Privacy Policy

Kernel ("Kernel," "we," "our") is a movie recommendation and exploration website operated at kernel.film. This policy explains what information we collect, why we collect it, and how we handle it. We designed Kernel to collect as little personal data as possible.

1. Information we collect

When you create an account, we store:

• Email address — used as your login identifier and to contact you if necessary about your account.
• Password — never stored in plain text. Passwords are hashed using bcrypt before being written to our database.
• Watchlist — the list of movie IDs you save to your account.
• Essential session cookie — a single signed, HTTP-only cookie used to keep you logged in. It contains only your user ID and expires after 30 days.

We do not use advertising trackers, third-party analytics, fingerprinting, or marketing pixels. Kernel has no ads.

2. How we use your information

We use the information above only to:

• Authenticate you and keep you logged in.
• Save and display your watchlist.
• Respond to support requests you send us.
• Protect against abuse and keep the service working.

We do not sell, rent, or trade your personal information to anyone, ever.

3. Third-party services

Kernel relies on a small number of providers to run:

• TMDb — movie metadata, posters, and backdrops are sourced from The Movie Database. When your browser loads posters, TMDb receives standard image-request information (such as your IP address). We do not send your account information to TMDb. Kernel uses the TMDb API but is not endorsed or certified by TMDb.
• Hosting — Kernel is hosted on Railway, which processes standard server logs (IP address, request path, timestamp) to operate the service.

4. Cookies

We use exactly one cookie: a strictly necessary session cookie used to keep you signed in. It is HTTP-only, signed, and marked Secure in production. We do not use tracking or advertising cookies.

5. Data retention

We keep your account information for as long as your account is active. If you ask us to delete your account, we will remove your email, password hash, and watchlist from our database.

6. Security

Passwords are hashed with bcrypt. Traffic is served over HTTPS in production. Session cookies are signed and HTTP-only. No system is perfectly secure, but we take reasonable steps to protect your data.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email us at the address below.

8. Children

Kernel is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you.

10. Contact

Questions or requests related to this policy can be sent to will.nellis@gmail.com.