MediaLog legal
Privacy Policy
Last updated August 20, 2026
This policy explains what information MediaLog handles, why it is needed, and the choices available to you. MediaLog is a strictly nonprofit service with no subscriptions, advertising, or sale of personal information.
1. Who We Are
MediaLog is a free media-journaling website operated as a nonprofit project by the operator of MediaLog. It lets people keep a wall of media they have experienced or want to experience, share a public profile, and interact with other public entries.
Privacy questions and requests may be sent to privacy@media-log.ca.
2. Information We Collect
| Category | Examples | How it is obtained |
|---|---|---|
| Account data | Email address, Supabase user identifier, authentication and session metadata | Provided when you request and use a magic link |
| Profile data | Username, display name, avatar, public-wall setting | Provided or changed by you |
| Media and social activity | Saved media, ratings, status, comments, wall order, featured entry, follows, likes, discussion comments, hidden entries, and reports | Created through your use of MediaLog |
| Search data | Search terms, selected media type, and selected provider result | Submitted when you search or add an item |
| Technical data | IP address for short-lived rate limiting, request time, browser and device data, security events, and ordinary server logs | Generated when your browser communicates with the service |
What we do not collect
MediaLog does not collect payment-card data, subscription or purchase data, contact lists, precise location, government identifiers, biometric data, or advertising profiles. MediaLog does not use user content for AI model training and does not use AI models to evaluate your account or content.
3. How and Why We Use Information
- Provide accounts, media walls, public profiles, search, and social features.
- Save the entries, comments, ratings, and privacy choices you request.
- Protect the service, enforce rate limits, investigate abuse, and respond to reports.
- Maintain, debug, and improve reliability without behavioural advertising.
- Comply with applicable law and valid legal requests.
Where GDPR or similar law applies, the legal bases are performance of the service you request, legitimate interests in operating and securing a nonprofit service, consent for optional public information, and compliance with legal obligations. MediaLog does not make decisions producing legal or similarly significant effects through automated processing.
4. Public Information
A public wall may show your username, display name, avatar, media entries, ratings, statuses, comments, likes, follows, and public discussion activity. Other people may copy or reshare information you make public. You can make your wall private and can mark an individual entry private. Search engines or archives may retain previously public content for a period outside MediaLog's control.
5. Service Providers and Media Sources
MediaLog uses third parties only where needed to operate the service or retrieve media information. They process information under their own terms and privacy notices.
| Provider | Purpose | Privacy information |
|---|---|---|
| Supabase | Authentication, database, and avatar storage | Supabase Privacy |
| Vercel | Production hosting, delivery, and operational logs | Vercel Privacy |
| Media search providers | TMDb, IGDB/Twitch, Spotify, MusicBrainz, Open Library, AniList, YouTube, BoardGameGeek, and TheAudioDB receive relevant search terms or metadata requests | External media requests |
Search requests are made from MediaLog's server and are not sent with your MediaLog email address. Cover art and avatars are loaded by your browser from external hosts, so those hosts can receive ordinary request data such as IP address, user agent, and the requested image URL.
7. Retention
- Account, profile, and wall data are retained until you delete them or request account deletion.
- Search responses may be cached for up to 15 minutes.
- Rate-limit identifiers normally expire when the applicable limit window ends.
- Reports may be retained as needed to investigate abuse and document enforcement.
- Hosting and security logs follow the retention settings of the production providers.
Deletion from active systems may not immediately remove encrypted backup copies, which expire under the relevant provider's backup schedule.
8. Your Privacy Rights
Depending on where you live, you may request access, correction, deletion, restriction, portability, or objection to processing. You may withdraw consent where processing is based on consent. Email privacy@media-log.cafrom your account address. MediaLog may request limited information to verify that the request concerns your account and aims to respond within 30 days, subject to lawful extensions.
EEA and UK
You may also complain to your local data-protection supervisory authority. You have the rights described in Articles 15 through 22 of the GDPR where they apply.
California
The CCPA generally applies to qualifying for-profit businesses and not to nonprofit projects. MediaLog nevertheless voluntarily offers California users the rights to know, correct, and delete covered personal information and to receive equal service when exercising those rights. MediaLog does not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics. An authorized agent may submit a request with proof of authority.
| California category | Collected examples | Business purpose and recipients | Sold or shared for advertising |
|---|---|---|---|
| Identifiers | Email, username, user ID, IP address | Authentication, security, hosting; Supabase and Vercel | No |
| Internet or electronic activity | Search terms, feature use, request and security logs | Service delivery, media search, security; hosting and selected search providers | No |
| Audio, electronic, or visual information | Optional avatar image | Profile display and storage; Supabase and viewers when public | No |
| Preferences and inferences | Media ratings, statuses, comments, likes, follows, and wall arrangement | Provide the journal and social features; Supabase and viewers when public | No |
| Sensitive personal information | Authentication session information; no password is collected by MediaLog | Account access and security; Supabase | No |
MediaLog has not sold or shared these categories for cross-context behavioural advertising in the preceding 12 months and does not knowingly sell or share personal information of users under 16.
9. International Processing
MediaLog and its providers may process information in Canada, the United States, the EEA, and other locations where they operate. Where required, transfers rely on recognized safeguards such as adequacy decisions or standard contractual clauses. Internet routing may also transit other countries.
10. Security
MediaLog uses passwordless, one-time email links, HTTPS in production, provider-managed encryption, row-level database security, restricted avatar storage, and authenticated API checks. No internet service can guarantee absolute security. Please report suspected unauthorized access to privacy@media-log.ca.
11. Children
MediaLog is not directed to children under 16 and does not knowingly collect their personal information. A parent or guardian who believes a child has created an account may contact MediaLog to request deletion.
12. Changes and Contact
Material changes will be posted here with a revised date and, where appropriate, shown in the service or sent by email. Questions, complaints, access requests, and deletion requests may be sent to privacy@media-log.ca. The person responsible for MediaLog's privacy practices reviews these requests.