Privacy Policy

Last updated: October 1, 2026

This policy explains what personal data Cage MDB collects when you use our website at cagemdb.com or nicolascage.io, why we collect it, who processes it for us and the choices you have. We collect very little, and we never sell it.

Also available in: 한국어 · 日本語

Who we are

Cage MDB is a free, non-commercial fan site about the films of Nicolas Cage, available at cagemdb.com and nicolascage.io (two addresses for the same site) and run by an independent developer as a hobby project. The operator of the site is the controller of your personal data under the GDPR and the person responsible for handling personal information under Korea's Personal Information Protection Act (PIPA).

You can download a copy of your data or delete your account at any time on the Account page.

What we collect

You can browse Cage MDB without an account. If you sign in or accept analytics, we process the following:

Account information: when you sign in with Google or Kakao, we receive your name or nickname, profile picture, a unique account identifier and, from Google only, your email address. We never see your password.
Your library: the movies you add to your watchlist or mark as watched, the ratings you give and when you did so.
Technical data: when you visit the site, our hosting and database providers process your IP address, browser and device information and request logs to deliver the site and keep it secure.
Analytics (only with your consent): if you accept analytics, Datadog collects usage and performance data such as pages viewed, clicks, errors, load times, browser and device details and an approximate location derived from your IP address. A sample of visits may be recorded as session replays, with anything you type masked. We link this data only to your random account ID, never to your name or email address.
Cookieless measurement: Vercel Web Analytics and Speed Insights count page views and measure performance without cookies and without identifying you.

We don't collect sensitive data, we don't buy data about you from others and we don't use your data for advertising.

Why we use it (legal bases)

To create and run your account and save your watchlist, watched list and ratings: this is necessary to provide the service you asked for (performance of a contract, GDPR Art. 6(1)(b)).
To calculate anonymous community ratings (the Cage MDB rating), which never identify you: our legitimate interest in offering a community rating (Art. 6(1)(f)).
To keep the site secure, prevent abuse and fix errors using server logs: our legitimate interests (Art. 6(1)(f)).
To understand how the site is used and improve it with Datadog: only with your consent (Art. 6(1)(a)), which you can withdraw at any time in .
To measure overall traffic and performance with Vercel's cookieless tools: our legitimate interests (Art. 6(1)(f)).

We don't sell your data, use it for advertising or profiling, or make automated decisions about you that have legal or similarly significant effects.

International transfers

Our providers may process data in the United States and in other countries outside your own. For personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the safeguards our providers offer, such as the EU Standard Contractual Clauses (and their UK and Swiss equivalents) or the EU-U.S. Data Privacy Framework.

How long we keep it

Account information, watchlist, watched list and ratings: until you delete your account. Deletion is immediate and permanent; copies in our providers' routine backups expire on their regular backup cycle.
Server and request logs: about 30 days.
Analytics data in Datadog (only with consent): up to 30 days.
Your cookie choice: 12 months, after which we ask again.

Your rights

Depending on where you live, you have some or all of these rights:

Access and portability: download a copy of your data in a machine-readable format (JSON) from the Account page.
Correction: your name and picture come from your Google or Kakao profile and are updated when you change them there and sign in again.
Deletion: delete your account and all of your data at any time from the Account page.
Objection and restriction: object to processing based on our legitimate interests, or ask us to restrict processing.
Withdrawing consent: change your analytics choice at any time in . This doesn't affect processing that took place before.
Complaints: lodge a complaint with a data protection authority, such as the authority in your EU country, the UK Information Commissioner's Office, or the Personal Information Protection Commission in Korea or in Japan.

You can exercise your rights of access, portability and deletion yourself at any time on the Account page.

Privacy rights in California and other U.S. states

If you live in California or another U.S. state with a consumer privacy law, you have the right to know what personal information we collect and to access, correct and delete it, and you won't be treated differently for exercising these rights. We collect identifiers and account information, your library, internet activity (technical data and, with consent, analytics) and approximate location, for the purposes described above.

We do not sell or share personal information, as those terms are defined in the CCPA/CPRA, we don't use sensitive personal information, and we honor Global Privacy Control signals.

