Terms and privacy
Terms & Conditions
Last updated 2026-10-04
1. Introduction
Scare Scale provides AI‑assisted horror movie ratings, user reviews, and related platform features. By accessing or using Scare Scale, you agree to comply with these Terms & Conditions and all applicable laws. If you do not agree, you must discontinue use of the platform.
2. Accounts & Authentication
User accounts are securely stored and authenticated through Supabase. You are responsible for maintaining the confidentiality of your login credentials and for all activity under your account. Personal identifiers such as your email address are required for account integrity, security, and GDPR‑compliant verification processes. These identifiers cannot be anonymised without deleting the entire account.
3. User‑Generated Content
Reviews, ratings, and display names submitted by users are publicly visible. You retain ownership of your content but grant Scare Scale a non‑exclusive, worldwide licence to display, distribute, and store this content as part of the platform. If you delete your account, your reviews and display name may remain visible to preserve platform continuity, but they will no longer be associated with personal account data.
4. Platform Infrastructure
Scare Scale operates using Supabase for authentication and data storage, AWS for media and infrastructure services, Vercel for hosting, deployment and anonymous page-view analytics, Resend for sending notification emails, and Umami for anonymous usage analytics. By using the platform, you acknowledge that your data may be processed by these providers in accordance with their respective privacy and security policies. All providers are selected for their strong compliance standards, including GDPR alignment.
5. Watchlists & Emails
Signed-in users can save films to a private watchlist. Your watchlist is only visible to you. We offer two optional emails, both off by default and only sent if you turn them on: watchlist emails, which tell you when films on your watchlist come out and remind you about them three months later if you haven't rated them, and weekly picks, one email a week with new horror releases and recommended films that is the same for everyone who receives it. You can turn either on or off at any time in Settings, and every email includes a link to stop it, which takes effect straight away. Turning them off does not affect your watchlist or account. Essential account emails, such as sign-up confirmation and password resets, are sent regardless of these settings.
6. Acceptable Use
You agree not to misuse the platform, including attempting to access restricted systems, reverse‑engineering platform features, interfering with platform functionality, or posting harmful, abusive, defamatory, or illegal content. We reserve the right to remove content or restrict access for violations of these terms.
7. Termination
We may suspend or terminate accounts that violate these Terms & Conditions, compromise platform security, or engage in fraudulent or abusive behaviour. Users may request full account deletion at any time by contacting info@scarescale.com. Account deletion is permanent and removes all personal data, including your email and authentication records. Public reviews and display names remain visible but are no longer linked to any identifiable account.
Privacy Policy
Last updated 2026-10-08
1. Overview
This Privacy Policy explains how Scare Scale collects, stores, and processes personal and non‑personal data. We are committed to transparency, user privacy, and compliance with the General Data Protection Regulation (GDPR).
2. Data We Collect
We collect account information (email, username, authentication metadata), user‑generated content (reviews, ratings, display names), your watchlist (the films you save and when you saved them), your email preferences (including when you turned each kind of email on or off, and when we last sent you weekly picks), and anonymous usage analytics. Personal data is used solely for account management, security, platform functionality and, where you have asked for them, notification emails. If you sign in with Google, Google sends us your email address, your name and a link to your profile picture, and never your Google password. We use your first name as your starting display name, which is public next to your ratings, and keep the rest with your account. You can also rate a film without an account. Your browser then keeps a random identifier so your ratings can be changed or moved onto an account later, and the rating is shown as Anonymous. To stop the same person rating a film more than once, we keep a one-way, salted fingerprint of your IP address with each anonymous rating for 30 days. We never store the address itself, and the fingerprint can't be turned back into it. We do not collect unnecessary personal information.
3. Anonymous Tracking
We collect anonymous behavioural analytics to understand feature usage, improve platform performance, and support product development, using Vercel Web Analytics and Umami. They count page visits and actions such as searches, ratings, shares and sign-ups, along with what the action was about: the film or list involved and the words searched for. Before a search is sent, anything that looks like an email address, phone number or web link is removed and the words are shortened. They set no cookies, store nothing on your device, do not keep IP addresses and never receive your email, name, account ID or review text. This data is aggregated, non‑identifiable, and cannot be used to determine individual user identity.
4. How Data Is Stored
All account and platform data is securely stored in Supabase, which provides encryption, access control, and GDPR‑aligned data handling. Media assets and supporting infrastructure may be processed through AWS. Deployment, caching, and edge delivery are handled by Vercel. All providers maintain industry‑standard security and compliance certifications.
5. Data Sharing
We do not sell, rent, or share personal data with third parties. The only data processors involved are Supabase, AWS, Vercel, Resend (which sends notification emails on our behalf, and receives only your email address and the content of the email) and Cloudflare (which checks that sign-ins and sign-ups come from a person rather than a bot), which are required to operate the platform. These providers act under strict contractual and GDPR‑compliant data‑processing agreements. Signing in with Google is optional: Google confirms who you are under its own privacy policy, learns that you signed in to Scare Scale, and receives nothing else about what you do here. To open Google’s sign-in window, the sign-in page loads a script from Google, which may read or set Google’s own cookies on its own domain; no other page loads it. To protect accounts from password guessing and fake sign-ups, the sign-in page also loads Cloudflare Turnstile, which looks at technical signals from your browser and device (such as your IP address and browser type) to tell people from bots. It doesn’t use cookies to track you or show you ads, and no other page loads it.
