./privacy▎

nextep is run by one person. Questions, requests and complaints: nikit238@gmail.com.

Your account: name, username, email address, a bcrypt hash of your password (never the password itself), your interface language, an avatar if you have one, and the dates the account was created and last changed.

Your library: the shows you added, your ratings, and the seasons you marked as watched.

Your session: a record that keeps you signed in.

Tokens: when you confirm your email address or reset your password, a single-use token tied to that address is stored until it is used or expires. Password-reset tokens expire after an hour.

If you sign in with GitHub or Google: your account id at that provider and the tokens nextep needs to complete the sign-in, plus the name, email address and avatar the provider hands back. If you only ever use an email and password, none of this exists.

That is everything. nextep collects nothing else about you.

To run your account and show you your library. Your email is used to confirm your address, to let you reset your password, and, if necessary, to contact you about your account. Nothing else.

No analytics. No advertising. No tracking pixels. No profiling. There is no third-party analytics code on this site at all.

Your data is not sold, rented, or handed to anyone for marketing.

Two: a session cookie that keeps you signed in, and NEXT_LOCALE that remembers your language.

Both are strictly functional — the site cannot work without them, and neither one tracks you. That is why there is no cookie banner.

Email: confirmation and password-reset emails are sent through Resend, which processes your email address in order to deliver them.

Sign-in providers: if you press the GitHub or Google button, you are sent to them to sign in, and they tell nextep who you are. If you don't press it, they get nothing.

Posters: show posters load in your browser directly from TMDB's image servers, so TMDB can see your IP address and browser when a poster loads.

Hosting: the app and its database run on a rented virtual server.

Backups: copies of the database are made regularly and stored off the server.

Trending data: Reddit and the language model that counts show mentions never receive any of your data — they only process public Reddit posts.

Your data is kept for as long as your account exists.

Backup copies that were already made can still contain your data after the account is gone, until those copies are removed.

Write to nikit238@gmail.com and your account will be deleted: the account and everything attached to it — library, ratings, watched seasons, sessions, and any linked GitHub or Google connection — is removed from the live database. Any unused confirmation or password-reset token expires on its own shortly after.

Backup copies made before that will still contain your data until those copies are removed.

You can also ask what is stored about you, or ask for it to be corrected.

This policy changes as the project changes. The date above tells you when it was last updated.

nikit238@gmail.com