Privacy Policy

Last updated: July 10, 2026

This Privacy Policy explains how Recommendly("we", "us") collects, uses and protects your personal data when you use rcmndly.com (the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.

1. Data controller

The data controller is Adam Pivarník, a private individual based in the Slovak Republic, operating the Service as a personal project. For any privacy-related questions or requests, contact hello@rcmndly.com. A postal correspondence address is available on request by email, and full business identification (IČO/DIČ) will be published here once the Service is operated by a registered business.

2. What data we collect

  • Account data — email address, password (stored only as a secure hash by our authentication provider), username, display name.
  • Profile data you choose to add — profile photo, bio, country, birth date, favorite genres and titles, social media links. All of these are optional. Birth date is used only to confirm you meet the minimum age (16).
  • Content — recommendation lists you create and recommendations submitted to them (title, optional name and note of the person recommending), and any titles you add to your personal library.
  • Feedback — if you send feedback through the in-app widget, we store your message, the page you were on, and (if you provide it) your email, so we can fix issues and reply. Providing an email is optional.
  • Technical data — essential authentication cookies, and IP addresses processed transiently for rate limiting and abuse prevention. We do not keep IP-based browsing logs.

People who send you recommendations do not need an account. If they enter a name, it is stored with the recommendation; it can be any name they choose.

3. Why we process your data

  • Providing the Service (account, lists, recommendations) — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Optional profile details (birth date, favorites, photo, bio) — legal basis: your consent (Art. 6(1)(a) GDPR). You can remove them at any time in Settings; that withdraws the consent.
  • Handling feedback you send and security, rate limiting and abuse prevention — legal basis: legitimate interest (Art. 6(1)(f) GDPR) in fixing bugs and keeping the Service available and safe.

We do not use your data for profiling or automated decision-making, and we do not show ads.

4. What is public

Your public profile (username, display name, photo, bio, favorite genres and titles, social links, country) and your public lists are visible to anyone with the link. Your birth date is never shown publicly. Recommendations you receive are private by default— they appear on your public profile only if you explicitly enable "Public recs" for a list, and you can turn that off again at any time.

5. Cookies

We use only strictly necessary cookies: the session cookies set by our authentication provider (Supabase) to keep you signed in. We use no analytics, advertising or tracking cookies, which is why you don't see a cookie banner. If this ever changes, we will update this policy and ask for consent where required.

6. Who we share data with

We do not sell your data. We use the following processors to run the Service:

  • Supabase (supabase.com) — database, authentication and file storage.
  • Vercel (vercel.com) — application hosting and content delivery.
  • Resend (resend.com) — sends the operator a notification when you submit feedback; if you include an email address, it is part of that message.
  • Title, game and place search providers (TMDB, Apple iTunes Search, Google Books, OpenLibrary, RAWG, Wikipedia, Steam, OpenStreetMap/Photon & Nominatim) — only the search terms you type are sent to these services, never your identity.
  • Google Favicon service — used to display logos of stores and streaming services; your browser requests these images directly from Google.

Some processors are located in the United States. Where personal data is transferred outside the EU/EEA, it is safeguarded by the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), or by an equivalent adequacy mechanism where the processor is certified for one.

7. How long we keep your data

We keep your data for as long as your account exists. When you delete your account (Settings → Delete account), your profile, lists, received recommendations, library, uploaded photos and any feedback you submitted are permanently deleted immediately — there is no retention period or backup restoration of deleted accounts on our side.

8. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15),
  • rectify inaccurate data (Art. 16) — most of it directly in Settings,
  • erase your data (Art. 17) — self-service via Settings → Delete account,
  • restrict processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interest (Art. 21),
  • withdraw consent for optional data at any time (Art. 7(3)).

To exercise any of these rights, email hello@rcmndly.com. We will respond within one month.

You also have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk, or with the authority in your country of residence.

9. Children

The Service is not intended for children under 16, and registration requires you to confirm you are at least 16 (and, if you provide a birth date, it is checked against this minimum). We do not knowingly collect data from children under 16; if we learn that we have, we will delete the account.

10. Security

Data is transmitted over encrypted connections (HTTPS), passwords are stored only as secure hashes, and database access is protected by row-level security so that private data is only readable by its owner.

11. Changes to this policy

We may update this policy from time to time — for example if the Service adds new features or changes providers. We will post the new version on this page and update the date above. Significant changes will be communicated by email or in the app.