6. Emails
Watchlist emails and weekly picks are sent only with your consent, which you give by turning them on. Weekly picks contain the same recommendations for everyone and are not based on your activity. We record when you gave or withdrew consent for each, so we can show we only email people who asked. You can withdraw consent at any time in Settings or with the link in every email; we stop sending straight away. We don't use open or click tracking in these emails, and we never sell or share your email address. Links back to Scare Scale are tagged with the kind of email they came from, so our anonymous analytics can count visits from emails without knowing who you are.
7. User Rights
Under GDPR, you have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You can manage email notifications yourself in Settings, and remove films from your watchlist at any time. For anything else, including a copy of your data or full account deletion, email info@scarescale.com and we will respond within one month. Account deletion permanently removes all personal data, including your email, authentication records, watchlist and email preferences. Public reviews and display names remain visible but are no longer linked to any identifiable account.
Data Processing Addendum (DPA)
Last updated 2026-10-08
1. Purpose of the DPA
This Data Processing Addendum outlines how Scare Scale, as the data controller, ensures that all personal data processed by third‑party providers is handled in accordance with GDPR and other applicable data‑protection laws.
2. Roles and Responsibilities
Scare Scale acts as the data controller. Supabase, AWS, Vercel, Resend and Umami act as data processors, handling personal data strictly according to Scare Scale’s documented instructions. These processors are contractually prohibited from using personal data for any purpose other than delivering platform functionality.
3. Categories of Data Processed
Data processed includes authentication information (email, login metadata and, for people who sign in with Google, the name and profile picture link Google provides), IP addresses, device information, user‑generated content, watchlists and email notification preferences. Resend processes email addresses and email content only to deliver emails users have opted in to (release-day emails and weekly picks). Anonymous analytics may also be processed to support platform performance and security.
4. Security Measures
All processors implement industry‑standard security measures, including encryption at rest and in transit, access controls, audit logging, and data isolation. Scare Scale selects processors based on their compliance certifications and security posture.
5. Sub‑Processors
Supabase, AWS, Vercel, Resend and Cloudflare (bot protection on the sign-in page and the rating form) may use additional sub‑processors to deliver their services. These sub‑processors operate under strict contractual obligations and GDPR‑aligned data‑processing agreements.
6. International Data Transfers
Where data is transferred outside the UK or EU, processors rely on GDPR‑approved mechanisms such as Standard Contractual Clauses (SCCs) to ensure adequate protection.
7. Data Retention and Deletion
Personal data is retained only as long as necessary for platform functionality, security, and legal compliance. Users may request full account deletion by emailing info@scarescale.com. Upon deletion, processors remove all associated personal data in accordance with GDPR requirements.
8. Breach Notification
Processors must notify Scare Scale without undue delay if a personal‑data breach occurs. Scare Scale will then notify affected users in accordance with GDPR obligations.
Data Retention Policy
Last updated 2026-10-03
1. Retention Periods
Personal data is retained only for as long as necessary to provide platform functionality, maintain security, and comply with legal obligations. Authentication data is retained until the user deletes their account.
2. Backups
Supabase and AWS maintain automated backups for disaster‑recovery purposes. Deleted account data may persist in encrypted backups for a limited period before being permanently removed.
3. Review Data
User reviews and display names remain visible indefinitely to preserve platform continuity, even after account deletion. These records are no longer linked to any identifiable personal data.
4. Watchlists & Email Preferences
Watchlist entries are kept until you remove them or delete your account. Email preferences, including the record of when you turned each kind of email on or off and when weekly picks were last sent, are kept for as long as your account exists so we can show that emails were only sent with consent. Both are deleted with your account.
Lawful Basis for Processing
Last updated 2026-10-08
1. Contract
Processing necessary for account creation, authentication, and delivery of platform features is carried out under Article 6(1)(b) GDPR — performance of a contract.
2. Consent
Release-day emails and weekly picks are sent under Article 6(1)(a) GDPR — consent. Both are off by default and only sent once you turn them on. You can withdraw consent at any time in Settings or from any email.
3. Legitimate Interests
Anonymous analytics, platform security (including the bot check on the sign-in page and rating form, and the IP fingerprint that limits anonymous ratings), fraud prevention, and service optimisation are processed under Article 6(1)(f) GDPR — legitimate interests.
4. Legal Obligations
Certain processing activities, such as security logging and fraud prevention, may be required under Article 6(1)(c) GDPR — compliance with a legal obligation.
Security Measures
Last updated 2026-02-16
1. Encryption
All personal data is encrypted in transit and at rest using industry‑standard encryption protocols.
2. Access Controls
Access to personal data is restricted to authorised personnel and protected by role‑based access controls.
3. Monitoring & Logging
Supabase, AWS, and Vercel provide audit logging, intrusion detection, and automated monitoring to protect platform integrity.
Children’s Data
Last updated 2026-02-16
1. Age Restrictions
Scare Scale is not intended for users under the age of 16. We do not knowingly collect personal data from children.
2. Parental Requests
If you believe a child has created an account, contact info@scarescale.com and we will remove the account in accordance with GDPR requirements.
Contact & Complaints
Last updated 2026-02-16
1. Contacting Us
For data‑protection enquiries, account deletion, or GDPR requests, contact info@scarescale.com.
2. Regulatory Complaints
Users in the UK may lodge complaints with the Information Commissioner’s Office (ICO) if they believe their data has been mishandled.