Privacy policy

Last updated 8 November 2026

This policy describes what Sarita collects, why, and what you can do about it. It is written to describe what the software actually does rather than to cover every eventuality.

Who we are

Sarita is a film and television recommendation site. For data protection purposes the data controller is WikiTribune, Ltd., which operates Sarita, of WikiTribune, Ltd., Mailbox 018, 272 Kensington High Street, London, W8 6ND, United Kingdom. Questions about this policy, or any request described below, can be sent to admin@sarita.ai.

What we collect

We hold three kinds of information, and no more than these.

Your account

  • Email address: required to create an account and to sign in, and used to send you anything you ask us to email you, such as tonight's pick.
  • Display name and handle: optional, and chosen by you. Your handle is how other people find and add you, so it is visible to anyone who knows it. Other people can also find you by your name or handle in people search, depending on your visibility setting (see who can find you).
  • Profile photo: optional. If you add one, we show it wherever your name appears, to the people your visibility setting allows, after an automatic check that it is suitable. If you ask us to, we may send your photo to an AI service to make you a custom avatar. When you remove it, or delete your account, it is deleted straight away.
  • Authentication is handled by Amazon Cognito. If you sign in with Google, we receive your email address and name from that provider. We never receive your password for any service, including ours. Cognito holds it, and we cannot read it.

What you do here

  • Titles you mark as watched, like, or add to a watchlist, and the ratings you give.
  • Your friends, follows, and anyone you have blocked.
  • Whether you found a particular recommendation good or bad.
  • Hot takes: the short comments you post about films and programmes.

Before you have an account

You can rate and save titles without signing up. Those actions are stored in your browser only. They are not sent to us and we cannot see them. If you later create an account, they are copied into it. If you clear your browser, they are gone, and we have no copy.

Invitations, including to people without an account

Someone using Sarita can invite a particular person to choose films and television with them, by email or by sharing a link. If somebody gives us your email address that way, we hold it to deliver that one invitation and to honour what you decide about it.

Typing an email address into the box on the Friends page does not search for it: it starts an invitation like this one. If the address already belongs to an account, that person gets a friend request from you instead of an email, and the request then shows on your Friends page under their name, so inviting someone by email can tell you that they have an account. The person inviting you may add a short note of their own. It goes into that one email, and we do not store it with the invitation; if you already have an account, it comes with the friend request instead, and is kept with that request until you accept or decline it.

  • We send one message. There is no reminder, ever. In some circumstances our staff may send it again.
  • If you decline, or the invitation expires, we delete the address within 30 days in any case.
  • If you accept, we delete it from the invitation's records. The address you sign up with is then part of your account, kept and used like any account's address, for example to send you messages about your account.
  • It is never used for marketing, never added to a list, never used to build a profile of you, and never used to train models.
  • Without making an account you can decline the invitation, stop invitation emails to your address for good, or report a problem. Every invitation says how.

The full detail, including the lawful basis and where the address came from, is in how we handle invitations.

Payments

If you buy VIP, the payment is taken by Stripe, which sells the subscription to you as merchant of record: Stripe takes the card, issues the receipt and accounts for any sales tax. You pay on Stripe's own pages, so your card details go to Stripe and never reach us.

We give Stripe your account identifier and your email address, so the payment is tied to your account, and the plan you chose. Stripe tells us the state of the subscription (which plan, whether it is active, and when it renews or ends), and that is all we keep about it. Stripe keeps its own records of the sale, as the law on tax records requires, under its own privacy policy.

What we do not collect

  • No location data, no contacts, no device fingerprinting.
  • No card or bank details. If you pay, Stripe holds those, not us.
  • We do not sell your data.

Advertising

Sarita carries advertising, and all of it is ours. The adverts you see are written and served by us, from this site. No advertising network is involved, no third-party script runs on the page, no advertiser is told that you visited, and nothing about you is used to decide which advert you see. The choice depends only on which page you are reading.

We had a real ad network briefly and removed it: it redirected a reader to a site we would never have chosen, without them clicking anything. If we bring one back we will update this page first, and anything that sets a cookie or loads a third-party script will ask you before it does.

