What we collect, why we collect it, who we share it with, and what you can demand from us.
Last updated: September 20, 2026
1. The short version
We do not sell your data. Ever.
We use no advertising cookies and no third-party trackers.
We collect the minimum needed for your account to work and your profile to exist.
Your profile is public by default: what you post is visible to anyone with the link.
You can request access, correction or deletion of your data at any time.
2. Who the controller is
Listrated is the controller of the personal data processed on the platform under the LGPD (Law 13.709/2018). Privacy contact: contato@listrated.com.
3. Data we collect
Account and login — email, username and password (stored as a scrypt hash, never in plain text). When you sign in with Google or Discord, we receive the account identifier, display name, email and avatar those providers supply.
Profile — display name, bio, location (free text you write yourself), avatar, cover image, accent color, status, custom links, highlight, layout and skin preferences, and your profile music (link, preview, title, artist and cover).
Lists, favorites and ratings — lists, favorited items, ratings, reviews, progress (episodes, chapters, hours), imported achievements and uploaded screenshots.
Interactions — profile view counts and daily aggregated history (games, music, media progress) used in the charts on your profile.
Uploads — images and files you upload (avatar, cover, screenshots), kept in S3-compatible object storage.
IP and technical logs — IP address, date and time, user agent, routes accessed and errors. Generated automatically by the infrastructure and used for security, diagnostics and abuse prevention.
External integrations — when you connect an account (Discord, Google, Last.fm, Steam, PlayStation, Xbox, Spotify, Deezer, AniList, MyAnimeList, Trakt), we receive identifiers and the public data needed to build your library: owned games, achievements, scrobbles, title lists and progress.
Analytics — we currently use no third-party analytics tools and no tracking pixels. If that changes, we will update this page before switching anything on, and will use aggregate metrics only, with no advertising profiling.
We do not collect sensitive data (LGPD art. 5, II) or precise geolocation.
4. Why we collect it (purposes and legal bases)
Create and maintain your account, authenticate login and keep the session — performance of a contract (art. 7, V).
Display your public profile, lists, ratings and integrations — performance of a contract.
Connect the external services you authorized yourself — consent (art. 7, I).
Automatically translate bio and location into English when a visitor uses the EN interface — performance of a contract.
Security, fraud and abuse prevention, and incident investigation — legitimate interest (art. 7, IX).
Answering requests and providing support — legitimate interest.
5. Who we share it with
We do not sell, rent or hand your data to advertisers. We share only what is necessary, with:
Infrastructure and database — the provider hosting the application and the PostgreSQL database where the data is stored.
Storage and CDN — S3-compatible object storage and the CDN in front of it, serving images, avatars, covers and uploads.
Authentication — Google and Discord, when you choose to sign in through them.
Media APIs and integrations — IGDB/Twitch, TMDB, MDBList, Trakt, AniList, Jikan/MyAnimeList, HowLongToBeat, Steam, CheapShark, PlayStation Network, Xbox Live, Last.fm, Spotify, Deezer, YouTube and Lanyard. We send only what the query needs, such as the title being searched or your identifier on that service.
Authorities — upon a court order or legal obligation.
Some of these providers are located outside Brazil, which means an international transfer of data. We choose services whose security standards and contractual safeguards are compatible with art. 33 of the LGPD.
6. What is public
Public: your profile (listrated.com/your-username), lists, ratings, reviews, avatar, cover, bio, location, status, custom links and the integrations you choose to display. This content may be indexed by search engines.
Not public: email, password, integration tokens, access logs and the internal identifiers of your external accounts.
7. Cookies
We use essential cookies only — session, login flow and your language choice. The full breakdown, with each cookie's name and lifetime, is in the Cookie Policy.
8. How long we keep it
Account and profile — for as long as the account exists.
Sessions — up to 30 days per session; expired ones are deleted automatically.
Access logs — 6 months, under art. 15 of the Internet Civil Framework, and longer only upon a court order or to investigate a security incident.
Uploads — while they are attached to your profile.
Third-party data cache (covers, metadata, prices) — refreshed periodically and not tied to your identity.
Backups — copies may persist for a short period after deletion, until the next rotation.
9. Security
Passwords stored with scrypt hashing and a unique salt: not even we can read your password.
Session in an httpOnly cookie, with SameSite=Lax and Secure in production; only the token hash is stored in the database.
All traffic over HTTPS.
Restricted administrative access and secrets kept out of the source code.
No system is 100% secure. If an incident poses a relevant risk to your rights, we will notify you and the Brazilian data protection authority (ANPD) under art. 48 of the LGPD.
10. Deleting your account
To delete your account, write from your registered email to contato@listrated.com with the subject Delete account. We confirm your identity and process the request within 15 days.
Deletion erases your profile, lists, ratings, reviews, uploads, integrations and sessions. Only access logs kept for the legal period remain, plus whatever is needed to comply with a legal obligation or to exercise rights in legal proceedings.
Deletion is permanent and cannot be undone.
11. Your rights (LGPD)
At any time, under art. 18 of the LGPD, you may:
confirm whether we process your data, and access it;
correct incomplete, inaccurate or outdated data;
request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
request portability of your data to another provider;
learn who we share your data with;
learn what happens if you withhold consent;
withdraw consent and disconnect external accounts;
object to processing based on legitimate interest;
Listrated is not intended for anyone under 13. Between 13 and 18, use requires the consent of a parent or legal guardian. If an account belonging to someone under 13 is identified, it is closed and the data deleted.
13. Changes to this policy
If we change anything material, we announce it on the site and update the date at the top of this page. Continuing to use Listrated after that means you are aware of the new version.