Privacy & Content Usage

Section 01

The approach: no accounts, no ad tracking

The catalogue can be read, searched, saved to and shared without creating an account and without giving an email address. There is no advertising network, no third-party analytics script, no session-replay recorder and no cross-site tracking pixel in this website. Nothing is sold, and no profile is built from what you watch.

This page lists exactly what is stored, where, and for how long — including the one identifier that does exist, which is a random value kept in a cookie so an anonymous watchlist can survive a page reload.

Section 02

What is stored in your browser

Key	Storage	What it holds	Lifetime
`cinemax:playback:<id>`	localStorage	Your position in a title (seconds watched, duration, the time it was written) so playback can resume on this device.	Until you clear site data or the player rewrites/removes it.
`cinemax:prism-intro:v1`	sessionStorage	A one-character flag meaning “the intro has already played in this tab”, so the animation does not repeat.	Until the tab is closed.
`session_id`	Cookie	A random UUID created by the server on your first watchlist request. It is the key for the anonymous watchlist rows belonging to this browser. It contains no personal data and is not linked to any account.	Up to one year, refreshed on use; cleared by clearing cookies.
`admin_token`	Cookie	Only for studio administrators who sign in: a signed, HTTP-only session token. Visitors never receive it.	24 hours, or until sign-out.
Service worker cache	Cache Storage	The application shell and static assets, so a repeat visit loads faster. It holds no catalogue data and no personal data.	Until the worker updates or you clear site data.

The earlier version of this site cached the whole catalogue in sessionStorage. That copy is now deleted on sight when the page loads, because it could keep a title visible after it had been deleted in the studio. The catalogue now lives only in memory for the current page.

Section 03

Cookies

Two cookies can exist, both first-party and both set by this deployment:session_id (anonymous watchlist key, one year) and admin_token (studio sign-in only, 24 hours, HTTP-only). No cookie is set by an advertising or analytics service, and none is shared with a third party.

Blocking cookies does not stop the catalogue from being read or searched; it only stops an anonymous watchlist from being remembered on the server.

Section 04

What the server receives

Requests: Page, API and image requests reach this deployment's own server, and its hosting provider logs them the way any web server does (address, path, time, user agent).
Watchlist: The title ids you save are stored against the anonymous session id. No name, email, address or payment detail is requested or stored.
Studio sign-in: Administrators authenticate with credentials held by the deployment; the session token is a signed JWT in an HTTP-only cookie, never in page JavaScript.
Not collected: No advertising identifiers, no precise location, no contact list, no device fingerprints, no cross-site identifiers.

Section 05

Third-party hosts your browser may contact

The page itself is served from this deployment, and both typefaces are self-hosted, so a normal page view contacts no third party for fonts or scripts. Your browser can still reach an external host in these cases:

Poster and backdrop images that are hosted externally — typically image.tmdb.org — load directly from that host. It sees your address and user agent for the image request, as any image host would.
A trailer you press play on may be an official YouTube or Vimeo embed, or a stream from the platform that holds the rights. That host's player then applies its own cookies and policies.
“Where to watch” links open the platform's own site or app. Nothing about you is sent with the link beyond the URL itself.
A share sheet hands the title to the app you choose; from that point the receiving app's terms apply (below).

No analytics, tag manager, ad, social embed script, A/B testing service or error-reporting SDK is loaded from a third party on any page of this site.

Section 06

What the Android application adds

The Android application is a shell around this same website. It adds no analytics library and no advertising SDK. What it does add:

It requests the INTERNET and ACCESS_NETWORK_STATE permissions, nothing else — no location, contacts, camera, microphone or broad storage access.
It keeps the screen awake only while a video is actually playing, and drops image and page caches when the system reports memory pressure.
A small bridge lets the page tell the app when playback starts or stops, when a player goes fullscreen, and when you ask to share a title.
Sharing is performed by Android's own share sheet. The app does not know, and cannot know, which app you pick, and it does not report it anywhere.
If a title is shared with an image or a trailer file, that file is written to the app's private cache directory and handed to the chosen app through a read-only, expiring permission. Nothing is written to shared storage.

Section 08

Retention and deletion

Playback positions live only in your browser. Clearing site data deletes them; signing out of nothing is required because there is no account.
An anonymous watchlist lives on the server, keyed by the session cookie. Clear that cookie and the key is gone; the orphaned rows are no longer reachable from your browser.
Server logs follow the hosting provider's retention policy and are used for operating and protecting the service.
Temporary files created for sharing are cache files in the app; Android may reclaim them at any time, and they are cleared with the app's cache.

Section 09

Your choices and your rights

You can clear the two storage keys and the two cookies at any time from your browser's site-data settings.
You can block the service worker by clearing site data; the site still works, it just loads slightly slower next time.
You can block third-party images (for example by blocking image.tmdb.org) and the catalogue will show its placeholders instead.
If you need a watchlist entry removed server-side, send the session id you want removed — it is visible in your browser's cookie list — and it will be deleted.

Depending on where you live, you may have statutory rights to access, correct, delete or object to processing. Because this deployment holds no account, the practical route for most of them is to delete the storage keys and cookie described above; anything else can be raised through the contact route on Copyright & Intellectual Property.

Section 10

Children

This website is not directed at children and does not knowingly collect information from them. It asks for no personal details at all, so the only data a child could generate is the same anonymous watchlist key every visitor gets. Some titles in a catalogue can be unsuitable for younger viewers, and that rating information comes from the studio record rather than from this site.

Section 11

Changes to this page

If a new storage key, cookie, third-party host or app permission is added, it is added to this page in the same change. The review date at the top records the version you are reading.