VIPs see no advertising at all.

Some links to Amazon carry our Amazon Associates ID. On a title page, a "Where to watch" link to an Amazon store page may include our ID, so that Amazon pays us a commission if you buy something there. It costs you nothing and changes nothing about the price. We do not tell Amazon anything about you; what Amazon collects once you are on its site is covered by Amazon's own privacy notice. As an Amazon Associate I earn from qualifying purchases.

Analytics

We measure how the site is used, from our own server logs. There is no analytics company involved, no tracking pixel and no third-party script. Our content delivery network records each request it serves, and we read those records to understand which pages people find useful and where visitors come from.

Each record contains:

  • the page or file requested, and the result (say, a page found or not found)
  • the date and time, and how long the response took
  • your IP address, and the network it belongs to
  • your browser's user-agent string
  • the page that linked you here, and any campaign tag in the address

We keep these records for 30 days and then they are deleted automatically. We use them to count visitors, to see which recommendations people read, to tell real readers apart from the automated crawlers that make up most of our traffic, and to find abuse and faults. The lawful basis is our legitimate interest in understanding and protecting a service we are running.

We do not log your cookies, so these records never contain your sign-in session. We do not sell them, and we do not share them with advertisers.

Cookies and browser storage

  • A sign-in cookie, set when you sign in. It is HttpOnly, so no script on the page can read it, and it exists solely to keep you signed in. It expires after 120 days.
  • Browser storage, holding a marker that you have signed in before, and anything you rated or saved before creating an account. It never holds a password or a sign-in token.

Neither of those is an advertising or analytics cookie, and no third party sets a cookie here. That is why you are not asked to accept anything: the sign-in cookie is what makes signing in work, and there is nothing else to consent to.

The checkout and billing pages you reach when buying or managing VIP are Stripe's own site, on Stripe's own domain. Any cookies set there are Stripe's, under Stripe's policy.

Who else sees it

Other people see only what your visibility setting allows:

  • Private: only you.
  • Friends only: people whose friend request you accepted. This is the default for a new account.
  • Everyone: any signed-in visitor.

You can also override that on an individual title, so one rating can be private on an otherwise public profile.

Someone who may see your activity may also get a notification about it: for example, a friend may be told when you rate something on their watchlist, or post a hot take about it.

Hot takes. When you post a hot take you choose who may see it: Only me, Friends and groups (your friends and the members of groups you have joined), or Public. Choosing Public submits it for possible display to anyone, including people without an account, on the page about that film or programme, with your display name and handle, where search engines can find it too. Which hot takes we show, and where, is our choice, made automatically or by our editors; we never show one beyond the audience you chose. For a film or programme, your choice also sets who sees your rating of it, which appears beside a public hot take.

Reactions. You can react to a hot take you can see, with one of a few emoji. Its writer sees who reacted and how, and may get a notification about it; everyone else who can see it sees only how many of each.

A note you add when you recommend something goes only to the people you send it to, and anyone it reaches can report it. A note sent to a group, or one our automatic check refuses, is also kept for 30 days for our staff to review, for the safety of the service. Notes are stored encrypted, with a key only the part of our service that shows them can use.

Who can find you. Signed-in people can search for others by name or handle. If your visibility is Everyone, anyone with an account can find you. If it is Friends only, your friends and the friends of your friends can find you; search shows them your display name, your handle and a friend you have in common. What you have watched and rated stays visible only as your setting allows. If it is Private, you do not appear in search at all, though someone who knows your exact handle can still send you a request. Searching never looks up email addresses.

How people become your friends. A friend request needs your answer. An invitation is different: pressing Connect on one makes you friends with whoever sent it. A group link, made by the person who started a Watch Buddies group and shared wherever they chose, makes everyone who presses Connect on it their friend straight away, without them confirming each one: up to 20 people for each link, within 14 days. It does not put anyone in the group; its creator adds members one at a time, and anyone can leave. A partner invitation also puts the two of you in a group of your own, and stops working once it is accepted. You can disconnect or block anyone at any time.

