Effective date: August 28, 2026
Shortlist ("we", "our", or "us") operates the Shortlist mobile application. This Privacy Policy explains what we collect, why, who it is shared with, and how long we keep it.
You can sign in with your phone number, Apple, or Google. Phone sign-in stores your phone number with our authentication provider so it can send and verify one-time codes. Apple and Google sign-in provide a stable account identifier and may provide your email address. Sign in with Apple also passes your name if you choose to share it; if you use Apple's Hide My Email feature we only ever receive a private relay address. We never receive or store a password. We use this information to create and secure your account, and never for marketing.
You may also set a username, display name and profile photo. Profile photos you upload are stored in our hosted object storage.
We store the films and shows you rate, mark as watched, add to your watchlist, or place on a list, along with when you did so. We also store the streaming services and region you tell us you have, so we can filter recommendations to what you can actually watch. This is the data that makes the app work.
Shorty is the in-app AI assistant. We store your chat history so you can return to past conversations, along with any facts Shorty records about your taste at your request. You can delete individual chats, and deleting your account deletes all of them.
If you use voice input, the audio you record is sent for transcription and is not retained after the transcript is returned.
If you import from Letterboxd, we read the public pages of the username you give us in order to match your ratings and watch history to titles in our catalogue. We store the resulting ratings and history against your account. We do not ask for, receive, or store your Letterboxd credentials.
Following another person, being followed, blocking and reporting all create records tied to your account. Reviews, review comments, shared lists, and messages, questions, spoiler flags, and emoji reactions in movie rooms are also stored with your account. Movie-room discussions persist so people who watch a title later can join the same room; they are removed when required by moderation or account deletion. If your profile is public, your profile, lists and activity are visible to other users. Shared-list links can also be opened by anyone who has the unguessable link until you revoke it. You can make your profile private at any time in the app.
If you choose to find friends from your contacts, phone numbers from your address book are sent only to perform the match. They are not written to our application database or retained after that request.
Paid subscriptions are processed by Apple through RevenueCat. We receive your subscription status and an anonymous purchase identifier. We never receive your payment card details.
We collect a device push token if you enable notifications, and in-app events (screens opened, features used, errors encountered) together with app version and platform. We use these to understand which parts of the app work and to diagnose failures.
We do not sell your personal information, and we do not share it for advertising. We share data only with the service providers needed to run the app:
We may also disclose information where we are legally required to, or where it is necessary to protect the safety of our users.
We keep your account data, library, lists and chat history for as long as your account is active. Some data is deleted on a schedule regardless:
You can export a copy of your Shortlist data at any time from the app, as a zip archive of CSV files. You can delete your account from the app; doing so removes your active profile, library, lists, chat history, and social connections from Shortlist. Our payment, hosting, and security providers may retain limited transaction, fraud-prevention, backup, or legal records under their own retention requirements. You can make your profile private, turn off notifications, and disconnect an import at any time.
If you signed in with Apple, you can also review or revoke this app's access in iOS Settings → your name → Sign in with Apple.
Shortlist is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.
We use encrypted connections (TLS), short-lived authentication tokens, and row-level security on our database so that one account cannot read another's data.
If we change this policy we will update the effective date above, and for material changes we will tell you in the app.
For questions about this privacy policy, contact us at privacy@shortlistapp.com.