Privacy Policy

Effective Date: June 5, 2026 Last Updated: August 3, 2026

MovieTQ (also known as "Movie Trailer Quiz") is operated by Caellum LLC, a Maryland limited liability company ("Company," "we," "us," or "our"). We respect your privacy and are committed to protecting the personal information you share with us.

This Privacy Policy explains what information we collect, how we use and share it, and the rights you have regarding your information when you use our website located at movietq.com and related services (collectively, the "Service").

1. Scope of This Policy

This policy applies to all visitors, registered players, and guest players of MovieTQ. It does not apply to the practices of third-party platforms, websites, or services that we do not own or control (such as Discord, YouTube, or Google).

2. Information We Collect

We collect information you provide directly, data generated during gameplay, and technical data collected automatically from your device.

A. Information Provided Directly by You

• Account Registration: To register an account, you must provide a unique username and a password (which is stored in a secure hashed format). Providing an email address is entirely optional; if you add one, we use it for email verification, account recovery (password-reset links), and essential service notices about your account — not for marketing. Each account is also assigned a random public player tag — a short identifier you can share so other players can send you gifts.
• Profile Customization: If you choose to personalize your profile, we collect your display name, biography text, and equipped virtual cosmetics (such as avatars, backgrounds, and titles).
• Contact & Support: If you submit a query through our contact form, we collect the subject, category, message content, and associate it with a snapshot of your account profile details (such as level, Popcorn balance, and role status).
• Purchases & Payments: When you buy Popcorns or a membership, your payment is processed by Stripe. You provide your card or payment details directly to Stripe, and we never receive or store your full card number. We do store a record of the transaction — such as the item purchased, amount, currency, date and time, your membership/subscription status, and the Stripe customer, subscription, and checkout-session identifiers associated with your account — so we can deliver your purchase, show your purchase history, provide support, process refunds and chargebacks, calculate any applicable taxes, and detect and prevent fraud.

B. Automatically Collected Data

• Network & Device Data: When you interact with the Service, our servers automatically log your IP address, the approximate country your connection resolves to (used to show prices in your local currency and to investigate abuse), web browser type, operating system, device type (such as desktop, phone, or tablet), referrer URL, pages visited, and date/time stamps. We record the browser, operating system, and device type as a short summary (for example, "Chrome 141 · Windows 10/11 · Desktop") rather than storing the full technical identifier your browser sends.
• Cookies: We use cookies to enable core functions:
  • Essential Session Cookies: We set an HttpOnly token cookie containing a JSON Web Token (JWT) to authenticate your account and maintain your login state.
  • Preference Cookies: We save your interface preferences so the site behaves consistently across visits. This includes a small mtq_lang cookie that remembers your chosen website language, and browser local storage for settings such as game volume and dismissed pop-ups. If you are signed in, we also store your chosen website language on your account so it applies on any device you sign in from. These preferences are functional only — they are not used for advertising and are not shared with third parties.
• Third-Party Cookies: We load trailer embeds using YouTube's privacy-enhanced ("no-cookie") mode (youtube-nocookie.com), which is designed to defer YouTube's cookies until you actually play a video. When you play an embedded movie trailer, YouTube (Google) may still set cookies on your browser and receive your IP address, as the embed and video host, in accordance with their privacy policies.
• First-Party Telemetry: We collect technical telemetry events to analyze usage, system latency, and game performance. This includes the duration of actions (such as response times), page/screen views, specific interactions with game features, and minimal performance/device metrics. Telemetry is collected directly by our own servers (first-party) and is never sold or disclosed to third-party ad networks or analytics platforms. If your browser transmits a Global Privacy Control (GPC) signal, we automatically anonymize or discard these telemetry events.

C. User-Generated Content (UGC) and Telemetry

• In-Game Chats: We log and display lobby chat messages, match chat, reports, and player moderation actions.
• Direct Messages: Direct messages sent between players are stored in our database and may appear in moderation logs or administrative moderation tools. Direct messages are not end-to-end encrypted. Authorized administrators and moderators may access direct messages when needed for moderation, safety, abuse prevention, user reports, support, or legal compliance.
• Gameplay Analytics: We track game participation, round statistics, correct/incorrect guesses, levels, achievements, and XP progression.

D. Social Providers (Discord & Google OAuth)

If you log in via Discord, we receive your public Discord username and account ID. We use this to establish your profile. We do not obtain your Discord password.

If you log in via Google, we receive your Google account identifier, and (where available and verified) your email address and basic profile name. We use this to create or match your account and establish your profile. We request only basic sign-in scopes (openid, email, profile); we do not access your Gmail, Google Drive, contacts, or any other Google service, and we do not obtain your Google password.

