Cookies & Privacy
Who we are
Our website address is https://www.whatshouldi.stream. We recommend films, TV and documentaries and tell you where to stream them. There are no visitor accounts, no sign-ups and no comments, so the amount of information we hold about visitors is very small.
Analytics
We use Matomo, which we host ourselves, to see which pages are popular and how the site is used. It is set up without cookies, and the last part of your IP address is removed before anything is stored, so it does not identify you. Nothing is shared with Google or any other company.
If you would rather not be counted at all, use the opt-out at the bottom of this page. Choosing it sets one cookie (mtm_consent_removed) so the site remembers not to count you. We also respect your browser's "Do Not Track" and Global Privacy Control settings: with either switched on, you are not counted and no cookie is needed.
My services and My list
If you choose your streaming services or save titles to My list, those choices are kept in your own browser (in its local storage), not on our servers. We never see them. They stay until you clear them on the page, or clear your browser's site data. The "Copy link" and "Save as file" options exist so you can move the list between your own devices; a copied link contains your list, so only share it with yourself.
Embedded trailers
Trailers are embedded from YouTube and Vimeo. Nothing is loaded from them until you press play. When you do, those sites behave as if you had visited them directly and may set their own cookies:
Cookies we set
Just browsing the site sets no cookies. The only exceptions are the ones you ask for: the analytics opt-out above, and the two below if you use the contact form or the donate page.
what-should-i-stream-session and XSRF-TOKEN are set only while you use the contact form or the donate page. They keep the forms secure against forged submissions and show the "message sent" notice; they contain no personal information and expire after two hours.
Site editors who log in to the admin area get a login cookie and a "remember me" cookie. These are only set on their own browsers.
Contact form
If you send us a message, we receive what you type: the topic you choose, your email address, and your name, subject and message if you give them. The message is saved in our admin area and emailed to us so we can reply, and we send you a short email to confirm it arrived. To stop spam, we also keep a scrambled (hashed) version of your IP address, which cannot be turned back into the address itself. We delete messages once the matter is dealt with. They are not added to any list or shared with anyone.
The form is protected by Cloudflare Turnstile, which checks that you are a person rather than a bot. To do that, Cloudflare looks at some information about your browser and device. This only happens on the contact page.
Donations
If you donate, you pay on Stripe's own checkout page. Your card or bank details go to Stripe and never reach us, and Stripe may set its own cookies on its page. Stripe tells us the amount, whether it is one-off or monthly, and your name and email address, so we can thank you and keep a record of donations. We keep those records for our accounts and do not use them for anything else. You can stop a monthly donation at any time.
Your rights
You can ask us at any time what information we hold about you, or ask us to delete it, by using the contact form. If you have not sent us a message or made a donation, the answer is "nothing".
Changes
If the way the site works changes, this page will be updated to match.