12. Contact and Complaints If you have questions, complaints, or feedback about our privacy practices, please contact us at: **Email:** `legal@movietq.com` **Mailing Address:** Caellum LLC, 4600 Powder Mill Road, Suite #450 #1043, Beltsville, MD 20705