The short version
- Your Netflix data stays in your browser. Your watch state, your searches and, with Pro, the viewing history and thumbs Tonight reads are never sent to us.
- Your playlists stay in your browser too — unless you have Pro and switch sync on. Then this profile's playlists, with each title's name, year and picture link, and the profile's name, go to our server, so your other browsers and your phone can show them. So does a title you send to your phone from Tonight. Only from browsers where you switched it on. Never for a free install.
- If you buy Pro, your licence key goes to tidywl.com. It switches Pro on and is checked again when you open the dashboard, at most once every 15 minutes. Paddle takes the payment; your card details and your email never reach us.
- What does leave is a random identifier and some counts. After you sync, remove or add titles, search, open a category, use a playlist or Tonight, are shown Pro's offer, or open the dashboard or the My List page for the first time in a day, and, from version 1.5.0, shortly after something fails, the extension sends tidywl.com a random ID for your install and your lifetime totals — how many titles you have removed and added, how many searches you have run, how large your My List is, and so on. Never which titles, never what you searched for, never which profile. From version 1.6.0, the counts of what failed also come with a one-word reason from a fixed list, never free text.
- There is no switch in the extension to turn this off. Uninstalling stops it, and records not updated for 12 months are deleted.
- From version 1.2.1, removing the extension opens one page on tidywl.com, asking why. Its address carries a few facts after a
#, which a browser never sends to our server by itself: the version, your browser's language, how long you had the extension, how many titles you removed and how many days you opened the dashboard. From version 1.6.1 it also carries your install's random ID, if it has one. With that ID, opening the page tells us the extension was removed, with the ID and those facts, so the removal can be read alongside that install's usage counts. Without it, the facts go only with an answer. Your answer is sent only if you press Send, and whether you were on a trial or Pro is never sent. Your email is asked for only after that, is optional, and is deleted within 60 days. Answers are deleted 12 months after the day they arrive. - From version 1.6.1, the dashboard links to a feedback page on tidywl.com, and once, after a big clean-up, asks you to answer a question there. It opens only if you click the link or the button on that ask. An answer there carries what you tapped or typed, whether you're on Free or Pro, the extension's version and where you opened it from. Never your licence key, never your install's ID. Answers are deleted after 12 months.
- There is no account and no sign-in. A Pro key is not an account: there is no password, and we never learn your email. The usage report's identifier is random, made in your browser, and linked to nothing that identifies you: not your Netflix account, not a profile, not your email, not a Pro key. From version 1.6.1 the page that opens when you remove the extension carries it too, so an answer there can be read alongside that install's counts.
- Five other requests leave your browser, and none of them identifies you. A public settings file from tidywl.com; IMDb's public ratings file; Netflix's numeric title ids sent to Wikidata to look up the matching IMDb id; for a title its id cannot match, its name sent to IMDb's search and to Wikidata's; and, from version 1.1.0, Netflix's numeric title ids sent to our own ratings table, which answers with each one's IMDb rating. Each one is described in full below.
- Custom playlists and pins use Chrome's own sync storage. That means Google carries them between your signed-in Chrome browsers. Without Pro sync we never see them.
- Everything about your account is stored per Netflix profile, and uninstalling the extension removes everything it stored in that browser.
- Nothing is sold, shared or used for advertising. There is nothing to sell and nobody to share it with.
What it reads on Netflix
TidyWL for Netflix works by calling netflix.com's own endpoints with the session you are already signed in with, exactly as the Netflix web app does when you use it by hand. It cannot read anything when you are not signed in to Netflix in that browser, and it never asks you for your Netflix password — it never sees one.
It reads, and only when you ask it to:
- Your My List — each title's id, name, type, year, runtime, maturity rating, genres and box-art address. Read when you press Sync.
- Your My List again, for the My List page — from version 1.3.0, each time you open the My List page the extension puts back in Netflix's menu, and again after you add or remove a title there: each title's id, name, picture and maturity rating, in Netflix's order. The page shows them while it is open and stores none of them.
- Your watch state — for each film, how far into it you are; for each show, whether Netflix records it as never watched, started or completed. Read as part of the same Sync.
- Which profile is active — its id, name and language, so everything can be filed under the right profile.
- Search results and genre catalogues — only for a search you typed or a genre you opened. For each search result, and each film in a genre, details such as its year, runtime and number of seasons are then asked for once, and kept for the rest of that page's life.
- A title's details on hover — its synopsis, cast, director or creators, genres, runtime and a still image, asked for once per title when you rest the pointer on a card, and kept for the rest of that page's life so a second look costs nothing. From version 1.3.0, resting the pointer on a title's picture, in the dashboard or on the My List page, opens Netflix's own preview instead, the one Netflix shows on its own rows: Netflix's page loads it, trailer included, exactly as it does there, and the dashboard adds the synopsis, cast and genres from what Netflix loaded for it. The extension's own request above is made only when Netflix's preview cannot open.