Groups share ratings, for choosing together. When you join a Watch Buddies group, your ratings, likes, watchlist and what you've watched are shared with the group's other members whenever we choose for the group: in its picks, on its page, and in the group parts of our emails. Members may also get a notification about them, for example when you rate something another member wants to watch. This applies whatever your profile's privacy setting. Hot takes you post for Friends and groups are shown to its members too. Everywhere else, your setting applies as before. If you leave the group, nothing more is shared with it.

We use these service providers, and no others that receive your personal data:

  • Amazon Web Services: hosting, databases, and sign-in (Cognito). Data is stored in the United States.
  • Google: only if you choose to sign in with them.
  • Stripe: payments, only if you buy VIP. Stripe is the merchant of record and keeps its own records of the sale.
  • Anthropic: a US company whose language model, Claude, writes the VIP parts of the site and of the weekly email, described below.
  • TypeSafe: checks each hot take, and each note you add when you recommend something to a friend, when you post it, for spoilers, abuse and advertising, and how useful it is. We send it the text and facts about the film or programme, never your name, handle or email address. It also checks profile photos before they are shown; for that we send it the photo, with your display name and handle so it can tell whether the photo pretends to be someone else.
  • An AI image service: only if you ask us to make you a custom avatar, and only that photo.

Sarita also uses TMDb and TVMaze for film and television information, and TypeSafe to judge what each programme is like: how dark it is, how fast it moves, which kind of comedy or crime story it is. Those are facts and judgements about programmes, fetched before you arrive, and TMDb and TVMaze receive nothing about you; TypeSafe also checks hot takes, as described above. The recommendations on every title page are written by Anthropic's model from the same kind of facts, also before you arrive, and with nothing about you.

The exceptions are the VIP features written for particular people. In each, we send Anthropic the display names of the people involved (or their handles, where no name is set) and what they have watched, liked, rated or put on their watchlist. That includes members who do not have VIP themselves, but only what the member asking could already see on the site. We send no email addresses and no account details.

  • The Watch Buddy paragraph. When a member with VIP opens their group, Anthropic writes a short paragraph suggesting what the group could watch together, from the group's marks on up to twelve titles.
  • The picks on title pages. When a member with VIP opens a title page, Anthropic chooses and explains what to watch next, for them or for one of their groups, from that person's or group's marks.
  • The weekly email. If a member with VIP has asked for our weekly email, Anthropic writes their edition from their own marks, from their friends' and their groups' marks that they could already see on the site, and from that week's new programmes. We send no email addresses.

Tonight's pick is open to everyone, signed in or not. When you ask for it, we send Anthropic the titles you rated or marked (from this browser if you are not signed in), the services you said you have, and (if you are picking for someone) the names and marks of the people in your group. If you named a partner who has not joined yet, we send their first name and your guesses about what they would love or hate, labelled as guesses. We keep your guesses about someone else for 21 days at most, and delete them as soon as that person joins. The answers you give in its quick “would you rather watch” game are about that evening only: they are kept for 24 hours, for that pick, and then deleted.

Every pick can be shared. Each time we make tonight's pick, we keep it for 7 days on a page of its own, so that you can send it to someone: the titles, what we wrote about each, and the names the pick was made for (for a group, its members' display names). Nothing about your ratings or your account is kept with it. The page's address ends in a long random code, so only someone who has the link can open it, and the page asks search engines not to list it. After 7 days it is deleted.

A pick can be put to a vote. Whoever has the link can vote, with no account. A vote keeps each person's choice, and the first name they gave if any, for 7 days after it closes, then deletes them. Votes are counted one per device, by a random code your browser keeps, not by who you are, and the network you voted from is kept only as a scrambled code, to stop one place voting many times. Anyone with the link can see the tally and the names once they have voted.

