Privacy policy

Applies to TidyWL for Netflix version 0.1.0 and later, on Google Chrome. Published 20 September 2026. Updated 6 October 2026 for version 1.2.1: removing the extension now opens one page on tidywl.com asking why, described under The page that opens when you remove it. Its address carries a few rough facts that reach our server only if you press Send there, and an email only if you add one. One new storage key, tidywl_installed_at, is in the table of keys below. Nothing else the extension sends changes. Updated 3 October 2026 for version 1.2.0, which adds Leaving soon: when you press Sync, TidyWL asks Netflix which titles in your My List it is about to remove, up to 100 titles a request, and keeps the answer in your browser. Nothing new is sent anywhere but Netflix, and the usage report does not change. Three new storage keys, and one Chrome clears when it closes, are in the table of keys below; the toolbar popup now shows each leaving title's picture, loaded from Netflix's image servers. Updated 30 September 2026 for version 1.1.0, which adds IMDb rating badges on Netflix's own title cards and, in Pro, Tonight. The badges send the Netflix ids of the cards on the page you are looking at to a ratings table on our server, which keeps no record of them; that is request 8, new, under The requests that leave your browser. Tonight, with its surprises on, reads a few of Netflix's genre catalogues; it also reads your Netflix viewing history and thumbs, so it never offers what you have seen or disliked; and what it remembers stays in your browser. Its Later, on my phone sends one title, the pick you press it on, to your paired phones through Pro's playlist sync, until 5 am. The usage report gains fifteen counts: how often Pro's offer is shown, its Upgrade button pressed and its link to a feature's demo pressed, and how Tonight is used. Updated 27 September 2026 for version 1.0.0, which adds TidyWL Pro: Undo for removals, pins, two clean-up rules, stats, up to 50 playlists a profile, and playlist sync between your browsers and onto your phone. Of those, only sync sends anything anywhere — your playlists and your profile's name — and only when you have a Pro key and switch sync on; every one is listed under Pro: your playlists on our server. Undo's removal history and the stats tally stay in your browser, in the table of keys below. The same version caps free playlists at five in a browser new to the extension, and may ask once on a removal's summary for a rating or a coffee; both are remembered in your browser and nowhere else. Updated 23 September 2026 for version 0.2.0, which added a usage report: versions before 0.2.0 sent nothing about your use anywhere. This is a different extension from TidyWL for YouTube, which has its own policy and behaves differently. Both have a paid tier called Pro, with separate keys: a key for one does not work in the other.

The short version

• Your Netflix data stays in your browser. Your watch state, your searches and, with Pro, the viewing history and thumbs Tonight reads are never sent to us.
• Your playlists stay in your browser too — unless you have Pro and switch sync on. Then this profile's playlists, with each title's name, year and picture link, and the profile's name, go to our server, so your other browsers and your phone can show them. So does a title you send to your phone from Tonight. Only from browsers where you switched it on. Never for a free install.
• If you buy Pro, your licence key goes to tidywl.com. It switches Pro on and is checked again when you open the dashboard, at most once every 15 minutes. Paddle takes the payment; your card details and your email never reach us.
• What does leave is a random identifier and some counts. After you sync, remove or add titles, search, open a category, use a playlist or Tonight, are shown Pro's offer, or open the dashboard for the first time in a day, the extension sends tidywl.com a random ID for your install and your lifetime totals — how many titles you have removed and added, how many searches you have run, how large your My List is, and so on. Never which titles, never what you searched for, never which profile.
• There is no switch in the extension to turn this off. Uninstalling stops it, and records not updated for 12 months are deleted.
• From version 1.2.1, removing the extension opens one page on tidywl.com, asking why. Its address carries a few rough facts — the version, your browser's language, how long you had the extension and on how many days you opened it — after a #, which never reaches our server. They are sent only with an answer, if you press Send. Your email is asked for only after that, is optional, and is deleted after 60 days.
• There is no account and no sign-in. A Pro key is not an account: there is no password, and we never learn your email. The usage report's identifier is random, made in your browser, and linked to nothing — not your Netflix account, not a profile, not your email, not a Pro key.
• Five other requests leave your browser, and none of them identifies you. A public settings file from tidywl.com; IMDb's public ratings file; Netflix's numeric title ids sent to Wikidata to look up the matching IMDb id; for a title its id cannot match, its name sent to IMDb's search and to Wikidata's; and, from version 1.1.0, Netflix's numeric title ids sent to our own ratings table, which answers with each one's IMDb rating. Each one is described in full below.
• Custom playlists and pins use Chrome's own sync storage. That means Google carries them between your signed-in Chrome browsers. Without Pro sync we never see them.
• Everything about your account is stored per Netflix profile, and uninstalling the extension removes everything it stored in that browser.
• Nothing is sold, shared or used for advertising. There is nothing to sell and nobody to share it with.

