Privacy Policy

1. What we collect

• Account data: email, username, display name, avatar and bio; name, email and picture from Google if you use Google sign-in. Sign-in details are required to create an account and contribute; you can browse without an account.
• Content and activity: ratings, reviews, posts, comments, lists, watchlists, home theater profiles, builds, photos, video links, follows and reactions. Public content is visible to visitors and search engines; private lists, watchlists, private setups and private builds have restricted visibility.
• Notifications: preferences, messages, read status, delivery records and browser-notification registration details if enabled.
• Security and support: sign-in requests, device and session history, IP addresses, browser details, usage logs, moderation reports, content copies and decisions. Contact messages include your name, email, message, IP address and browser details.

We collect this from you, your browser and activity, Google sign-in, other members’ reports and linked-video providers. Cookie and browser-storage details are in our Cookie Notice.

2. Why we use it

Our purposes and lawful bases under UK and EU data law are:

• Contract: managing your account, publishing your content, community statistics and service notifications.
• Legitimate interests: keeping the service secure and reliable, preventing abuse, moderating content and responding to enquiries.
• Consent: optional analytics, browser notifications and loading video players.
• Legal obligation: retaining or disclosing information when the law requires it.

Moderators decide reports. Strike counts can then automatically suspend posting for seven days at three strikes, or indefinitely at five; moderators and admins are exempt. Contact us to challenge a decision or request human review.

3. Who receives it

• Hosting and email: Amazon Web Services hosts HDIS and sends email; Google Workspace handles our mailboxes.
• Sign-in and security: Google provides Google sign-in; Cloudflare Turnstile receives IP and browser information for bot checks.
• Analytics: Google Analytics 4 receives IP and device information, page views and activity such as sign-ups, sign-ins, ratings and searches, subject to your cookie choices. How Google uses this data.
• Advertising: we are not showing Google AdSense ads yet. When enabled, Google may use data for ad delivery, measurement and personalisation, subject to your choices.
• Browser notifications: Google, Mozilla, Apple or Microsoft delivers encrypted notifications, depending on your browser.
• Videos: YouTube (Google), Vimeo and TikTok receive IP and browser information when you press play. We also send public video links to these providers to obtain creator credits. Facebook, Instagram and affiliate retailers receive your visit if you follow their links.
• Movie search: The Movie Database (TMDB) receives movie-search text, without your account details.

We do not sell personal information. Data is hosted in the United States; providers may process it in other countries. AWS's data-processing terms include standard contractual clauses and a UK addendum for international transfers. Contact us for information about transfer safeguards.

4. How long we keep it

• Logs: access logs for 90 days; other operational logs for 14–30 days.
• Sign-in records: code requests are cleared in the daily clean-up after 24 hours; device records after 90 days from expiry or sign-out.
• Notifications: 90 days; completed delivery records normally 30 days, or sooner if their notification is deleted.
• Browser registrations: normally cleared after 180 days disabled or inactive, or 30 days after the provider reports them gone. Pending or recent deliveries, and a still-active sign-in, can delay deletion.
• Account, content and preferences: while your account remains open, unless deleted earlier. Moderation records, contact emails and affiliate-click records have no fixed deletion period; we retain them as needed to resolve enquiries, review decisions and operate the service.

Scheduled clean-ups run daily, so deletion may follow the stated period rather than happen immediately.

5. Your choices and rights

Where applicable, you can request access, correction, erasure, restriction or a portable copy of your data, and withdraw consent at any time without affecting earlier lawful processing.

You can object to processing based on legitimate interests. Contact us using the address below to exercise your rights.

To delete your account, email privacy@howdoesitsound.io from your account address. We handle deletion manually, disabling the account and removing its data; allow up to 30 days.

Use Cookie Preferences in the footer to change analytics and ad-personalisation choices. Outside the EEA, UK and Switzerland, Do Not Track and Global Privacy Control turn off ad personalisation, not analytics. Inside those regions, with no saved choice, we treat these signals as refusal.

You can complain to your local supervisory authority, including the UK Information Commissioner's Office (ICO).

6. Children

HDIS is not intended for children under 13. If you believe a child has given us personal data, contact us to have it removed.

7. Contact