Privacy Policy

Effective date: August 24, 2026

This Privacy Policy explains how RateWave (“we”, “us”) collects, uses, and protects information when you use ratewave.net. RateWave is a service for rating video games, TV shows, and movies. It is currently free, with no advertising and no paid tier. This Policy is a notice describing our privacy practices, not a consent form. Most of the information we handle is processed because it is necessary to provide your account and the service under our Terms of Service. Where we instead rely on your consent, we ask for it separately, and you can withdraw it at any time.

Information we collect

Account information: the email address, username, and password you provide when you register. Your password is never stored in readable form, see Security below. Your email address is set at registration and cannot be changed from within the app. We also record whether you have opted in to marketing email and, if so, when you gave that consent.
Pending registrations: when you sign up, we hold your email, chosen username, and hashed password temporarily while we wait for you to enter the confirmation code we email you. No account exists until you confirm. If the code is not used, this record expires and is deleted (currently within about 24 hours).
Profile content: your username and any avatar or banner image you upload.
Activity you create: the scores and optional written comments you post, the lists you create and the titles you save to them, the lists you subscribe to, and the accounts you follow.
Moderation records: if you report another user’s comment, we record that a report was made, who made it, and the content it refers to.
Notifications: we record a notification for you when someone follows you, when someone you follow posts a review or publishes a list, when someone subscribes to a list you published, and when a moderator acts on your account. Each record notes what happened and whether you have seen it. Notifications are deleted automatically after 30 days.
Technical data: basic request metadata, including your IP address, used transiently for security and rate limiting. When your password is changed, we include the time and the originating IP address in the security-notification email we send to your account, so you can recognise whether the change was made by you. If an error occurs, our error-tracking provider may receive diagnostic data about the request. We do not store IP addresses or request logs in our own database. Diagnostic information held by our hosting and error-tracking providers is kept for a limited period under their own retention settings and deleted when that period ends. We do not use advertising or third-party analytics trackers, and we do not sell or share your data with advertisers.

How we use your information

For each purpose below we note the legal basis on which we rely. These bases are our current understanding and may be refined; they do not reduce any rights you have.

To operate your account and authenticate you. Legal basis: necessary to provide the service.
To display your ratings, comments, profile, lists, and follow relationships. Legal basis: necessary to provide the service.
To notify you in the app about activity involving your account, such as a new follower, a review or list from someone you follow, a subscription to a list you published, or a moderation action taken against you. We do not send these by email. Legal basis: necessary to provide the service.
To send transactional email (account confirmation and password resets) via our email provider. This email is sent regardless of your preferences because it is necessary to operate your account. Legal basis: necessary to provide the service.
To send marketing email (occasional news and updates), but only if you have opted in. You can withdraw your consent at any time from the Edit Profile screen on your profile, or via the unsubscribe link in any such email. We do not send marketing email to users who have not opted in. Legal basis: your consent, which you can withdraw at any time.
To protect the service against abuse, spam, and unauthorized access, including rate limiting and moderation. Legal basis: our legitimate interest in keeping the service secure.
To diagnose errors and keep the service running. Legal basis: our legitimate interest in keeping the service reliable.

Cookies and sessions

We use a small number of strictly necessary cookies to keep you signed in and to protect form submissions. These are required for the site to function; we do not use tracking, advertising, or analytics cookies. Signing out, changing your password, or resetting your password ends your existing sessions.

What is public

RateWave is a social product and is public by design. Your username, avatar, ratings, written comments, and follower and following counts are visible to anyone, including people who are not signed in, and may be indexed by search engines. Your email address and password are never shown publicly. There are no private profiles or private ratings: do not post anything in a comment you would not want published.

Your lists are part of that public profile. Every list you create is shown on your public lists page, whether or not you have published it, so a list is not a private place to keep notes. Publishing a list additionally makes it findable in search on RateWave, lets other people subscribe to it, and gives it a page that search engines may index; publishing is permanent and cannot be undone, and a published list can only be deleted, never returned to unpublished. Which lists you subscribe to is not shown on your profile, but subscribing is not anonymous: your username is shown to the owner of that list in their notifications.

Third-party services

Catalog data comes from IGDB (games) and TMDB (film & TV). This website uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB. Browsing the catalog does not send your account details to these providers.
Uploaded avatar and banner images are stored and served by Cloudinary.
Transactional email is delivered by Resend.
Hosting and database are provided by Railway; DNS, TLS, and edge protection by Cloudflare. Both process requests in order to operate and secure the site.
Error tracking is provided by Sentry, which may receive technical diagnostic data when something goes wrong.

Several of these providers store or process data on servers outside Saudi Arabia, primarily in the United States and the European Union. These transfers are necessary to provide the service: hosting, image storage, and email delivery are performed by these providers, and your account cannot function without them. Those locations may have different data-protection laws than your own. We rely on these providers’ own safeguards to protect your data in transit and at rest.

Moderation

Any signed-in user can report a comment. Reports, and any moderation action taken on an account, are recorded. What administrators can do and what each action means is set out in our Terms of Service.

Data retention & deletion

We keep your account data for as long as your account exists. You can delete your account at any time from your account settings; this removes your profile, ratings, comments, lists, list subscriptions, notifications, follows, and outstanding password-reset tokens, and releases your username and email address for future use by anyone. We also delete any avatar or banner image you uploaded from our image provider. In the rare case that this fails, the image is no longer shown on RateWave or linked to any account, but the file may remain in the provider’s storage; contact us at [email protected] and we will remove it. Unconfirmed registrations expire automatically and are purged.

Any moderation record held against your account, such as a warning or a mute, is removed when your account is deleted.

Deleted data may persist for a limited period in encrypted database backups before those backups are rotated out.

Your choices

You can change your display name or password, upload or replace your avatar or banner, or delete your account from within the app. Email addresses cannot be changed in the current version; if you need a different email address, delete your account and register again.

You can turn marketing email on or off at any time from the Edit Profile screen on your profile. Turning it off stops all marketing email; transactional email needed to run your account is unaffected.

Depending on where you live, you may have rights to access, correct, or delete your personal data, or to object to its processing. To make a request, contact us at [email protected].

You can also request a copy of the personal data associated with your account by contacting us, and we will provide it in a structured, machine-readable format.

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA), the authority responsible for personal-data protection in Saudi Arabia. If you are located outside Saudi Arabia, you may also contact your local data-protection or supervisory authority.

Age requirement

RateWave is not directed to anyone under 16, and you must be at least 16 to create an account. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete the account and its data.

Security

We protect your data with measures including password hashing (bcrypt), encrypted connections (HTTPS), rate limiting on sensitive endpoints, and database backups. No online service can guarantee absolute security.

Data breaches

If a personal-data breach occurs, we will notify the Saudi Data & Artificial Intelligence Authority (SDAIA) within the timeframe required by the Personal Data Protection Law. Where a breach is likely to cause you harm, we will also notify you at the email address on your account. Such a notice will explain, as far as we can, what happened, what data was affected, what we are doing in response, and the steps you can take to protect yourself.

Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the effective date above.

Contact

Questions about this Policy can be sent to [email protected]. RateWave is operated by Salem Al-Qahtani, Riyadh, Saudi Arabia, who is the controller responsible for your personal data.