Privacy

If you don’t have an account

Nothing about you is stored on Lantern’s servers. Your searches aren’t kept against you and no profile is built. If you choose your country and streaming services, that choice is saved in your own browser and never sent to us.

If you do have an account

• Your email address. The only thing you give us. It exists so you can sign in and so your lists follow you between devices.
• Sign-in links, stored as a one-way hash. Each one works once and expires after 15 minutes.
• Your session, also stored as a hash. The cookie in your browser lasts 90 days.
• Your lists — favourites and watchlist, and when you added each film.
• Your country and streaming services, if you set them.
• The date your account was created.

That is the whole list, and you don’t have to take our word for it: Export my data on your account page returns exactly what is stored, as a JSON file.

What Lantern never stores

• No passwords. There aren’t any — signing in is by emailed link.
• No viewing history. No record of what you clicked, searched for or lingered on, and no profile inferred from any of it.
• No advertising. No ad networks, and your data is never sold or shared for marketing.
• No third-party tracking cookies.

Cookies

One cookie, and only once you sign in: your session. It is httpOnly, so scripts can’t read it, and SameSite=Lax, so other sites can’t use it. It is the only way the site knows it’s you.

Visitor numbers are counted with cookie-free analytics: no cookies, no tracking across sites, and nothing that identifies you as a person.

Who else is involved

• Resend sends your sign-in emails, and receives your email address and the link in order to deliver it.
• TMDB supplies posters, synopses and streaming information. Poster images load straight from TMDB’s servers into your browser, which means TMDB can see your IP address — as any site’s images would.
• Umami counts visits, on servers in Germany. It receives the page you opened, the site you came from, and your rough location and device type — never your IP address itself, and never a cookie. The requests go through this domain, so your browser doesn’t contact them directly.
• Vercel serves the website itself.

None of them is given your lists.

Where it lives

Lantern’s database runs in Paris, France.

How long it is kept

• Sign-in links: 15 minutes, and they are cleared as soon as they are used.
• Sessions: 90 days, or until you sign out.
• Everything else: for as long as your account exists.

Dormant accounts aren’t deleted on a schedule today. If that changes, this page will say so before it does.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected, have it deleted, or object to how it is used. Two of those you can do yourself, immediately, from your account page: Export my data and Delete my account. Deleting removes the account, its sessions, its lists, its service preferences and any sign-in links still outstanding.

For anything else, write to contact@lantern-film.eu. If you think Lantern is mishandling your data and it hasn’t been put right, you can complain to the CNIL, the French data protection authority.

Changes

If this page changes in a way that matters, the date below changes with it. See also the terms and how Lantern works.

Last updated: 20 September 2026