• Social Reward Verification (optional): If you choose to claim a social-follow reward (for example, joining our Discord server or following us on X), we store the social identity involved — your Discord account ID (when you verify server membership through Discord) or the X handle you submit — solely to deliver the reward and enforce our one-reward-per-person anti-abuse rules. When verifying Discord membership, we request a list of the servers your Discord account belongs to only to confirm you are in ours; we do not store that list. This data is kept for as long as your account exists and is deleted with your account.

3. Sources of Information

We collect information:

1. Directly from you when you register, chat, update your profile, or submit contact forms.
2. Automatically from your browser or device via cookies and server logs.
3. From third parties including Discord and Google (OAuth profile metadata).

4. Purposes of Processing

We process your data to:

• Provide, operate, and maintain the game lobbies and matchmaking.
• Save your level, achievements, cosmetics, and Popcorn currency balances.
• Process and deliver your purchases, memberships, and gifts; provide receipts and support; handle refunds and chargebacks; and calculate any taxes we are required to collect.
• Log system events, detect cheating, prevent bots, block offensive terms, and investigate security incidents.
• Moderate public chats, direct messages, profiles, reports, and other user-generated content to enforce our rules and protect players.
• Respond to customer support and feedback submissions.
• Comply with legal obligations, enforce our Terms of Service, and cooperate with law enforcement.

We do not sell your personal information. On the pages you see before signing in, we may use a limited ad-conversion measurement tool to see whether an ad brought you to the site; this never runs on gameplay or trailer-viewing pages, and you can opt out (see "Your Rights and Choices" below).

5. Disclosures of Information

We share your personal information only in the following limited circumstances:

• Service Providers: We disclose technical data, user IDs, and profile details to Supabase (hosting, authentication, and database), Cloudflare (DNS and network proxying), and Render (server API hosting) to operate our Service infrastructure.
• Payment Processing (Stripe): When you make a purchase, we share the information needed to complete it with Stripe, Inc., our payment processor. You provide your payment details directly to Stripe, which collects and processes them under its own privacy policy; we receive transaction metadata (never your full card details) to fulfill, record, and support your purchase.
• YouTube/Google Embeds: We embed trailers using YouTube's privacy-enhanced ("no-cookie") mode. When a trailer plays, YouTube (Google) receives your IP address and may set player cookies as the video host.
• Ad Conversion Measurement (Google): On our pre-sign-in pages only, we may share limited technical data (such as your IP address and whether you arrived from one of our ads) with Google to measure ad performance. This does not run on gameplay or trailer pages and is never used to target you with ads elsewhere. Honored automatically if your browser sends Global Privacy Control, or you can opt out via the footer link on any page.
• Legal Compliance: We may disclose information if required to do so by a subpoena, court order, or search warrant, or to protect the safety, rights, or property of Caellum LLC, our players, or the public.
• Business Transfers: In the event of a merger, acquisition, financing, or transfer of assets, user data may be transferred to the acquiring entity.

6. Retention of Data

We retain personal data only as long as necessary to fulfill the purposes described in this policy:

• Registered User Accounts: All account credentials, profile configurations, stats, and inventories are stored until you delete your account.
• Account Deletion Grace Period: When you request account deletion, your data is scheduled for deletion and enters a 14-day grace period. During this time, your data remains in the database but you cannot play. If you do not cancel the request within 14 days, all associated tables (profiles, stats, messages, friendships, and auth rows) are permanently deleted, other than the limited purchase and billing records we are required to keep for legal, tax, and accounting purposes (see "Purchase & Billing Records" below).
• Guest Play Accounts: Guest account records and their associated gameplay data, settings, and login tokens are automatically pruned from our live database 48 hours after creation.
• Lobby & Match Chats: Chat messages, match messages, and lobby logs associated with a match are archived and pruned from our live database 14 days after the match is completed.
• Direct Messages: Direct messages between players are automatically pruned from our live database 14 days after they are sent.
• Match Records (Fair Play): To detect cheating and automated play, we keep a record of each match you finish — the game mode, the room settings it was played on, your score, how many answers you gave and how many were correct, and when it started and ended. These records are pruned from our live database after 30 days. Where such a record indicates possible cheating, we keep the resulting internal fair-play note (the behaviour observed, the date, and a short summary of the evidence) for as long as your account exists, so that repeated behaviour can be recognised. These records and notes are visible only to administrators, are never shown to other players, and are deleted with your account. This processing is based on our legitimate interest in keeping the game fair for everyone.
• System Event Logs: IP addresses and activity records logged in system_logs are archived and pruned from our live database after 30 days.
• First-Party Telemetry: Session telemetry events (including navigation timing, route response times, and feature interactions) are archived and pruned from our live database after 60 days. Telemetry is anonymized/discarded if the Global Privacy Control (GPC) signal is active.
• Audit Logs: Security and administrative audit logs of critical actions (such as moderator bans, mutes, account deletions, settings changes, or credential updates) are retained to ensure system security and accountability. For accountability, these records may retain the username of the staff member or actor who performed the action, and the account identifier (and, for actions such as bans, mutes, or deletions, the username) of the user the action was taken against, even after either account is later deleted. The IP address recorded with an audit event is anonymized (removed) after 30 days — matching the system-log window above — so only the accountability fields described here are retained beyond that point. This limited retention is based on our legitimate interest in maintaining a tamper-evident security record.
• Purchase & Billing Records: Records of your transactions (such as items purchased, amounts, dates, currency, and Stripe identifiers) are retained as needed to provide receipts and support and to meet our tax, accounting, and legal obligations — typically for several years — and a limited form of these records may be kept even after your account is deleted where the law requires it. So that a retained transaction record stays correctly attributable to the person who made it, each record also stores, as of the time of that purchase, your account identifier, username, display name, and email address, and those fields are kept with the record even after your account is deleted. This is necessary because usernames and email addresses become available for re-registration after an account is deleted, so without them a retained financial record could not be told apart from a later, unrelated account. This limited retention is based on our legal obligation to keep accurate financial records and our legitimate interest in maintaining an accurate transaction history.