Additional information for users in Korea

In accordance with the Personal Information Protection Act (PIPA):

Items collected: name or nickname, profile picture, account identifier, email address (Google sign-in only), service usage records (watchlist, watched list and ratings), access logs, IP address, cookies and, with consent, analytics data.
Purposes: identifying members and managing accounts, providing the watchlist, watched list and rating features, calculating community ratings, security and error fixing and, with consent, service analytics.
Retention period: until you delete your account; access logs for about 30 days; analytics data for up to 30 days.
Destruction: once the retention period ends or the purpose has been achieved, electronic records are deleted using methods that make them unrecoverable. We don't keep paper records.
Overseas transfers: your information is transferred over the network when you use the service to Supabase, Inc. (account and library), Vercel Inc. (hosting and logs) and, with consent, Datadog, Inc. (analytics), which store it in the United States or other countries for the retention periods above. You can refuse by not creating an account and not accepting analytics; you can still browse the site.
Your rights: you can request access to, correction or deletion of your personal information, or the suspension of its processing, at any time on the Account page or by contacting us, including through a legal representative.
Security measures: encrypted connections (HTTPS), access controls that limit each user to their own data and collecting only the minimum information necessary.
Privacy officer: the site operator. You can exercise your rights yourself at any time on the Account page.
Remedies: you can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, call 1833-6972).

Cookies and local storage

We use a small number of cookies and browser storage entries. Essential ones are needed for the site to work; analytics cookies are only set if you accept them. You can change your choice at any time in , and our Cookie Policy has more detail.

Cookies and browser storage used by Cage MDB
Name	Set by	Purpose	Category	Duration
Name`sb-…-auth-token`Cookie	Set bySupabase	PurposeKeeps you signed in and secures requests to your account.	CategoryEssential	DurationUntil you sign out (up to 400 days)
Name`sb-…-auth-token-code-verifier`Cookie	Set bySupabase	PurposeProtects Google sign-in against interception (PKCE).	CategoryEssential	DurationUntil sign-in completes
Name`kakao_oauth`Cookie	Set byCage MDB	PurposeProtects Kakao sign-in against forgery and replay (state, PKCE and nonce). Only sent to the sign-in callback.	CategoryEssential	Duration10 minutes
Name`cookie_consent`Cookie	Set byCage MDB	PurposeRemembers whether you accepted or rejected analytics.	CategoryEssential	Duration12 months
Name`preferred_language`Cookie	Set byCage MDB	PurposeRemembers the language you chose.	CategoryPreference	Duration12 months
Name`theme`Local storage	Set byCage MDB	PurposeRemembers whether you chose the light or dark theme.	CategoryPreference	DurationUntil you clear it
Name`user_data_cache`Local storage	Set byCage MDB	PurposeKeeps a copy of your watchlist, watched list and ratings so pages load quickly. Cleared when you sign out.	CategoryEssential	DurationUntil you sign out (refreshed every 24 hours)
Name`moviesScrollPosition`Session storage	Set byCage MDB	PurposeRestores your scroll position when you return to the movie list.	CategoryPreference	DurationUntil you close the tab
Name`_dd_s`Cookie	Set byDatadog	PurposeGroups analytics events into a visit. Only set if you accept analytics.	CategoryAnalytics (consent only)	Duration15 minutes after your last activity (at most 4 hours)

Names starting with "sb-" contain our Supabase project ID and may be split into numbered parts (such as .0 and .1) when they are large.

Cookies and storage are kept separately for each address: signing in or making a cookie choice on cagemdb.com doesn't carry over to nicolascage.io, and vice versa.

Deleting your account

Open the Account page, choose "Delete account" and confirm. Your account, profile, watchlist, watched list and ratings are deleted immediately and permanently, and your ratings are removed from the community averages. If you signed in with Kakao, we also disconnect Cage MDB from your Kakao account.

If you disconnect Cage MDB in your Kakao account settings, we treat it as a request to delete your account.

Children

Cage MDB is not directed at children under 13 (under 14 in Korea), and we don't knowingly collect their personal data. If a child has created an account, it can be deleted at any time on the Account page.

Changes to this policy

We'll post any changes on this page and update the "Last updated" date. If a change is significant, we'll also tell signed-in users on the site before it takes effect.

Contact