What it reads on Netflix

TidyWL for Netflix works by calling netflix.com's own endpoints with the session you are already signed in with, exactly as the Netflix web app does when you use it by hand. It cannot read anything when you are not signed in to Netflix in that browser, and it never asks you for your Netflix password — it never sees one.

It reads, and only when you ask it to:

• Your My List — each title's id, name, type, year, runtime, maturity rating, genres and box-art address. Read when you press Sync.
• Your watch state — for each film, how far into it you are; for each show, whether Netflix records it as never watched, started or completed. Read as part of the same Sync.
• Which profile is active — its id, name and language, so everything can be filed under the right profile.
• Search results and genre catalogues — only for a search you typed or a genre you opened. For each search result, and each film in a genre, details such as its year, runtime and number of seasons are then asked for once, and kept for the rest of that page's life.
• A title's details on hover — its synopsis, cast, director or creators, genres, runtime and a still image, asked for once per title when you rest the pointer on a card, and kept for the rest of that page's life so a second look costs nothing.
• For Tonight — Pro only, from version 1.1.0, and only once you open it. With Surprises from outside My List on, as it is until you switch it off: a few of Netflix's genre catalogues that fit the mood you chose, and details, such as the runtime, of the best-rated few films in them; a mood already read today is not read again. On the poster layout, a larger picture of the main pick, asked for once it has stayed on screen for a moment and kept for the rest of that page's life.
• Your viewing history and your thumbs, for Tonight — Pro only, from version 1.1.0, and only when you open Tonight: the titles this profile has played on Netflix and when, and the titles it has given a thumbs up, down or "love", so Tonight never offers what you have already seen or disliked. Read from Netflix's own viewing-activity service, the one behind Account → Viewing activity, through the session you are signed in with and only for the profile you are using — at most once every six hours, one page of 50 at a time a second apart, and after the first time usually just the newest page. What is kept is the title ids, the time of the last play and the thumb, in this browser only; never a title's name, never an episode, and none of it is sent to us or to anyone.
• Which titles in your My List Netflix is about to remove — from version 1.2.0, as part of Sync. Netflix marks these on the title's picture, and gives a sentence with the last day, such as "Last day to watch on Netflix: October 5". TidyWL asks for those sentences for up to 100 titles at a time, so one or two requests for most lists, and only when you press Sync.

One thing it reads without being asked, from version 1.1.0: the link on each of Netflix's own title cards, on whatever netflix.com page you are looking at. The link carries the title's Netflix id (/browse?jbv=<id>), and that id is how the extension puts an IMDb rating badge on the card. It reads the link and what kind of card it is, never the card's text, skips games, and asks Netflix nothing for it. The ids go to our ratings table, request 8 below, and, when that cannot answer, to Wikidata, request 3. Some titles cannot be matched by their id at all, because Wikidata has no Netflix id recorded for them. For those, and only those, the extension takes the title's name and year from what the Netflix page has already loaded to draw that card — it asks Netflix nothing for it — and searches by name, requests 4 and 3. A click on a badge opens that title's page on imdb.com in a new tab.

Your search terms go to Netflix, on your own signed-in session, in the same way that typing them into Netflix's own search box would. They do not go anywhere else.

It writes two things to Netflix, and only on your instruction: adding a title to My List, and removing one. Both are the same operations the Netflix web app performs; both are confirmed before a batch runs. Custom playlists are not written to Netflix — see below.

What stays in your browser

Everything above is cached in the extension's own storage so that the dashboard can sort, filter and search hundreds of titles without asking Netflix again. Opening the dashboard never asks Netflix for anything — reading Netflix is what the Sync button is for. This is a privacy property as much as a speed one, and it is also why the extension does not quietly re-read your account in the background. Opening it can make requests to tidywl.com, never to Netflix: the usage report, at most once a day and only when a count has changed; the settings file, request 1, at most once an hour; and, with Pro, the licence check and playlist sync, requests 6 and 7. The first two carry no title and nothing from your account.

