Legal

This website

renoir.info is a set of static pages. It sets no cookies, keeps no accounts, and runs no analytics or tracking of any kind — which is why there is no consent banner: there is nothing here to consent to. The one script on the site does page transitions and requests nothing from any third party.

Like any website, it is served by a hosting company — Hostinger — whose servers keep ordinary technical logs of requests (an IP address, a time, a page). Renoir adds nothing to that. If you write to hello@renoir.info, your email is handled by the same company's mail service and read by one person.

The app — Privacy Policy

Renoir maps cinema: films, the people who made them, and the connections between them. This policy describes what it does with information, and it is written to one rule: every sentence is a checkable statement about how the app behaves today. When the behavior changes, the sentence changes in the same commit.

The evidence behind each claim here is recorded in the repository, in legal/DATA_FLOWS.md — an audit of every request the app can make, read out of the code rather than assumed.

The short version

• Renoir asks you to sign in before the library opens. Sign-in is one emailed code — no password, nothing to reset.
• Everything you save is written to your device first. Your account exists so it follows you between devices.
• The server holds: your email address, an account id, the name you choose to show, the films you keep, and, only if you set them, a profile photo and favorite films, directors, actors and soundtracks. There is a small social layer: you can follow people, recommend films to them with a short note, block them, and report them.
• Film images are fetched from The Movie Database, and the app asks Expo whether a software update exists. Neither request carries your name, your email, or anything you have saved.
• There is no analytics, no advertising, no crash-reporting service, and no tracking. Nothing is sold and nothing is shared with anyone.
• You can delete your account from inside the app, and it is genuinely gone from the server when you do.

1. The front door, and what stays on the device

Renoir asks you to sign in before the library opens. This section is about what that does — and does not — mean for your information.

Everything you save is written to files inside Renoir's own storage on the device, which no other app on your phone can read: the films you heart, the ones you add to your watchlist, the ones you mark as watched, your preferences, your recent searches and the poster you arrange. The device copy is the one the app actually reads. Your account exists so that copy can follow you between devices.

That is not a policy we apply — it is how the app is built: the code that syncs refuses to run at all without a signed-in account, and anything saved on a device before its first sign-in is stamped with the owner local. So nothing you save, and no identifier of any kind, reaches Renoir's server except through the account described in section 3.

2. What leaves your device regardless of your account

Two things do, and neither can be switched off inside the app. Most apps do not tell you about either. Renoir will.

Film images come from The Movie Database. Aside from a small set of images bundled inside the app so its first screens need no network, posters, backdrops, stills and portraits are fetched from TMDB's image service at the moment they appear on screen. That request carries no name, no email, no account and no identifier that Renoir has assigned. It does carry your device's IP address, and the address of the image being requested names the film or the person you are looking at. So over a session, TMDB can see — tied to an IP address rather than to you by name — which films you opened and in what order. It is not anonymous; it is pseudonymous, and the difference is worth being honest about. The Image quality setting changes how large these images are, and nothing else: it does not reduce what TMDB sees.

Images you have already viewed are kept in a cache on your device so they do not have to be fetched twice. Nothing about that cache is sent anywhere.

The app asks Expo whether an update exists. Renoir can be fixed without a trip through the App Store, and the mechanism for that is a service called EAS Update, run by Expo. Every time you launch the app, before any of it has started running, it asks Expo's servers whether a newer version of the app's code is available. That request carries the app's version, the platform, the release channel, and a random identifier that is created the first time you open Renoir and stored on the device. It carries no email, no account, no name, and nothing you have saved.

Two things about that identifier deserve stating plainly. It is stable: the same value is sent on every launch, and it survives signing out and even deleting your account. Only deleting the app clears it. And if Renoir crashed the last time you used it, the text of that crash — which can include technical details of what the app was doing — travels with the next update check as well.

We would rather write this paragraph than leave it out. It is the one place where something durable about your installation is sent to a third party, and there is currently no in-app switch for it.

3. Your account

Signing in exists for two reasons: so the films you keep follow you between devices, and so the small social layer described here can exist at all.

How signing in works. You type an email address; Renoir asks its server to email you a code; you type the code back. There is no password, so there is nothing to reset and nothing for us to store. Your email address is sent when you request the code, and again with the code when you redeem it. If no account exists for that address, requesting a code creates one.

What the server then holds. This is the whole list.

