What we know about you is almost nothing.

SceneF has no accounts, sets no cookies of its own, and runs no advertising and no third-party analytics. The one thing you can sign up for is mail, and an email address given for it — or a name typed into a group vote or a dare — is the only thing this site keeps that could name you. What follows is each kind of data the site keeps, what it is for, who else handles it, and how long it stays.

Your taste profile stays in your browser

Preferences — a home theater, liked genres, a time window — are stored in your own browser’s localStorage and appended to URLs as you browse. They never reach a database on our side; ranking happens per request and is forgotten when the response is sent. Sharing a personalized link shares those preferences with whoever you send it to, because they are literally in the URL — that is the whole mechanism. The board you chose and any screenings you have shortlisted for a plan are kept in the same place.

The ticket door counts crossings, not people

Every ticket link is a redirect on this site, so we can tell theaters how many readers we sent them. Following one sends you on to the theater’s box office or the ticket seller it uses — the theater’s own website where neither has a page for that show, and a SceneF page if the show has left the board — and writes one row: the time; the screening, its film and its theater; what kind of software followed the link (a person’s browser, an AI assistant fetching for a person, or a crawler or script) and, for the last two, a short label for which one, from a fixed list; a browser family from another fixed list, such as Safari on iOS; the referring site reduced to a name or a bare domain, never the page or its query string; the short source tag in the link’s address, if it has one; the affiliate program the link was credited to, if any; and whether the link had expired. All three kinds are written down alike. Links followed by SceneF’s own checking tools, or on a preview copy of the site, are forwarded and not written down.

No IP address, user-agent string, full referring address, cookie or identifier is stored, and nothing links one crossing to another. The rows are kept one per crossing, filed by day and then by month, with no end date — a record of the door, not of anyone who used it. The totals are public at /numbers.

The page you land on belongs to the theater or its ticketing company, and their privacy policy takes over at their door. No ticket link pays SceneF anything today: no affiliate program is live, and every link goes to the vendor unwrapped. If that changes, this line changes with it — the programs are named on /status in the same deploy that wraps the first link, and what appears on the board, and where, is never for sale either way. With none live, no network is named here, and none receives anything from a ticket link. Nothing about you rides along with a ticket link — not your email address if you have given us one, not a name — and there is no account, visitor ID or profile here to send.

We count doors, not people

Once per browsing session, your browser sends the site the address that referred you (or the campaign label on the link, if it has one) and the page you landed on, without its query string. Before anything is stored, the server reduces the referrer to a name or a bare domain, adds the time, the kind of software and a browser family, and stores that as one row, filed by day. That is the entire record: no visitor ID, no IP address, no cookie, and nothing that could connect one visit to another or a visit to a person. A flag in your browser’s session storage is what keeps it to once a session. It exists so we can tell theaters, honestly, where their audiences are coming from.

Agents and the API

When an AI assistant asks this site for showtimes — through the MCP server, the SceneF GPT or the open API — we receive only the request itself: the date, filters, and preference parameters it chose to send. We never see your conversation with the assistant, and we keep no record tied to you. An MCP tool call is answered and nothing about it is written down on our side. Each question /ask runs a search for, and each listings request for a region we do not publish, adds one row to the demand log: the time, the film, format, dates or region asked for, and whether we had it. When /ask finds nothing, the question itself — lowercased, punctuation collapsed, cut to sixty characters — stands in for the film. The assistant’s own operator has its own privacy policy for what you typed there.

Email alerts and watchlists

Signing up for mail — in the mailroom, on the watchlist page, or with the 70mm and IMAX alert — stores your email address, the only contact detail the site keeps about a reader; your choice of the daily board, schedule drops for the theaters you picked, or watchlist alerts; the titles on your watchlist, up to sixty per sign-up; whether you have confirmed; and when you signed up and were sent the confirmation. A Letterboxd export is read in your browser, and only the titles in it reach us.

It is used for one thing: sending the mail you asked for. Until you confirm, the only mail sent to it is the confirmation link, once for each time the address is signed up. Mail is delivered by Resend, an email delivery service, which receives your address and each message in order to deliver it and handles them under its own privacy policy. So that no watchlist alert is ever sent twice, our send log records each one by address and film.

