Privacy

Last updated 19 September 2026.

Not yet reviewed by a lawyer. This describes the software honestly and is accurate as of the date above, but it has not been through counsel. That review is required before COUCH is offered to households outside the author’s own.

The short version

COUCH works out who in your household watched what, so it can answer what to watch next. That requires knowing things about your family that are nobody else’s business. So: your viewing data is never sold, never shared with advertisers, and never leaves the product in a form that identifies you or your household.

What is stored

Your account — email address and a hashed password. Passwords are hashed with bcrypt and cannot be read back, by us or anyone else.
Profiles — the display names you choose for people in your household, and for a child profile an optional birth date used only to sort what is age-appropriate.
Watch events — what was played, when, on which device or room, from the sources you connect. These are append-only: corrections add a new record rather than rewriting history, so the trail of what was inferred and what a human fixed stays intact.
Your judgements — ratings, reactions, ownership assignments, and the appropriateness verdicts you set for your household.
Connection credentials — tokens for the services you link (for example Trakt) are encrypted with AES-256-GCM before being written to the database, and are never included in an export.

What is not collected

No advertising identifiers. No third-party analytics or tracking pixels. No cross-site tracking. There is no ad network in this product and no plan to add one — the money is never allowed to touch what the app recommends.

Children

Child profiles are created by a parent, are scoped to the household, and are never public. Children do not sign in and have no account, no password, and no friends list. A child profile holds a display name and, optionally, a birth date. The kid screen shows only titles an adult in the household has explicitly approved.

Who else sees anything

Service	What it receives
TMDB	Title lookups (a show or film name, or its TMDB id). Not your identity, not who watched.
Trakt	Only if you connect it. You authorise it directly on Trakt; we receive the watch history you already keep there.
Home Assistant	Your own server on your own network. COUCH reads from it; nothing about it is sent outward.
Anthropic	Only when a recap is generated, and only the series name, the season and episode number you stopped at, and public episode summaries. No names, no profiles, no household identity.
Other households using COUCH	Nothing at all unless a grown-up here turns on “Helping other families” on Household, which is off until somebody does. With it on, the fact that a household decided “fine on her own”, “only with a grown-up” or “no” about a title can be counted towards a total another household sees. Never your name, never who is in your house, never the note you wrote, and never anything you watched. Nothing is shown about a title until at least five households have decided it, and turning it back off takes you out of the next answer — no pooled copy is kept anywhere.
Railway	Hosting and the database. Standard infrastructure access.
Cloudflare R2	Encrypted nightly database backups, kept 30 days and then deleted.

What you can do about it

Take it with you. An owner can download everything the household ever produced as one JSON file, from the Household screen. Sync credentials are deliberately excluded.
Delete it for good. An owner can delete the household from the Household screen. This removes every row it produced — watch history, profiles, judgements, and the encrypted connection tokens — in a single transaction. There is no soft delete and no recovery. An automated test creates a household, fills every table in the schema, deletes it, and asserts nothing is left.
Leave entirely. You can delete your account, not just your household, from the same screen. A household nobody else is in goes with you. One with other people in it stays, and you leave it — what a house watched together is not one person’s to erase, so your name stays on that history and only your login goes. The screen tells you which houses do which before you type anything. If you own a house other people are in, hand it over to one of them first; that is on the same screen.
Correct it. Any inferred attribution can be overruled by a person, and your correction is permanent — the engine never overwrites it.

Backups are the one exception to immediate deletion: a deleted household may persist in an encrypted backup for up to 30 days before that backup expires.

Contact

Questions, or a request to see or remove your data: write to support@getcouch.app, or ask the household owner who invited you.

Terms · Back to COUCH

Loading…

The short version

What is stored

Your account — email address and a hashed password. Passwords are hashed with bcrypt and cannot be read back, by us or anyone else.

Profiles — the display names you choose for people in your household, and for a child profile an optional birth date used only to sort what is age-appropriate.

Watch events — what was played, when, on which device or room, from the sources you connect. These are append-only: corrections add a new record rather than rewriting history, so the trail of what was inferred and what a human fixed stays intact.

Your judgements — ratings, reactions, ownership assignments, and the appropriateness verdicts you set for your household.

Connection credentials — tokens for the services you link (for example Trakt) are encrypted with AES-256-GCM before being written to the database, and are never included in an export.

Children

Who else sees anything

Service

What it receives

TMDB

Title lookups (a show or film name, or its TMDB id). Not your identity, not who watched.

Trakt

Only if you connect it. You authorise it directly on Trakt; we receive the watch history you already keep there.

Home Assistant

Your own server on your own network. COUCH reads from it; nothing about it is sent outward.

Anthropic

Only when a recap is generated, and only the series name, the season and episode number you stopped at, and public episode summaries. No names, no profiles, no household identity.

Other households using COUCH

Nothing at all unless a grown-up here turns on “Helping other families” on Household, which is off until somebody does. With it on, the fact that a household decided “fine on her own”, “only with a grown-up” or “no” about a title can be counted towards a total another household sees. Never your name, never who is in your house, never the note you wrote, and never anything you watched. Nothing is shown about a title until at least five households have decided it, and turning it back off takes you out of the next answer — no pooled copy is kept anywhere.

Railway

Hosting and the database. Standard infrastructure access.

Cloudflare R2

Encrypted nightly database backups, kept 30 days and then deleted.

What you can do about it

Take it with you. An owner can download everything the household ever produced as one JSON file, from the Household screen. Sync credentials are deliberately excluded.

Delete it for good. An owner can delete the household from the Household screen. This removes every row it produced — watch history, profiles, judgements, and the encrypted connection tokens — in a single transaction. There is no soft delete and no recovery. An automated test creates a household, fills every table in the schema, deletes it, and asserts nothing is left.

Leave entirely. You can delete your account, not just your household, from the same screen. A household nobody else is in goes with you. One with other people in it stays, and you leave it — what a house watched together is not one person’s to erase, so your name stays on that history and only your login goes. The screen tells you which houses do which before you type anything. If you own a house other people are in, hand it over to one of them first; that is on the same screen.

Correct it. Any inferred attribution can be overruled by a person, and your correction is permanent — the engine never overwrites it.

Backups are the one exception to immediate deletion: a deleted household may persist in an encrypted backup for up to 30 days before that backup expires.