Held in chrome.storage.local, which never leaves the machine:

And in chrome.storage.session, which Chrome clears when it closes: tidywl_popup_intent, from version 1.2.0 — a popup button you pressed while not on Netflix (which button, for which tab, and when), held for two minutes until the Netflix tab opens.

From version 1.2.0 the toolbar popup shows each leaving title's picture. It loads from Netflix's image servers, at the address saved at Sync, the same way the dashboard's pictures do.

One more thing is held locally and is not a key: the browser's own Cache Storage keeps a copy of IMDb's ratings file under tidywl-imdb-dump for twelve hours, so that a page of results does not pull 8.6MB again. It is IMDb's public file, identical for everyone, and it says nothing about you.

Every key that holds something about your account carries your Netflix profile's id. There is deliberately no shared fallback key: an adult profile's list cannot appear under the kids profile on the same account, because there is no place for the two to meet. If the extension cannot tell which profile is active, it stores nothing. The keys without a profile in their name — the settings copy, the dashboard's size, the IMDb ratings, that file's download time, the badges' ratings, the count of Sync-to-mobile presses, the four usage-report keys, the three Pro keys without one, the note that this browser had the extension before 1.0.0, and the two records of the rating and Ko-fi asks — hold nothing that belongs to a profile. The usage counts are added up across every profile that used the extension in that browser, and never say which.

Custom playlists, pins, and Chrome's sync

A custom playlist is a name you typed and a list of Netflix title ids. Nothing else — no titles, no images, no descriptions. Those are looked up again each time the playlist is shown.

Playlists are held in chrome.storage.sync rather than local storage, under tidywl_playlists_<profile> and tidywl_playlist_<profile>_<id>. Two smaller things sit there with them, for the same reason — so that they follow you to your other computer: tidywl_pinned_<profile>, the title ids you have pinned so that a bulk remove cannot take them, and tidywl_archive_playlist_<profile> and tidywl_archive_playlist_stale_<profile>, which playlist each of the two clean-up rules moves titles into — a single id each. That is Chrome's own sync, which means Google replicates them between the Chrome browsers you are signed in to, under Google's terms and Google's encryption, exactly as it does your bookmarks. It is a feature — your playlists follow you to your other computer for free — but it is also the one place anything you made in this extension leaves the machine, so it is worth stating plainly:

• It goes to Google, not to us. Chrome's sync gives us no copy, no key and no way to read it. Pro sync is a separate, second copy, described in the next section, and only exists if you switch it on.
• It is playlist names and numeric title ids. Name them whatever you like — a playlist name is text you wrote, and it travels with the ids. A pin is an id alone.
• You can turn it off in Chrome's own settings, under You and Google → Sync and Google services, by excluding extensions from sync. Playlists and pins then stay on that machine.

Playlists are never written to your Netflix account. Nobody else on the account sees them, and Netflix is not told they exist.

A Pro key is kept here too, under tidywl_license: the key itself, whether the subscription is active, this browser's seat number and the name you gave it, and the names of the other browsers using the key — so the key follows your Chrome profile to your other computers, as a bookmark would.

Pro: your playlists on our server

TidyWL Pro keeps your playlists in step between browsers that Chrome's own sync does not reach — Brave, another Google account, another computer — and shows them on your phone. To do that it has to send them to a server, and the server is ours. Everything in this section happens only with a Pro key, and only in a browser where you switched on Sync playlists to your phone and other browsers under About → Pro. It is off until you do.

What a sync sends, for the Netflix profile open in that tab and no other:

• the profile's id and its name, as Netflix shows it — so your phone can say whose playlists they are;
• each playlist's id, name, and when it was made and last changed — the newest change wins when two browsers disagree;
• each title in it: Netflix's id, and, where this browser knows them, its name, whether it is a film or a series, its year, and the address of its picture on Netflix's image servers. The picture itself is never copied to us;
• for a playlist you deleted, its id and two times, and nothing else — so it does not come back from a browser that still has it.

When: when you open the dashboard, a few seconds after you change a playlist, and when you press Sync now. Each sync first asks the server for its copy, then sends what is newer here.

Not sent, even with sync on: your My List — except the one title you send to your phone, below — your watch state, your searches, your pins, your IMDb ratings, or another profile's playlists. Your Netflix password is never seen by the extension at all.

Your phone

Under About → Pro → Phones, Pair a phone shows a six-character code and a QR code. The code works once, for ten minutes. Your phone opens tidywl.com/netflix/app/ — scanning the QR code carries the code in the part of the address after #, which is never sent to any server — and swaps the code for a pass of its own. Your licence key never reaches the phone.