• Your email address. It is how the account is identified and how a sign-in code reaches you. No other user can see it.
• An account id. A random identifier the server assigns.
• The name you choose to show. You are asked for one after your first sign-in. It is written only when you tap Save — nothing is sent as you type — and you can leave it unset. This name is readable by other signed-in Renoir users.
• The films you keep, and what you did with them. For each one: which film, which action — kept, on the watchlist, or watched — and when you did it. A watched entry also carries the date you watched it, if you gave one.
• A profile photo, only if you set one. The one picture you pick is uploaded so it can appear on your profile. It is served from a public web address: any signed-in member can see it, and in practice anyone who has its link can fetch it. Remove it and it is deleted from the server.
• Four favorite films. A new account starts with four from Jean Renoir's work, and you can change or clear them whenever you like. These are the deliberate public face of your shelf, separate from the shelf itself, and they carry a visibility setting that controls who sees them. That setting starts as public — visible to any signed-in member — and you can change it.
• Who you follow, who you block, and who you report. Your follow lists are visible to other signed-in members. Your block list is not: blocking is silent, and the person blocked is never told. A report goes to us and to no one else.
• Films you have recommended, and films recommended to you. For each one: which film, who sent it, who received it, the note the sender wrote with it, and how far it has got · sent, seen, watched or closed · with the time of each step that actually happened. The note is at most a hundred characters, written once at the sending, never edited after. Only the two of you can see any of it.

What a new account starts with. Nothing is written for you: no follows, no favorites, an empty shelf. So the room is not bare on day one, the community page shows a few recommendations from Renoir's own account until your own people arrive; they are part of the page rather than entries in your account, and they give way as real follows and recommendations accumulate.

Renoir has no ratings and no reviews — the app cannot create either, by design — so there is no score of yours on the server, and the shelf itself carries no written text. Nothing else about your device is sent: no model, no operating system version, no advertising identifier, no location.

When it is sent. When you sign in, when you add or remove something — after a short pause, so a run of quick taps travels together — and when you bring the app back to the foreground. There is no background schedule and nothing is uploaded while you are not using the app.

One thing to expect the first time. Signing in uploads the shelf you already built on the device, if you built one before the account existed, with its original dates, so the order of your shelf survives.

The contact form. You can write to us from inside the app — it is on the entrance, so it works even when you cannot sign in. Sending it stores what you typed — your message, the name and address you chose to give, and whether you asked for a reply or marked it urgent — in a box on the server that only we can read. It is not linked to any account, which also means deleting an account does not find and delete your messages: they are kept until read and dealt with, and the address in section 11 is how to ask for one to be removed sooner.

Signing out stops all syncing immediately, tells the server to end this device's session, and deletes the stored session from the device. Everything you have kept stays on the phone, exactly as it was.

4. Who else is involved

Four services make Renoir work, and none of them is given your information to use for their own purposes.

• Supabase hosts Renoir's database and storage. It processes the account information in section 3 on Renoir's behalf — including the profile photo and the contact-form messages — and holds it on Renoir's instructions. It also composes and triggers the sign-in emails.
• Hostinger runs the mailbox and mail service that actually delivers the sign-in emails from Renoir's own address, and hosts the renoir.info website. A sign-in email necessarily carries your address through its systems; nothing else does.
• The Movie Database (TMDB) supplies the film catalogue and serves the images, as described in section 2. Film and person information in Renoir comes from TMDB, and Renoir credits it where it is shown. Renoir does not send TMDB anything about you.
• Expo operates the update service in section 2.

Nothing is sold. Nothing is shared for advertising. There is no data broker and no partner of any kind.

5. What Renoir does not do

Each of these was verified against the code and the full dependency list, not merely intended.

• No analytics. There is no analytics library in the app of any kind.
• No advertising, and no advertising identifier. The app cannot read your device's advertising id, and it never asks permission to track you across other apps or websites, because it does not.
• No crash-reporting service. Renoir sends no crash reports to any monitoring service. The one exception is the update check described in section 2, which carries the previous crash's text to Expo.
• No third-party trackers, tags or pixels.
• No fingerprinting. Renoir reads nothing about your device — not the model, not the operating system version, not the locale, not the timezone.
• One optional photo, and only when you choose it. If you set a profile photo, Renoir asks for access to the picture you pick and uploads that one image, as section 3 describes. Beyond that, no access to your camera, microphone, location, contacts, calendar or health data — the app has no code for any of it.
• No notifications. Renoir cannot send you a push notification.
• No background activity. The app does no work while it is not open.
• No profiling and no automated decisions. Nothing about you is scored, ranked or predicted.

6. What stays on your device

Renoir keeps a small set of files in its own private storage: your shelf, your preferences, your recent searches, the poster you arranged, the notes you write and the folders you sort them into, a lookup table of the films you have annotated, your profile — one file for each account that has signed in on this device — a short list of profiles you recently visited, and, while you are signed in, your session. If you set a profile photo, the copy of the picture you picked lives there too. Notes is the one place in Renoir where you can write at length, and nothing you write there leaves the device: no note, no folder, not a word of one is sent anywhere.

Two honest notes about these.

