Privacy
The short version: Personal Showcase keeps what you put in, your e-mail address to sign you in, and nothing else. No ads, no analytics, no trackers, nothing sold or shared for marketing.
Who runs it
Personal Showcase (https://personalmedialibrary.com) is a free, non-commercial, invite-only website run by one individual in Ontario, Canada. It earns nothing. Your personal information is handled according to the principles of Canada's federal privacy law, PIPEDA. The person in charge of the protection of personal information is the site's owner, reachable at hello@personalmedialibrary.com. Write there with any question or request about your information.
Last updated 3 October 2026.
What is kept, and why
- Your e-mail address, to send you sign-in codes and to know your account. Nothing else is ever mailed to you.
- What you put in your library: the titles you add; Owned, Seen and Want, with the dates; your ratings, notes and reviews; your window; your name, shop look, rating setup, streaming country and services. This is the service itself. It is private: other people cannot see it.
- Your sessions: when you signed in, when you were last here, and the kind of browser (for example "Firefox on Windows"), so you can see where you are signed in and sign out anywhere. The session cookie holds a random number; the server keeps only a scrambled (hashed) copy of it.
- Sign-in codes and invites: kept only as hashes, and codes only for minutes. An invite remembers who made it and, if it was made for one address, that address.
- Short-lived server logs: the IP address, time and page of each request, to keep the site running and to stop abuse. They are deleted after 30 days at most. Rate-limit counters are kept in memory only.
- That you ticked "I am 16 or older" when you made your account.
Nothing is collected about you from anywhere else, and nothing is used for advertising or profiling.
One cookie
The site sets one cookie, the session cookie that keeps you signed in. It is strictly necessary, so there is no cookie banner. There are no advertising, analytics or third-party cookies. Your browser also remembers a few display choices (the CRT effects, the catalogue's genre and decade) in its own local storage; those never leave your device.
Who else handles it
- DigitalOcean hosts the server and its backups, in its Toronto data centre (Canada).
- Resend sends the sign-in mail. It receives your e-mail address and the message with the code. Resend is based in the United States.
Both handle your information only to provide their service to this site. Your information may be stored or processed outside your province or outside Canada, where the law may differ.
The data sources
To find titles, covers and details, the server asks TMDB, TVmaze, MusicBrainz and the Cover Art Archive, ListenBrainz, Open Library, IGDB (Twitch), Wikipedia and Wikidata (listed on Credits). It asks them about titles (a name, a year, an id), never about you: no personal information is sent to them. Cover pictures are loaded by your browser straight from those sources' image servers, so, as with any picture on the web, they see your IP address and browser when you view one.
How long
Your account and library are kept until you delete them. Deleting your account (on the Account page) removes your account, library, ratings, notes, reviews, settings and sessions at once; copies in the server's backups disappear as the backups are replaced, within 30 days. Titles stay in the shared catalogue, which holds nothing about who added them.
Your rights
- See and take it: "Export my data" on the Account page gives you everything you put in, as a file (and your watched films in Letterboxd's format).
- Correct it: change anything in the app; your name is on the Account page.
- Delete it: "Delete my account" on the Account page.
- Ask: what is held about you, how it is used, or to complain: write to hello@personalmedialibrary.com. You will get an answer within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
Keeping it safe, and if something goes wrong
The site is served only over HTTPS, has no passwords to steal, keeps secrets only as hashes, and limits how fast anyone can try codes. If a breach ever puts your information at real risk of significant harm, you will be told by e-mail as soon as possible, together with the Privacy Commissioner of Canada (and Quebec's Commission d'accès à l'information for people in Quebec), and every incident is recorded.
Age
You must be 16 or older to have an account. If you believe someone younger has made one, write to the contact above and it will be deleted.
Changes
If this policy changes, the date at the top changes too, and anything that matters is announced on the site before it applies.