“Just ask” lets you describe what you want to watch in your own words. We send Anthropic what you typed, the titles you loved and disliked, and the services you have. When you ask for a Watch Buddies group, we also send the display name of each person in it (or their handle, where no name is set) and the titles each of them loved and disliked (including members who do not have VIP themselves, but only what you could already see on the site), and the age of the group's youngest viewer, if one is set, so that what we suggest suits them. We send no email addresses and no account details. We keep every ask (what you typed, what we understood and the titles we suggested) on your account for 30 days, and you can see your recent ones on the Just ask page. Our admins may read them, to see how the feature is used and to improve it. They are in your data download and are deleted with your account. If you are not signed in, you can ask once: we send Anthropic what you typed and the titles marked in this browser, and we keep nothing you typed.

We keep each paragraph and each set of picks for up to 90 days, so the same group is not charged twice for the same answer, and the working copy of a weekly email for 30 days. If you would rather not appear in these, leaving a group takes you out of that group's from then on, and making your profile or an item private takes it out of everyone's.

When Sarita puts new programmes in an order that suits you, it does that in your browser. Your ratings and watchlist are compared against those judgements on your own machine. The ordering is never sent back to us, and no request we make reveals which titles you have marked. We score the programmes, never the people.

Hot takes and what we show

Each hot take is checked automatically when you post it. If it looks like it breaks our rules we say so straight away, and you can change it and try again. One that seems to give away the story is shown behind a Show spoiler button. Which hot takes appear, and where, is decided automatically and by our editors, and anyone who can see one can report it; a report can stop one being shown. Those are choices about what to show, not findings that a hot take broke a rule.

Your rights

You can exercise the first two yourself, immediately, from your settings:

  • Get a copy of your data: a complete JSON export, downloaded on the spot.
  • Delete your account: this removes your ratings, hot takes, watch history, votes, friend and follow connections and your sign-in itself. It is immediate and cannot be undone. If you have a VIP subscription, deleting your account ends it at once and the rest of the period is not refunded; places you gave on a family plan end with it. Stripe keeps its own record of the sale.
  • Correct your data: your display name and visibility can be changed at any time.
  • Edit or delete a hot take at any time, from the page you posted it on.
  • Object, restrict, or complain: write to admin@sarita.ai. If you are in the UK or the EU you may also complain to your national data protection authority; in the UK that is the Information Commissioner's Office.

Our lawful basis is performing the service you asked for (you cannot have a collection without us storing it) and, for keeping the service secure and working, our legitimate interests. Checking hot takes for spoilers, abuse and advertising, and choosing which to show, is in our legitimate interest in keeping the service safe and worth reading.

How long we keep it

Your account and its contents are kept until you delete them. Deletion takes effect immediately; ordinary backups may retain a copy for a short period before ageing out. A hot take stays on our pages until you delete it, remove the title from your collection, or delete your account. A public one leaves our pages within minutes of being deleted, but search engines may show their copy for longer.

Records we keep for safety. To keep Sarita safe, and to check how our automatic checks and our editors are working, we keep records of what happens on it for our staff to review, including after you have edited or deleted what they record. They are never shown to other members, and we keep them only as long as we need them for that, or as the law requires. For example, we keep a log of hot takes: each one you post, edit or delete, with your rating at the time, any our automatic check refuses, and the check each was given, for 30 days. While we are small, our staff can also see a log of what members do on the site, such as what they rate, save, post or share and when, to understand how it is being used. We keep it for 30 days and will stop keeping it once we no longer need it.

Children and young people

You must be 13 or older to have an account. Below that we do not knowingly collect anything. If you believe a younger child has created an account, write to admin@sarita.ai and we will remove it.

Where we know how a film or programme was rated in your country, we show that rating on its page so you can judge for yourself. For a lot of television nobody publishes one, and we say so rather than leaving a blank that might look like approval.

Whoever set up a Watch Buddies group can give the age of its youngest viewer. Suggestions made for that group then leave out anything rated above that age in your country. Where your country has no rating we use the US one, and where neither has one, the strictest rating any other country gives. A title with no rating we can read is left out.

Changes

If this policy changes materially we will say so on this page and update the date at the top. Sarita is a new service under active development, so expect this page to gain detail rather than lose it.