Privacy Policy

1. Information we collect

Information you give us directly

• Account details: your email address, name, and a hashed version of your password. We never store your password in readable form.
• Taste preferences: genres you like, shows and films you've told us you enjoy, streaming services you subscribe to, how much time you typically have to watch, and your preferred delivery time.
• Feedback: the thumbs-up, thumbs-down, "seen it", "loved it", and "didn't like it" signals you send on each pick.
• Payment details: if you subscribe to Pro or Family, your payment method is handled entirely by Stripe. We receive a customer reference and subscription status but we do not store your card number, CVC, or billing address.

Information we collect automatically

• Usage data: timestamps of picks delivered, which picks you replaced, email open and click events (via Resend), and basic analytics on page visits.
• Device and connection data: your IP address, browser type, and operating system. This is logged by our servers for security and debugging, and retained briefly.

Information from third parties

• Google Sign-In: if you choose to sign in with Google, we receive your name, email address, Google account ID, and profile picture. We do not receive access to your Gmail, contacts, calendar, or any other Google service.

2. How we use your information

We use what we collect to:

• Generate your daily picks using Anthropic's Claude, informed by your taste profile and past feedback.
• Deliver those picks to you by email at the time you've chosen.
• Improve future picks as we learn which recommendations land and which don't.
• Process payments for Pro and Family subscriptions.
• Send transactional emails (verification, password reset, billing receipts).
• Investigate abuse, debug issues, and keep the service running.
• Comply with legal obligations when they apply.

We do not use your taste preferences or feedback to train third-party AI models. The content we send to Claude is used only to generate your picks in that moment, under Anthropic's commercial terms which prohibit training on API inputs.

3. Who we share it with

We share limited information with a small set of service providers who help us run Kueup. We do not sell your personal data. Ever.

We may also disclose information if we're legally required to (a subpoena, court order, or valid government request), or if necessary to protect the safety, rights, or property of Kueup, our users, or the public. If Kueup is ever acquired or merges with another company, your information may be part of that transfer — you'll be notified before anything changes.

4. Cookies and local storage

We use a small number of cookies and browser storage mechanisms, all of them strictly necessary to run the service:

• Authentication token (JWT): stored in your browser's local storage to keep you logged in. Cleared when you log out.
• Onboarding progress: temporarily stored in local storage while you complete setup, then cleared once your account is created.
• Replacement counter: a daily counter of how many pick replacements you've used, stored locally. Resets at midnight.

We do not use tracking cookies, advertising cookies, or third-party analytics that profile you across other sites.

5. How long we keep it

• Account data is kept for as long as your account is active.
• Pick history and feedback is kept while your account is active and is what makes your picks sharper over time.
• Server logs (IP addresses, request logs) are kept for up to 30 days for debugging and security.
• Billing records are kept for as long as required by applicable tax and accounting laws, typically seven years.
• When you delete your account, we remove your profile, preferences, pick history, and feedback within 30 days. Billing records and anonymised usage statistics may be retained where required by law.

6. Your rights and choices

Depending on where you live, you may have the right to:

• Access a copy of the information we hold about you.
• Correct information that's inaccurate or incomplete.
• Delete your account and associated data.
• Object to or restrict how we process your data.
• Port your data to another service.
• Withdraw consent at any time (where we rely on consent).
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at privacy@kueup.ai from the address on your account. We'll respond within 30 days. You can also unsubscribe from daily picks at any time using the link at the bottom of any email, or by adjusting your delivery preferences on the dashboard.

7. Your California privacy rights (CCPA / CPRA)

If you're a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives you specific rights regarding your personal information. This section describes those rights and how to exercise them, and applies in addition to the rights described in section 6.

Categories of personal information we collect

In the last 12 months, we have collected the following categories of personal information, as those categories are defined in the CCPA:

• Identifiers — your name, email address, unique user ID, and (if you sign in with Google) your Google account ID.
• Customer records — account credentials (hashed) and billing reference information.
• Commercial information — subscription status, billing history, and pick replacement activity.
• Internet or network activity — IP address, browser type, operating system, and logs of your interactions with the service (pages visited, picks received, feedback given, emails opened).
• Inferences — preferences and taste profiles we derive from your feedback to personalise future picks.