The record stays until you unsubscribe. Every message after the confirmation ends with a one-click unsubscribe link, and following it deletes the record — address, choices and watchlist — at once; nothing more is sent. The confirmation message carries no such link, so an address that is never confirmed stays on file, sent nothing further, until you ask us to remove it. Unsubscribing does not clear the send log’s watchlist entries, and mail composed before the mail service was connected was filed in our own storage instead of being sent. Either can be removed on request, below.

Group votes and dares

A group vote stores the screenings on its shortlist and, for each vote, the screening chosen, the time, and the name the voter typed (up to 24 characters) — or a random guest handle when they typed none. When someone answers a dare, the answer is stored under the dare’s link with the darer’s name from that link, the answerer’s name if they gave one, and the time. Anyone holding the link can see those names. Neither expires. An invitation link carries the sender’s name in its own address and stores nothing here.

Mail and hosting

If you email info@scenef.com, we keep the correspondence like anyone keeps mail, and use it only to reply. The site and its storage are hosted by Vercel, which receives every request — its IP address included — and keeps standard logs to run the service; we don’t mine them. On the home page, until your browser has a board saved, the approximate location Vercel derives from that address is used to suggest the nearest board within 100 miles; the location is not stored, and a board it suggests is saved in your browser. Some doors — the ticket links, /ask, and the sign-up, vote and dare forms — count requests per IP address in the server’s memory to slow a flood; those counts are never written to storage.

How long any of it is kept

This section exists because a policy that describes what it collects and never says how long it keeps it is incomplete — and because two directories that list this site’s connector reject a privacy policy on exactly that omission.

Your taste profile is kept by your browser and deleted when you clear it; nothing about it is retained on our side, because it is used for the one request it rides on and then forgotten. The ticket-door rows, the arrivals and the demand log hold no identifier that could be traced back to a person, so each is kept one row per event, filed by day or month, with no end date, as a coverage record rather than as a record of anyone. The mail record lasts until you unsubscribe or ask us to remove it; group votes and dare answers until you ask us to take a name off. Vercel’s logs are theirs, kept on their schedule, and we do not mine them or copy them anywhere. Email is kept as long as correspondence is useful and deleted on request. We also keep a backup copy of our storage, made by hand from time to time. It holds the mail record, the send log, stored mail, votes and dares as they stood when it was made, so something deleted here stays in that copy until it is deleted there too; a removal you ask for is made in both.

What leaves this site, and what does not

Nothing about you is sold, and nothing is shared with a data broker, an advertiser or an analytics vendor, because none of those relationships exist. Three services handle data on our behalf: Vercel hosts the site and its storage, so a request reaches their infrastructure before it reaches ours; Resend delivers the mail you subscribed to; and mail sent to us passes through Google Workspace.

Your browser also talks to a few other parties directly, each under its own privacy policy, and each sees that request’s IP address. A ticket link sends you to the theater’s box office or the ticket seller it uses, which is a normal outbound link. Some images load straight from where they are published: TMDB’s image server; Amazon’s image server, for a poster found through OMDb; or the site or image service a theater’s own listing uses. A trailer on a film page plays in YouTube’s privacy-enhanced player, from youtube-nocookie.com, which loads as it scrolls into view. The map is drawn by Mapbox: your browser fetches its tiles from Mapbox, and Mapbox’s map library reports map loads back to Mapbox.

The connector and API surfaces send nothing onward at all — a tool call is answered from our own dataset and the conversation that prompted it is never stored, never logged, and never used to train anything.

What you can do

Clear your browser’s storage and your taste profile, board and plan shortlist are gone. Follow the unsubscribe link in any alert and your mail record is deleted. Write to info@scenef.com to ask what is on file under your email address, or to have removed an unconfirmed sign-up, the send log’s entries for your address, a stored copy of mail addressed to you, your name on a group vote or a dare (send the link), or your correspondence. The ticket-door rows, the arrivals and the demand log hold nothing that identifies you, so there is nothing in them to look up or remove.

Changes

If any of this changes, this page changes first, and the practice follows — not the other way around. Questions to info@scenef.com.

Last reviewed October 2026 · SceneF, San Francisco