• A pass reads the synced playlists of every profile under your key, and nothing else — so a paired phone shows all of them, as the Netflix app does, including a kids profile's. It cannot change anything, and it cannot be used to sync.
• The phone tells our server what kind of device it is and, on an iPhone, where the page runs — "iPhone · Safari", "iPhone · Home Screen app", "Android phone" — so you can tell your phones apart in the list. Nothing more specific.
• Scan code uses the phone's camera only while the scanner is open, and reads the QR code on the phone. Nothing from the camera is sent anywhere; the code reader itself is served from tidywl.com, not from a third party.
• The phone keeps its pass and the last copy of the playlists in that page's own storage, so the page opens straight away, and whether you chose not to add it to your Home Screen. Forget this phone removes both from the phone, and the phone's row from our server.
• Titles' pictures load on the phone straight from Netflix's image servers, which see the request as they would from the Netflix app.
• Remove, beside a phone in the extension, stops that pass for good. The next time the phone opens the page, it deletes what it kept.

Tonight's pick, on your phone — from version 1.1.0. When you press Later, on my phone under a pick in Tonight, that one title goes to our server at once — if sync is off in that browser, Tonight asks you to switch it on first, and sends nothing until you do: its Netflix id, name, whether it is a film or a series, its year and the address of its picture, as a playlist named Tonight's pick in the same copy your paired phones read. Nothing else from Tonight or your My List goes with it, and nothing goes unless you press it. Your phone shows it above your playlists and hides it after 5 am. It is deleted from our server by the next sync after 5 am of any of your browsers on version 1.1.0 or later, or by the next sync after you press Undo; a title sent later replaces it. A browser still on version 1.0.0 lists it as an ordinary playlist until the deletion reaches it. The phone remembers when the last pick it opened onto was sent, so it opens on that pick's profile once.

The requests that leave your browser

These are every outbound request the extension makes other than to netflix.com. There are no others; they are the only fetch calls in the extension's background worker, nine of them, because the sixth has two. The first four carry no identifier, no cookie, no account, and nothing that distinguishes your copy from anyone else's. The fifth, the usage report, carries the random identifier described with it — and nothing else about you. The sixth and seventh are Pro's, and a free install never makes them. The eighth, new in version 1.1.0, carries Netflix title ids and, like the first four, no identifier, no cookie and no account.

1. A public settings file, from tidywl.com

The extension fetches https://tidywl.com/config/netflix-config-v1.json when you open the dashboard or press Sync, and, from version 1.1.0, the first time a Netflix page shows title cards after it loads — at most once an hour in all, and it never waits for it. It holds a handful of values, such as the support links shown in the About dialog and the Pro prices on the upgrade card, so that small things can be corrected without shipping a new version. From version 1.1.0 it can also switch IMDb ratings off: while it does, requests 2, 3, 4 and 8 are not made, the badges come off Netflix's cards, and the dashboard hides the ratings it saved. It can switch Tonight's reading of your viewing history off the same way, and correct the address that reading uses on netflix.com if Netflix moves it — never to anywhere outside netflix.com.

The request carries no identifier and no payload; every install receives the same bytes. Nothing in the file is executed as code, and the extension works normally with the file deleted, unreachable or malformed — every value in it has a built-in default. Like any web request it reaches our host with your IP address, which is not recorded against anything and is not retained.

2. IMDb's public ratings file

To show an IMDb rating on a card, the extension downloads https://datasets.imdbws.com/title.ratings.tsv.gz — IMDb's own daily public dataset, about 8.6MB, covering every title IMDb rates. It is downloaded at most once every twelve hours, kept in the browser, and searched in your browser for the ids you need.

The important consequence: this download tells IMDb nothing about which titles you have. The extension asks for the whole file, exactly as anyone else does, and does the matching itself. IMDb sees a download, not a request about you. The one request that does name a title to IMDb is the fourth, below, and it is made only for a title that cannot be matched by its id.

3. Netflix title ids — and sometimes a title's name — to Wikidata

IMDb's file is keyed by IMDb id, and Netflix's titles are not. To bridge the two the extension queries https://query.wikidata.org/sparql, Wikidata's public query service, with a list of Netflix's numeric title ids — up to 250 at a time — and asks which IMDb id each corresponds to.