7. Children's Privacy (COPPA)

The Service is not intended for or directed to children under the age of thirteen (13). We do not knowingly collect or solicit personal information from children under 13. Registration requires users to confirm that they are at least 13 years old.

If we learn that a registered user is under 13 — or that we have inadvertently collected personal information from a child under 13 — we will promptly disable and delete that account along with the associated personal information. If you believe a child under 13 has registered an account, please notify us at [email protected].

8. International Data Transfers

Our databases and hosting servers are located in the United States. If you access the Service from the European Economic Area (EEA), United Kingdom, Canada, or other international regions, please be aware that your personal information will be transferred to and processed in the United States, where privacy protections may differ from your home country.

9. Your Rights and Choices

Depending on your jurisdiction, you may have rights under applicable consumer privacy laws:

• Access and Portability: You may request a copy of the personal information we hold about you.
• Correction: You can correct or update your username, password, email, display name, and bio in your Profile settings at any time.
• Deletion: You can request permanent account deletion via your settings.
• Opt-Out: We do not sell your data or use it for targeted behavioral ads. The one limited exception is the ad-conversion measurement described in "Disclosures of Information" above — you can turn this off at any time using the "Do Not Sell or Share My Info" link in the site footer, and we honor the Global Privacy Control signal automatically.

To exercise any of these rights, or to appeal a request decision, please contact us at [email protected]. We will verify your identity before processing your request.

California Residents — "Shine the Light." California Civil Code § 1798.83 ("Shine the Light") permits California residents to request information about a business's disclosure of personal information to third parties for those third parties' own direct-marketing purposes. We do not disclose your personal information to third parties for their direct marketing, so there is nothing to report under this law. You may still contact us at [email protected] with any questions.

"Do Not Track" and Global Privacy Control signals. Some browsers offer a "Do Not Track" (DNT) or Global Privacy Control (GPC) setting. We do not serve targeted/behavioral advertising, and the only third-party sharing we do is the limited, pre-sign-in ad-conversion measurement described above. We honor the Global Privacy Control (GPC) signal for that measurement and for first-party telemetry: if your browser transmits a GPC signal, we skip the ad-conversion tool entirely and anonymize or discard telemetry events for your session. You can also opt out manually via the "Do Not Sell or Share My Info" footer link. We do not respond differently to standard "Do Not Track" (DNT) headers. The third-party YouTube embeds you choose to play are governed by Google's own policies.

10. Security Safeguards

We implement administrative, technical, and physical safeguards to protect your personal data. Passwords are stored in hashed form, database access is restricted, and data is transmitted using HTTPS/TLS between users, our web/API infrastructure, and supported third-party service APIs where applicable. However, direct messages and chat messages are not end-to-end encrypted, and authorized administrators and moderators may access them as described above. No database, application, or internet transmission can be guaranteed to be 100% secure.

11. Changes to This Policy

We may update this Privacy Policy as our features, practices, or legal requirements change. When updates occur, we will post the revised policy with a new "Last Updated" date. For material changes, we will provide notice through an in-product alert on login. We encourage you to review this policy periodically.

12. Contact and Complaints

If you have questions, complaints, or feedback about our privacy practices, please contact us at:

Email: [email protected]

Mailing Address: Caellum LLC, 4600 Powder Mill Road, Suite #450 #1043, Beltsville, MD 20705

← movietq.com — Play now — it's free