The session file holds the credential that keeps you signed in, along with your email address, and it is stored as ordinary text rather than in the system keychain. It is inside Renoir's private storage, which other apps cannot read on a normal device, and signing out deletes it. Moving it to the keychain is a known improvement that has not been made yet; we would rather say that than describe it as secure.

These files sit in the part of the app's storage that your phone's own backup includes. If you back your phone up to iCloud, or to a computer, or use Android's automatic backup, these files are in that backup — including, when you are signed in, the session credential and your email address, and the profile photo if you set one. Restoring such a backup onto another device carries them with it. That is a consequence of where the files live; you can control it in your phone's own backup settings.

7. Deleting things

Your account. In the app: Profile, then Account, then Delete account, confirmed once. This removes the account and everything synced to it from the server — the account itself, the profile, the profile photo, your favorite films, your follow and block relationships, and every film entry — and it is immediate and permanent. There is no waiting period and no recovery.

What deletion deliberately leaves alone: the films you kept on this device stay on this device. They existed before the account did, and deleting the account is not a request to erase your own shelf. If you want them gone as well, delete the app. And a contact-form message is never touched by account deletion, because it was never linked to the account — section 3 explains, and the address in section 11 is how to ask for one to be removed.

Everything at once. Deleting Renoir from your phone removes all of the files described in section 6, the image cache, and the update identifier from section 2.

Asking us instead. You can also write to the address in section 11 and ask what is held about you, ask for it to be corrected, or ask for it to be deleted. It is one person reading, and it will be answered.

8. How long things are kept

Account information is kept until you delete the account. There is no automatic expiry, and nothing on the server deletes your data after a set period — so the honest answer is: until you ask, or until you delete the account yourself. Contact-form messages are kept until they have been read and dealt with, then deleted by hand; account deletion does not touch them. On-device files last until you delete them or delete the app.

9. Children

Renoir is not directed at children, and it is not designed or marketed for them. It shows posters and descriptions for films made for adults, and its terms require account holders to be at least 13. Nothing is knowingly collected from a child. If you believe a child has created an account, write to the address below and it will be deleted.

10. Legal basis, and where this applies

Renoir is offered from the State of Utah, United States, and this policy is governed by its law.

Where the law requires a basis for handling information — as it does in the UK and the European Economic Area — the basis is the performance of the service you asked for: an account exists to sync the films you keep and to run the profile you choose to show, and the information in section 3 is the minimum that makes that work. There is no processing for marketing, and therefore no consent to withdraw and nothing to opt out of. Where the law gives you rights of access, correction, deletion, portability or complaint, they apply, and section 11 is how to use them.

Renoir does not sell personal information and does not share it for cross-context behavioral advertising, in the sense California law gives those terms.

11. Changes, and how to reach us

If this policy changes, the date at the top changes with it, and the repository keeps the history of what was altered and why. A change that materially widens what Renoir collects will be announced in the app rather than made quietly.

Renoir is published by Tanush Saran. Write to hello@renoir.info about anything in this document, including a request about your own information. A human reads it.

The app — Terms of Use

These are the terms for using Renoir. They are short because the app is simple: it shows you films, it lets you keep the ones that matter to you, and it asks almost nothing of you in return.

By using Renoir you agree to what follows. If you do not, do not use it — there is nothing to cancel and nothing to pay.

1. What Renoir is

Renoir is a film library and a personal shelf, published by Tanush Saran.

It costs nothing. There is no subscription, no advertising and no in-app purchase.

2. Your license to use it

You may install Renoir on devices you control and use it for your own personal, non-commercial purposes. That permission is personal to you and cannot be transferred.

You may not copy, decompile, reverse-engineer or redistribute the app or its catalogue; extract the film data in bulk or scrape it for another product; resell or sublicense any part of it; or remove the credits it displays.

Renoir, its design, its code and the arrangement of its catalogue remain ours. Nothing here gives you ownership of any of it.

3. Your account

Renoir asks you to sign in before the library opens, so using Renoir means having an account. Sign-in is by a code emailed to you — there is no password. Keep access to that mailbox: it is the only way in, and there is no other route to recover an account.

You must be at least 13 years old to create an account — or older where the law where you live sets a higher age for agreeing to a service like this.

You agree to use an email address you are entitled to use, and to be responsible for what happens under your account. If you set a display name or a profile photo, other signed-in members can see them, so both carry the same three rules: use only material that is lawful and yours to use, do not put anything in them you would not want read, and do not impersonate anyone. We may remove a name or photo that breaks these rules, and the report and block controls inside the app are how to tell us about one.

You can delete your account at any time from Profile, then Account. It is immediate and it is permanent — see the Privacy Policy for exactly what that removes and what deliberately stays on your device.