Some titles are on Wikidata without their Netflix id recorded, so an id finds nothing. For those, and only those, the extension searches Wikidata by the title's name, as Netflix shows it, one title per request, with the language to search in taken from your Netflix profile (for example en). It accepts an answer only when exactly one film or series has that name, that kind and a matching year; otherwise the title simply has no rating. The year is compared in your browser, against what Wikidata sends back — it is not sent. A title with no year to go on is never searched by name.

What Wikidata receives is numbers, or a title's name and a language code, plus the extension's name. A name says nothing its id did not — the id already names the title. Not your profile, not your account, not an identifier of any kind, and nothing that says the titles are a personal list rather than any other set. Wikidata's own privacy policy governs what Wikimedia does with the request.

4. A title's name — to IMDb's search, when its id cannot be matched

Some titles are not on Wikidata at all yet — most often ones released in the last few months — and some are there without their Netflix id. In the dashboard, for a title that both Wikidata requests above have tried and failed to match, and only for those; for the badges on Netflix's own cards, for a title neither our ratings table nor Wikidata could match by its id, before Wikidata's name search, because IMDb answers in under a second and Wikidata can take most of a minute. For those titles, and only those, the extension sends its name, as Netflix shows it, to https://v3.sg.media-imdb.com/suggestion/, the address behind the search box on imdb.com, one title per request. It accepts an answer only when exactly one film or series comes back with that name, that kind and a matching year; otherwise the title simply has no rating. As with Wikidata, the year is compared in your browser and not sent, and a title with no year is never searched by name.

What IMDb receives is the title's name, in the address of the request, and nothing else. The request is made with cookies switched off, so even if you are signed in to IMDb in this browser it is not tied to your IMDb account. Not your profile, not your Netflix account, not an identifier of any kind. Like any web request it reaches IMDb with your IP address. IMDb's own privacy notice governs what IMDb does with the request.

When requests 2, 3 and 4 happen: when you press Sync, for the titles in your list; when a page of search or genre results is drawn, for the titles on it; for Tonight, for the few films whose details it reads; and, from version 1.1.0, for the badges on the Netflix cards on your screen, for the titles their ids could not match. All three are answered from the browser's own copy once a title has been matched, so a matched title is never asked about again; a title that could not be matched is asked about again after a week — by id, then by name on Wikidata, then by name on IMDb — at most 40 names at a time for each.

From version 1.1.0, requests 2 and 3 also stand in for our ratings table, request 8, when it refuses, is down or does not answer within eight seconds. For the badges, the ids it could not answer go to Wikidata by id, and their ratings come from IMDb's file; a title that neither the table nor Wikidata can match by its id is then searched by name, as above, at most 40 at a time, and a title neither name search finds is not searched again for a week. Tonight does the same by id for its surprises; only the few films whose details it reads can also be searched by name, as above. After such a failure the badges leave the table alone for a quarter of an hour and use these two instead, and they ask Wikidata again about a title it had no match for only after a week.

There is no setting for you to turn ratings off in this version; if that matters to you, say so and it will be added.

5. A usage report, to tidywl.com

From version 0.2.0, each install carries a random identifier, made in your browser the first time a report is sent. It is not derived from, linked to, or stored alongside your Netflix account, a profile, your email or anything else about you, and it is not shown anywhere in the extension. Reinstalling makes a new one.

Whenever one of your lifetime counts has changed, the extension sends that identifier and the counts to https://tidywl.com/api/netflix/installs. It checks on each Netflix page load, after a Sync, after a removal, and the first time you open the dashboard on a given day. The report is exactly this, and nothing else:

The last fifteen, from paywall_pin down, were added in version 1.1.0. Before it, the report was the identifier and the fourteen above them.

Never sent: a title, a Netflix or IMDb id, what you searched for, a category's name or id, a playlist's name or contents, a profile's name, id or how many profiles there are, a rating, your watch state, the time you did anything, the extension's settings, or an IP address the extension has read. The report has no field that could hold any of these, and the server refuses a report carrying anything it does not expect, so none can be sent by mistake.

Days opened is a number, not a diary. The report carries how many days, never which days, what time or for how long. The server does note the date each report arrives; see How long anything is kept.

There is no timer and no install beacon. A report is sent only when a count has changed. An install that has never done anything counted above sends nothing at all, and an install that is idle sends nothing while it is idle. If a report cannot be delivered it is not retried or stored; the same counts simply go the next time one of the moments above comes round.

