Privacy
Last updated 1 September 2026.
Not yet reviewed by a lawyer. This describes the software honestly and is accurate as of the date above, but it has not been through counsel. That review is required before COUCH is offered to households outside the author’s own.
The short version
COUCH works out who in your household watched what, so it can answer what to watch next. That requires knowing things about your family that are nobody else’s business. So: your viewing data is never sold, never shared with advertisers, and never leaves the product in a form that identifies you or your household.
What is stored
- Your account — email address and a hashed password. Passwords are hashed with bcrypt and cannot be read back, by us or anyone else.
- Profiles — the display names you choose for people in your household, and for a child profile an optional birth date used only to sort what is age-appropriate.
- Watch events — what was played, when, on which device or room, from the sources you connect. These are append-only: corrections add a new record rather than rewriting history, so the trail of what was inferred and what a human fixed stays intact.
- Your judgements — ratings, reactions, ownership assignments, and the appropriateness verdicts you set for your household.
- Connection credentials — tokens for the services you link (for example Trakt) are encrypted with AES-256-GCM before being written to the database, and are never included in an export.
What is not collected
No advertising identifiers. No third-party analytics or tracking pixels. No cross-site tracking. There is no ad network in this product and no plan to add one — the money is never allowed to touch what the app recommends.
Children
Child profiles are created by a parent, are scoped to the household, and are never public. Children do not sign in and have no account, no password, and no friends list. A child profile holds a display name and, optionally, a birth date. The kid screen shows only titles an adult in the household has explicitly approved.
Who else sees anything
| Service | What it receives |
|---|---|
| TMDB | Title lookups (a show or film name, or its TMDB id). Not your identity, not who watched. |
| Trakt | Only if you connect it. You authorise it directly on Trakt; we receive the watch history you already keep there. |
| Home Assistant | Your own server on your own network. COUCH reads from it; nothing about it is sent outward. |
| Anthropic | Only when a recap is generated, and only the series name, the season and episode number you stopped at, and public episode summaries. No names, no profiles, no household identity. |
| Railway | Hosting and the database. Standard infrastructure access. |
| Cloudflare R2 | Encrypted nightly database backups, kept 30 days and then deleted. |
What you can do about it
- Take it with you. An owner can download everything the household ever produced as one JSON file, from the Household screen. Sync credentials are deliberately excluded.
- Delete it for good. An owner can delete the household from the Household screen. This removes every row it produced — watch history, profiles, judgements, and the encrypted connection tokens — in a single transaction. There is no soft delete and no recovery. An automated test creates a household, fills every table in the schema, deletes it, and asserts nothing is left.
- Correct it. Any inferred attribution can be overruled by a person, and your correction is permanent — the engine never overwrites it.
Backups are the one exception to immediate deletion: a deleted household may persist in an encrypted backup for up to 30 days before that backup expires.
Contact
Questions, or a request to see or remove your data: contact the household owner who invited you, or the operator of this installation.