4. What you write is yours

The shelf you build is yours. The films you keep, the ones you mark as watched, the dates you record — you own all of it, and Renoir claims no ownership over any of it. The same is true of the profile you choose to show: the name, the photo, the favorites.

The notes you write in Renoir are yours in the fullest sense: they live on your device alone, no copy reaches the server, and syncing them is not something you have permitted because it is not something that happens.

To sync it between your devices we need permission to store and transmit it on your behalf, and that is the only permission you give: it is limited to running the service for you, it is not a license to publish, display or use your shelf for anything else, and it ends when you delete the account.

Your shelf is not public: the films you keep, your watchlist, your watched marks and their dates are private to your account, and no part of the shelf is visible to any other user. The profile is the deliberate exception: your display name, your photo if you set one, your follow lists, and, under the visibility you choose, your favorite films, directors, actors and soundtracks exist to be seen by other signed-in members.

The other exception is one you make deliberately, one film at a time. A film you recommend to another member is visible to them: they see the film, who sent it, and the note you wrote with it, at most a hundred characters, written once at the sending and never edited after. Nobody else sees any of it.

5. How you may not use it

Do not use Renoir to break the law. Do not attempt to gain access to another person's account or to any part of the service you have not been given. Do not probe, overload or interfere with the service or the servers behind it, and do not use automated means to create accounts or to request sign-in codes.

There is no tolerance in Renoir for objectionable content or for abusive behaviour toward other members. Do not put anything objectionable in a display name or a profile photo, and do not use Renoir to harass, threaten or impersonate another member. A name or a photo reported as either is removed, and the account behind it can be ended without notice. The report and block controls inside the app are how to tell us.

6. Film data, images and credits

Renoir's film and person information, and the posters, backdrops and stills it shows, come from The Movie Database. Aside from a small set of images bundled with the app, images are fetched from TMDB's service as you browse — the Privacy Policy explains what that means for you.

Renoir uses the TMDB API but is not endorsed or certified by TMDB. Your use of Renoir is also subject to TMDB's own terms of use, and Renoir may change how or whether it shows this material if TMDB's terms or availability change.

Posters, stills and other film imagery remain the copyright of their studios and rights holders. They are shown here to identify films, not licensed to you: you may not extract, redistribute or reuse them.

Renoir shows no ratings and no critics' scores, by design. Nothing in it should be read as a judgment of a film's quality.

The one number Renoir prints is the CRI, the Cinema Relevance Index. It is computed from the record and from Renoir's own curation: credits, years, countries and languages, the connections between works, and the movement rosters decided here by hand. It measures how much of cinema runs through a thing, never how good the thing is, and a masterpiece can carry a modest one.

No rating, review or vote is an input to it. Which films the catalogue holds at all was shaped in part by how widely a film had been logged elsewhere, so a CRI is a position within Renoir's catalogue rather than within all of cinema. Two values in it are authored rather than computed, both the app's namesake: Jean Renoir prints 100.0, and the films he directed are lifted toward the top.

7. It is offered as it is

Renoir is provided as is and as available, without warranty of any kind, whether express or implied — including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement.

Specifically, and honestly: it may contain errors. The catalogue is incomplete and some of its information will be wrong. The service may be unavailable, and features may change or be removed. Nothing is promised about the accuracy or completeness of anything you read in it.

Keep your own record of anything you would be sorry to lose. Renoir tries hard not to lose your shelf, and its writes are not perfectly atomic — a crash at the wrong instant can, in principle, lose recent changes on the device. Your account gives you a copy on the server, but no backup is guaranteed.

8. Limits on liability

To the fullest extent the law allows, we are not liable for indirect, incidental, special or consequential loss, for lost data, or for lost profits, arising from your use of Renoir. Where liability cannot be excluded, it is limited to the amount you paid for the app, which is nothing.

Nothing here excludes liability that cannot lawfully be excluded — including for death or personal injury caused by negligence, or for fraud. If you are a consumer, your statutory rights are unaffected by anything in these terms.

9. Ending it

You can stop using Renoir whenever you like: delete your account, delete the app, or both.

We may suspend or end an account if it is being used to break these terms or to harm the service or other people. If the service itself is discontinued, reasonable notice will be given in the app so you can delete your account first if you wish.

10. Changes to these terms

These terms may change. The date at the top changes with them, and the repository keeps the history. A change that materially reduces what you get will be announced in the app rather than made quietly. Continuing to use Renoir after a change means accepting the new version.

11. Law, and reaching us

These terms are governed by the law of the State of Utah, United States, and its courts have jurisdiction over any dispute. If you are a consumer resident elsewhere, this does not remove any right you have to bring a claim in your own country's courts or under its mandatory consumer law.

If part of these terms turns out to be unenforceable, the rest of it stands.

Write to hello@renoir.info. A human reads it.