Why: to know how the extension is actually used — how many people open it in a week, which of its three tabs they use, how large a My List gets, and whether anyone wants mobile sync enough to press a button for it; and, from version 1.1.0, which of Pro's features people reach for and whether Tonight gets used — which decides what gets built next. Store reviews come from a self-selected few; this is the only other signal. The numbers are not sold, not shared with anyone, and not used for advertising.

6. A licence check, to tidywl.com — Pro only

When you enter a key, the extension sends it to https://tidywl.com/api/netflix/license/activate with the name for this browser, pre-filled as something like "Chrome on Mac" and changeable. The server answers with the subscription's status, the browsers using the key, and a 24-hour sign-in for this browser. Later checks, when you open the dashboard at most once every 15 minutes, send the key and this browser's seat number. Deactivate this browser, and Remove beside another browser, send the key and that seat's number. Manage subscription sends the key and this browser's seat number to /api/netflix/license/portal.

If you enter a Transaction ID from a Paddle receipt instead of a key, the extension first sends that ID, and nothing else, to https://tidywl.com/api/netflix/license/claim, which answers with the key it paid for; that key is then activated as above. Both are described under Paddle, who takes the money.

From version 1.1.0 you do not have to paste the key after buying. The page tidywl.com shows after checkout, /netflix/checkout/success/, hands the key it shows you to the extension, if the extension is installed in that browser, and the extension activates it exactly as above, with the same pre-filled browser name. This is the only page on tidywl.com the extension runs anything on. It tells the page only whether Pro was switched on — never the key back, and nothing else from your browser. A different key already active in the browser is never replaced.

7. Playlist sync and phones, to tidywl.com — Pro only

Syncs go to https://tidywl.com/api/netflix/sync and carry exactly what Pro: your playlists on our server lists. Pairing a phone asks /api/netflix/pair for a code and sends nothing else; the phone list and Remove use /api/netflix/phones. All of them carry this browser's 24-hour sign-in, never the key.

8. Netflix title ids, to our ratings table at tidywl.com — from version 1.1.0

To put an IMDb rating on Netflix's own title cards, the extension sends https://tidywl.com/api/netflix/ratings a list of Netflix's numeric title ids, up to 200 in a request, and the server answers with the IMDb id, rating and number of votes it has for each. It asks about the cards on the Netflix page you are looking at as they appear, one request at a time, never about the same title twice in one page load, and not at all about a title it rated in the last day. Tonight, in Pro, uses it too: one request for the surprises it found in Netflix's catalogue, which leave out every title in your My List as of your last Sync.

The ids are those of whatever cards Netflix shows on the page, in any row; nothing in the request says which row a card was in.

What the server receives is the ids, and nothing else — no install identifier, no profile, no title's name, nothing from the dashboard's copy of your list, and no cookie: the request is sent from the extension's background worker with cookies switched off. The server writes nothing down about it — no log of the request and no record of which ids were asked for. Like any web request it reaches our host with your IP address, which goes only to a rate limiter, 60 requests a minute from one address, and is not stored.

The ratings in the answer are IMDb's, matched to Netflix ids on our server from Wikidata and IMDb's daily public file — the sources of requests 2 and 3 — for every title Wikidata links, not for the titles anyone asked about. When the table cannot answer, the extension uses requests 2 and 3 instead, as described under them. The settings file, request 1, can switch it off.

What the extension does not do

• No record of what you watch or search for. The usage report above counts how often you did things, never what they were done to. The only titles we keep are the ones in playlists you chose to sync with Pro. The ratings table, request 8, receives title ids to answer and keeps none of them.
• No account. Pro is a key, not an account: no password, no email, no profile with us.
• No third-party analytics, tag manager, advertising pixel or session recorder. None, anywhere, including on this page.
• No reading of other sites. It runs on netflix.com and nowhere else.
• No video. It does not download, record, decrypt or touch Netflix video in any way.

The permissions it asks for, and why

Wikidata does not appear in that list because it does not need to: its server permits cross-origin requests, so no host permission is required to reach it. It is described above all the same, because what a request carries matters more than whether Chrome made us ask for it.

The page that opens when you remove it — from version 1.2.1

When you remove TidyWL for Netflix from Chrome, Chrome opens https://tidywl.com/netflix/removed/ in a new tab and asks what made you remove it. The extension is gone by then: this is not one of its requests. While it was installed it gave Chrome the page's address, and Chrome opens it itself. Answering is optional, and closing the tab sends nothing.

