Privacy

Who runs this

MediaPassport is run by Locke Werks at passport.lockewerks.com. It is invite-only. It tracks what you watch, read and listen to, and who you did it with. It does not show ads, sell data, run analytics, or recommend anything to you by algorithm.

What you give the app

• Your account: name, email address and password. The password is stored only as a hash. If you turn on two-factor sign-in, its secret and backup codes are stored with your account.
• What you track: the shows, films, books, podcasts and music you add, what you have finished and when, ratings, favourites, notes, verdicts, tags, lists, where you stopped, which streaming services you have, and anything you hide or snooze. Each watch also records where it came from (the app, a webhook, an import and which kind, or the API with the label the caller sent or the token's name) and, when that source was guessing rather than told, how sure it was.
• Other people you name: companions are names you type for the people you watch with, and a note can say who recommended something. They are not accounts, and nobody named is contacted.
• Connections you set up: API tokens (stored only as a hash and a short prefix), webhook addresses and their signing secrets, and, if you allow notifications, the push address your browser hands over, stored with the browser's full user-agent string, which names the browser, its version and your operating system.
• Imports: the rows of a file you import. They are cleared once an import succeeds. A failed import keeps them so it can be looked at. A preview you do not import can be discarded, and is deleted after three days if you leave it.

What is recorded automatically

• Sign-in sessions: the IP address and browser of each session. A session ends when you sign out, or about 30 days after you last used it. An ended session is deleted within about six hours.
• Web server log: each request's IP address, browser and the full address requested. A search is part of the address, so what you search for is in this log. The log starts a new file at 10 MB and deletes a finished file 30 days later, so at current traffic an entry lasts roughly 50 days.
• The app's own log is kept by the server with no time limit. It records counts from each background refresh and the ids of anything that failed, not titles or names. Lines written before September 24, 2026 also named the titles and artists being refreshed.
• Your time zone: the name of the zone your browser reports, such as America/Denver, so that “today” and whether something has aired follow your own calendar. It says roughly where you are, to the level of a region. It is replaced when you use the app on a device set to a different zone, unless you have chosen one in Settings. Accounts that have not reported one use UTC.
• A change log of edits to your library, so that connected tools can catch up. It holds what changed and when, not your IP address.

Cookies and your device

The only cookies are the ones that keep you signed in. They cannot be read by scripts and are only sent to this site. Darker mode, and choosing “Not now” on the two-factor reminder, are remembered in your browser's storage, and the app keeps some images and its own files on your device so it opens offline. Nothing on your device is used to track you.

Who can see it

You, with these exceptions. A list you mark as a household list can be seen by every account on this instance. Titles live in one catalogue shared by every account, so if another account tracks the same title, it sees the same part names, and any edition link made on that title along with its label, whoever made it. Linking editions searches every title added here from a catalogue such as TMDB, so a title another account added that way can turn up in that search. A title you added by hand only turns up for accounts that track it.

Nothing else you track is visible to other accounts. The people who run the server can reach the database, as with any service, and do not look through it.

What other services receive

To look things up, the server asks TMDB, TheTVDB, MusicBrainz, Cover Art Archive, Podcast Index, Audible and Audnexus for catalogue data, and fetches the podcast feeds you follow. Those requests carry a search term or an id and nothing else. None of these services is told who you are, that you have an account, or what you watched.

Show, film and book posters, and every cover in Up Next and your library, come through this server. Some artwork does not: podcast and album covers on a title's page, in search, Music, Upcoming and artist pages, podcast episode images, book covers while you search for a book, and posters inside lists load straight from the site that hosts them, such as TMDB, Amazon, Cover Art Archive or a podcast's publisher. Those sites see your IP address and which image was asked for, as any website would. Playing a podcast episode fetches the audio from its publisher.

If you turn on notifications, they are delivered by your browser's push service (Apple, Google, Microsoft or Mozilla, depending on the browser). Their contents are encrypted so only your device can read them. If you add a webhook, the address you gave receives the kind of change and the ids involved, not titles or names.

Where it is kept

On one server that Locke Werks administers. Traffic to it is encrypted.

How long it is kept

Your account and library are kept until you delete them. Records of delivered webhooks are removed after 30 days. Sessions and logs are covered above.

The database is backed up on the same server in two ways. Before each update to the app, a copy is taken, and the newest ten are kept. Separately, the server takes a weekly copy of the whole database and keeps the latest three, along with a continuous record of changes reaching back to the oldest of them, about three weeks. Something you delete stays in the weekly copies for about three weeks, and in the pre-update copies until ten more updates have happened.

Your choices

• Download your library from Settings, as a data file or a page you can read. The data file holds your history, companions, notes and verdicts, tags, lists, hidden items, titles you added yourself, services, podcasts and followed artists. The readable page holds your history, who you watched with, every title and where it stands, and your notes other than verdicts. Devices, tokens, webhooks and the change log are in neither.
• See what is stored and which services are connected under Settings, Your data.
• Edit or delete anything you tracked, revoke API tokens, remove webhooks and notification devices, and turn two-factor sign-in on or off. A token or webhook keeps working, even after a password change, until you revoke or remove it.
• Choose your time zone, or go back to following your device, under Settings, Time zone.
• Change your name, email address or password, or delete your account, under Settings, Account. Changing your password signs out your other devices, though one that already had a page open can keep working for up to five minutes.
• Deleting your account removes it and everything in it from the live database at once. That includes titles you added by hand, and podcasts you added from a pasted or private feed address, unless another account tracks them too, and edition links you made, unless another account tracks either title. A title another account tracks stays, with its part names, because it is in their library as well.

Children

MediaPassport is not meant for children under 13, and accounts are only created by invitation.

Changes

If this policy changes, the date at the top changes with it.

Contact

Questions or requests go to nyx@lockewerks.com.