Personal data (hereinafter referred to as "data") will only be processed by us to the extent necessary and for the purpose of providing a functional and user-friendly website, including its contents and the services offered there.
Per Art. 4 No. 1 of Regulation (EU) 2016/679, i.e. the General Data Protection Regulation (hereinafter referred to as "GDPR"), "processing" refers to any operation or set of operations such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or combination, restriction, erasure, or destruction performed on personal data, whether by automated means or not.
This privacy policy is intended to inform you in particular about the type, scope, purpose, duration, and legal basis for the processing of such data either under our own control or in conjunction with others. We also inform you below about the third-party components we use to optimize our website and improve the user experience, which may result in said third parties also processing data they collect and control.
Our privacy policy is structured as follows:
I. Information about us as controllers
II. Rights of users and data subjects
III. Information about data processing
The party responsible for this website (the "controller") for purposes of data protection law is:
E-Mail: contact@mirulist.app
The controller’s data protection officer is:
E-Mail: contact@mirulist.app
With regard to the data processing described in more detail below, users and data subjects have the right:
In addition, the controller is obliged to inform all recipients to whom it discloses data of any such corrections, deletions, or restrictions placed on processing the same per Art. 16, 17 Para. 1, 18 GDPR. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Nevertheless, users have a right to information about these recipients.
Likewise, under Art. 21 GDPR, users and data subjects have the right to object to the controller’s future processing of their data pursuant to Art. 6 Para. 1 lit. f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.
Your data processed when using our website will be deleted or blocked as soon as the purpose for its storage ceases to apply, provided the deletion of the same is not in breach of any statutory storage obligations or unless otherwise stipulated below.
MiruList uses localStorage and sessionStorage to provide the service and retain choices on your device. Stored data may include the sign-in token, display, sorting and filter preferences, search state, scroll positions, calendar views, collapsed sections, and your YouTube embed choice. Session storage also records whether a movie view has already been counted that day so it is not duplicated in aggregate statistics.
When you sign in through an external OAuth provider, MiruList briefly sets a technically necessary, HTTP-only cookie. It protects the sign-in flow against tampering and is deleted after the flow or expires shortly afterwards.
This storage is not used for cross-site tracking. It is required for requested features or secure operation. Where personal data is involved, the legal basis is Art. 6(1)(b) or (f) GDPR. Access to your device is based, where applicable, on Section 25(2)(2) TDDDG.
You can use MiruList without an account. If you create one, we store the username, e-mail address and password you provide, together with a one-way hash of that password; we never store the password itself. We also store the account settings you choose, such as your interface language, your content age limit and which parts of your profile are public. If you sign in through an external provider instead, we store that provider's name and your identifier with it rather than a password.
We store the time an account was created and last changed. We do not store the IP address you registered from.
To verify your e-mail address or let you reset a password, we store a one-way hash of the relevant token and its expiry, and delete it once it has been used or has expired.
The legal basis is Art. 6(1)(b) GDPR, as this processing is required to provide the account you requested. You can delete your account at any time; we then delete the associated data unless a statutory retention obligation applies.
MiruList lets you add films, vote, mark films as watched, rate them, write reviews and comment on films and movie nights. Where you do so, we store that contribution together with the member and account it belongs to, the display name and profile picture shown beside it, the time it was submitted, and any members you mention.
Who can see a contribution depends on the watchlist it belongs to and, for reviews, on the visibility you choose yourself: private, shared with people on your lists, or public. Reviews and watch history appear on your public profile only if you switch that on in your profile settings.
The legal basis is Art. 6(1)(b) GDPR, as these are the features the service exists to provide. We do not store your IP address alongside contributions.
If you send feedback through the in-app form, we store the score you gave and, optionally, a message. A name and e-mail address are optional and are stored only if you explicitly consent to it on the form, so that we can reply or send you a copy. Without that consent the feedback is stored without contact details.
The legal basis is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time under Art. 7(3) GDPR by contacting us.
If you write to us at the address given above, or use the contact form on this site, we use the data in your message to handle your enquiry. A message sent through the form is delivered to us by e-mail; it is not stored in the MiruList database. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or its preparation, and otherwise Art. 6(1)(f) GDPR, based on our interest in answering enquiries. We delete this correspondence once your enquiry has been dealt with, unless a statutory retention obligation applies.
For technical reasons, in particular to provide a secure and stable service, your browser transmits data to our hosting provider. These server log files may include your browser type and version, your operating system, the page you came from, the pages you visit, the date and time of access, and the IP address of the connection used. This data is processed by the hosting provider to deliver and secure the site; the MiruList application itself does not store it in its database or combine it with your account.
The legal basis is Art. 6(1)(f) GDPR, based on our interest in the stability, functionality and security of the service.
MiruList counts page and movie views in aggregate. It stores daily totals, page types or movie identifiers, and, for landing pages, at most the referring origin or a “direct” category. It does not store persistent visitor identifiers, individual browsing histories, or analytics cookies for this purpose. The legal basis is Art. 6(1)(f) GDPR, based on our interest in understanding general usage and improving the service.
MiruList obtains movie data, search results, and streaming availability server-side through The Movie Database (TMDB) API. Streaming availability is supplied by JustWatch through TMDB; MiruList does not establish a direct technical connection to JustWatch.
Posters, backdrops, and provider logos are loaded directly from TMDB media servers. TMDB therefore technically receives data including your IP address, browser information, request time, and the referring origin. The browser does not send the full MiruList page address. The legal basis is Art. 6(1)(f) GDPR and our legitimate interest in presenting the movie information you requested. See the TMDB privacy policy for details.
Links to TMDB or streaming services are opened only when you actively select them. The destination provider's privacy terms apply from that point.
We may embed movie trailers from YouTube using YouTube's privacy-enhanced domain. The video iframe is not loaded automatically. It is loaded only after you actively click the "Load from YouTube" button.
When the video is loaded, Google/YouTube may process personal data such as your IP address, device/browser information, the page visited, and playback interactions. If you are logged in to YouTube or Google, this data may be associated with your account. More information is available in Google's privacy policy: https://policies.google.com/privacy.
If you choose to remember your decision, we store this preference locally in your browser so future trailer embeds can be loaded without asking again on the same device/browser. This preference is not transmitted to us.
MiruList does not use advertising or Google Analytics and does not create user-specific analytics or advertising profiles.
Last updated: 14 September 2026.