What the address carries. Up to five short fields, after a #:

None of it reaches our server when the page opens. A browser never sends the part of an address after a # to the server it asks for the page; the page's own script reads the fields in your browser. The plan, p, goes no further than that: the page reads it to tell a subscriber that removing the extension did not cancel the subscription, and how to cancel, and never sends it anywhere. The other four leave your browser only if you press Send.

What Send stores. Pressing Send sends your answer, with those four fields, to https://tidywl.com/api/netflix/removed, which keeps one row:

Not stored: your IP address, which goes only to a rate limiter and is not written down; the usage report's install identifier, which the page never has and the server never asks for; the plan; any cookie. An answer names nothing about you unless you type it.

Your email, only if you leave it. After Send, the page offers to take your email so we can ask you one question about your answer. If you type it and press that second Send, it goes to https://tidywl.com/api/netflix/removed/email with the answer's random id, and is stored on that answer's row with the day it was added. It is used for that one question, and for nothing else: no newsletter, no list, never shared. It is deleted 60 days after you leave it; the answer stays, without it. To have it deleted sooner, write to support@tidywl.com from that address.

Why: the store counts how many people remove the extension, never why. This page is the one place a person who left can say, and the reasons decide what gets fixed or built next.

How long anything is kept, and how to remove it

• The cache stays until you Sync again, which replaces it, or until you uninstall.
• The IMDb ratings file is replaced when it is more than twelve hours old.
• The badges' ratings are asked for again after a day, and at most 5,000 titles are kept.
• Tonight's surprises are kept for a day. A title put off with Not tonight stays put off for seven days, and the record that you did for thirty. A film you pressed Play on in Tonight leaves its picks for a day. Your occasions stay until you delete them.
• Playlists stay until you delete them, and pins until you unpin them.
• The usage report's record is kept on our server as described below, and deleted after 12 months without a report.
• Pro's copy of your playlists stays on our server while your subscription is active, updated by each sync. Turning sync off stops that browser sending; it does not delete the copy, because your other browsers and your phone still use it. A deleted playlist leaves only its id and two times. When a subscription ends, the copy — every profile, playlist and phone under the key — is deleted 90 days later, so it is still there if you come back within that time.
• Tonight's pick on your phone is hidden there after 5 am, and deleted from our server by the next sync of any of your browsers on version 1.1.0 or later after that, or after you press Undo.
• A paired phone stays until you remove it in the extension. An unused pairing code is deleted when the next one is made, and cannot be used after ten minutes in any case.
• Uninstalling removes everything the extension stored in that browser, and stops the usage report. It does not delete Pro's copy on our server — see Requests about your data. If you want to be certain your playlists are gone from your other signed-in Chrome browsers as well, delete them in the dashboard before you uninstall, so the deletion is what syncs.
• An answer sent from the page that opens when you remove the extension is kept. An email left with it is deleted 60 days after it was left, and the answer stays without it.

What our server keeps. One record per install, on a server we run at tidywl.com — a Cloudflare Worker with a Cloudflare D1 database, the same one that serves TidyWL for YouTube, in separate tables. It keeps the highest value it has seen for each count and the latest My List size, and three dates — the day only, never a time: the day your install's first report arrived, the day its latest one did, and the latest day one of the counts for something you did (a sync, a removal, an addition, a search, a category, a playlist, a pin, an import, an export or, from version 1.1.0, Play pressed on one of Tonight's picks) went up. Once a day the server also adds every install's figures up into daily totals — how many installs reported in the last week, how many were new, how many did something — kept in tables that name no install, and so kept after the records they were added up from expire. A record that has not been updated for 12 months is deleted; before deletion its install, removal and addition counts are added to a single running total, and after deletion nothing about that install remains.

The server does not keep request logs, does not read or store the IP address your report arrives from, and has no error-tracking service attached. Cloudflare, which fronts the site, rate-limits the endpoint per address at its edge; that happens in Cloudflare's infrastructure under Cloudflare's own policies, and nothing about the address reaches the server or its database.

How to stop it. There is no setting in the extension to turn the report off; uninstalling stops it, and the record then expires after 12 months. We chose not to add a switch rather than add one and design around people flipping it; that trade-off is ours, and this page says so plainly.