We do not knowingly collect sensitive personal information as defined by the CPRA (such as Social Security numbers, precise geolocation, biometric data, or information about your health, sex life, or racial origin). We do not collect personal information from children under 16.

Sources, purposes, and disclosures

The sources of this information (directly from you, automatically from your use of the service, or from third parties like Google), the purposes for which we use it, and the categories of third parties with whom we share it, are all described in sections 1, 2, and 3 of this policy. We disclose personal information only to the service providers listed in section 3, each of which is bound by contract to process information solely for the purposes we specify.

We do not sell or "share" your personal information

Because we don't sell or share your personal information, there is no "Do Not Sell or Share My Personal Information" link on our site — there's nothing to opt out of. If that ever changes, we'll update this policy and provide a clear mechanism for you to opt out before any selling or sharing begins.

Your CCPA rights

As a California resident, you have the right to:

• Know what personal information we've collected about you, the sources it came from, the business purposes for collecting it, and the third parties we've disclosed it to.
• Access a portable copy of your personal information, covering the previous 12 months by default or longer on request.
• Correct personal information we hold that is inaccurate.
• Delete your personal information, subject to the exceptions allowed by the CCPA (for example, we may retain information needed to complete a transaction, detect security incidents, or comply with a legal obligation).
• Limit the use of sensitive personal information — though since we don't collect any, this right has nothing to operate on.
• Opt out of sale or sharing — though again, we don't sell or share, so there's nothing to opt out of.
• Non-discrimination — we will never charge you a different price, give you a lower quality of service, or otherwise penalise you for exercising any of these rights.

How to exercise your CCPA rights

To submit a request, email privacy@kueup.ai from the address on your account, with "California Privacy Request" in the subject line and a clear description of what you'd like us to do. You can also delete your account directly from your dashboard at any time.

Verification. To protect your information, we need to verify your identity before acting on most requests. For logged-in users, emailing us from the address on file is usually enough; for higher-risk requests (like deletion), we may ask you to confirm specific account details. We'll respond to confirm receipt within 10 business days and fulfil or respond substantively within 45 days, with a possible 45-day extension if the request is complex (we'll tell you if so).

Authorised agents. You can designate someone else to submit a request on your behalf. We'll ask for written proof that you've authorised them, and we may still need to verify your identity directly.

Appeals. If we deny your request in whole or in part, you can appeal by replying to our response email. You can also file a complaint with the California Privacy Protection Agency at cppa.ca.gov or with the California Attorney General.

Shine the Light

California's "Shine the Light" law (Civil Code § 1798.83) gives California residents the right to request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

8. Security

We take security seriously. All traffic to Kueup is encrypted in transit using TLS. Passwords are hashed using bcrypt before they hit our database. Our servers are hardened, our secrets are stored outside of source control, and access to production systems is limited to the minimum number of people required to operate the service.

That said, no system is perfectly secure. If we ever discover a breach that affects your personal information, we'll tell you within 72 hours of discovering it, as required by applicable law.

9. International transfers

Kueup is operated from Brentwood, California, United States. Our servers are located in San Francisco, United States. Our service providers are based in the United States, the European Union, and other jurisdictions. If you access Kueup from outside those regions, your information will be transferred, stored, and processed in them. Where required, we rely on Standard Contractual Clauses or equivalent safeguards to protect those transfers.

10. Children

Kueup is not designed for, and is not directed to, anyone under the age of 13. We don't knowingly collect information from children under 13. If you believe a child has given us information, please contact us and we'll delete it promptly.

If you're between 13 and 18, you should only use Kueup with the involvement of a parent or guardian.

11. Changes to this policy

We'll update this policy from time to time as Kueup evolves. When we make material changes, we'll email all active users at least 14 days before the changes take effect and update the "last updated" date at the top of this page. Continuing to use Kueup after a change means you accept the new policy.

12. Contact us