What Pro keeps on our server, in the same database and its own tables, never joined with the usage report's: a fingerprint of your key (a bought key is also stored encrypted, so the page you land on after paying can show it to you again, and never in readable form), the plan, whether the subscription is active, past due, cancelled, expired or refunded, whether it is a trial, how many browsers it allows, when the next charge is due and when the paid period ends, and Paddle's own identifiers for the subscription and for you as their customer; one row per payment — Paddle's Transaction ID, the subscription it paid for, which licence, and when it was recorded; one row per browser using it — its name, and when it was activated and last seen; one row per synced profile — its id and name, and which browser last wrote to it; one row per playlist, holding what a sync sends; and one row per phone — what kind of device it is and where it runs, a fingerprint of its pass, and when it was paired and last opened. Not your email, your name, your address or one digit of your card.

Paddle, who takes the money

TidyWL Pro is sold through Paddle, which is the merchant of record — legally the seller, and the one that charges you, files the sales tax and handles refunds. The checkout is Paddle's own form, opened over the pricing page on this site in an ordinary browser tab, never inside the extension.

Your card details, billing address and email go to Paddle, and never to us. What Paddle tells us is: this subscription exists, this is its plan, this is whether it is paid, when the next charge is due and when the paid period ends, and here are Paddle's own reference numbers for the subscription, for you as their customer and for each payment. What Paddle does with what you gave them is covered by Paddle's privacy policy, not this one.

A free trial of 7 days, where Pro offers one, is taken through the same Paddle checkout and needs a card like any subscription: the card goes to Paddle and never to us, and all we learn beyond the above is that the subscription is a trial.

One page loads Paddle's script. The pricing page, tidywl.com/netflix/pricing/, loads Paddle.js from Paddle's own servers so the checkout can open over it. What that script does in your browser is covered by Paddle's policy, not this one. No other page on this site loads anything from Paddle.

The page you land on after paying. When the checkout finishes, the pricing page sends you to a page on this site with the payment's Transaction ID in the address, and that page trades the ID for your key. The address carries nothing else, and the page keeps nothing in your browser.

Finding a lost key. Every Paddle receipt, the first and each renewal, shows that Transaction ID. Paste it into Find my key on the same page, or into the key box under About → Pro in the extension, and it goes to our server once, on its own, to look your key up; the extension then activates that key as if you had typed it. The lookup stores nothing new: the ID is already on our server, recorded when Paddle told us about the payment. The ID alone is enough to see the key, so treat your receipts the way you would the key.

Manage subscription. The button under About → Pro sends your key and this browser's seat number to our server, which looks up Paddle's customer reference for the key, asks Paddle for a signed-in link to that account, and hands it straight back for the browser to open in a new tab. There you can cancel, change your card or download invoices. It happens only when you press the button. That link is a credential, so it is never written down: not stored, not logged, not kept once the tab is open.

When a subscription ends or is refunded, Paddle tells our server, the licence's status changes, and Pro switches off in each browser at its next licence check. Nothing else is sent in either direction.

Requests about your data

The usage record is linked to nothing that identifies you, so there is no way for us to find yours if you ask — we cannot look it up, export it or delete it on request. Expiry is how it is deleted. Everything else the extension holds is in your browser, where uninstalling removes it.

Pro is different, because the key identifies it. Write to support@tidywl.com from any address and quote your key, and we can tell you exactly what is stored under it, or delete it — the licence, every browser and phone on it, every synced profile and playlist, and the payments recorded against it. Deleting it is permanent: the key stops working and cannot be restored, so cancel your subscription with Paddle first. The playlists in your browsers are not touched. Anything Paddle holds, including your email and your invoices, has to be asked of Paddle.

Children

The extension is not directed at children. The usage report is counts and a random identifier, the same for a kids profile as for any other. A Netflix account may have a kids profile, and the dashboard works on one; everything it reads there stays on the machine under that profile's own id, exactly as for any other profile — unless the account holder has Pro and switches sync on while that profile is open, in which case its playlists and its profile name are synced like any other profile's, and a paired phone shows them beside the others'. The rating badges work there as on any other profile: the ids of the cards on the page go to our ratings table, with nothing to say which profile they came from.

Changes to this policy

If the extension's behaviour changes, this page changes with it before the new version ships, and the date at the top is updated. Past versions are in this site's public git history.

Who to ask

Email support@tidywl.com, or ask in the Discord. TidyWL is made by one person, Dominic Lam, and is not a company.

TidyWL for Netflix is an independent extension. It is not affiliated with, endorsed by or sponsored by Netflix, IMDb, Wikimedia or Google.

← Back to TidyWL for Netflix