- For Tonight — Pro only, from version 1.1.0, and only once you open it. With Surprises from outside My List on, as it is until you switch it off: a few of Netflix's genre catalogues that fit the mood you chose, and details, such as the runtime, of the best-rated few films in them; a mood already read today is not read again. On the poster layout, a larger picture of the main pick, asked for once it has stayed on screen for a moment and kept for the rest of that page's life.
- Your viewing history and your thumbs, for Tonight — Pro only, from version 1.1.0, and only when you open Tonight: the titles this profile has played on Netflix and when, and the titles it has given a thumbs up, down or "love", so Tonight never offers what you have already seen or disliked. Read from Netflix's own viewing-activity service, the one behind Account → Viewing activity, through the session you are signed in with and only for the profile you are using — at most once every six hours, one page of 50 at a time a second apart, and after the first time usually just the newest page. What is kept is the title ids, the time of the last play and the thumb, in this browser only; never a title's name, never an episode, and none of it is sent to us or to anyone.
- Which titles in your My List Netflix is about to remove — from version 1.2.0, as part of Sync. Netflix marks these on the title's picture, and gives a sentence with the last day, such as "Last day to watch on Netflix: October 5". TidyWL asks for those sentences for up to 100 titles at a time, so one or two requests for most lists, and only when you press Sync.
One thing it reads without being asked, from version 1.1.0: the link on each of Netflix's own
title cards, on whatever netflix.com page you are looking at. The link carries the title's Netflix id
(/browse?jbv=<id>), and that id is how the extension puts an IMDb rating badge on the card. It
reads the link and what kind of card it is, never the card's text, skips games, and asks Netflix nothing for
it. The ids go to our ratings table, request 8 below, and, when that cannot answer, to Wikidata, request 3.
Some titles cannot be matched by their id at all, because Wikidata has no Netflix id recorded for them. For
those, and only those, the extension takes the title's name and year from what the Netflix page has already
loaded to draw that card — it asks Netflix nothing for it — and searches by name, requests 4 and 3. A click on
a badge opens that title's page on imdb.com in a new tab. From version 1.5.0 you can switch the badges off in
the toolbar popup's Settings, everywhere or only on the My Netflix page and the My List page; wherever they are
off, no card's link is read and no id is sent for the badges.
Your search terms go to Netflix, on your own signed-in session, in the same way that typing them into Netflix's own search box would. They do not go anywhere else.
It writes two things to Netflix, and only on your instruction: adding a title to My List, and removing one. Both are the same operations the Netflix web app performs; both are confirmed before a batch runs. Custom playlists are not written to Netflix — see below.
What stays in your browser
Everything above is cached in the extension's own storage so that the dashboard can sort, filter and search hundreds of titles without asking Netflix again. Opening the dashboard never asks Netflix for anything — reading Netflix is what the Sync button is for. This is a privacy property as much as a speed one, and it is also why the extension does not quietly re-read your account in the background. Opening it can make requests to tidywl.com, never to Netflix: the usage report, at most once a day and only when a count has changed; the settings file, request 1, at most once an hour; and, with Pro, the licence check and playlist sync, requests 6 and 7. The first two carry no title and nothing from your account.
The one exception, from version 1.3.0, is the My List page in Netflix's menu. It shows your list as Netflix has it now, so it reads it from Netflix each time it opens, and it stores nothing it reads.
Held in chrome.storage.local, which never leaves the machine:
| Key | What is in it |
|---|---|
tidywl_titles_<profile> | Your My List: id, title, type, year, runtime, maturity, genres, box-art address. |
tidywl_last_synced_<profile> | When you last pressed Sync. |
tidywl_show_states_<profile> | Per show: never watched, started, or completed. |
tidywl_first_seen_<profile> | The first date this extension saw each title in your list. Netflix does not record when you added something, so this is the extension's own note, and it only starts from your first Sync. |
tidywl_imdb | The IMDb id and rating found for each Netflix title, so the lookup is not repeated. This one is not filed per profile, because a title's IMDb rating is the same whoever is watching, and the key holds no indication of whose list a title came from. |
tidywl_remote_config | A copy of the public settings file described below. |
tidywl_dashboard_view | Whether you last had the dashboard full-page or as a panel, and, from version 1.5.0, whether the IMDb ratings show on the dashboard's own cards, which its IMDb switch sets. Hiding them does not change what is looked up. |
tidywl_imdb_dump_fetched_at | When IMDb's ratings file was last downloaded, so it is not downloaded again for twelve hours. A timestamp and nothing else. |
tidywl_badge_ratings | From version 1.1.0. What the badges on Netflix's own cards show, so a card seen again is not asked about again: for each Netflix title id, its IMDb id, rating and number of votes, whether the rating is the whole series', when it was found, and whether it came from our ratings table or from this browser's own lookups — with, when Wikidata had no match, when it was asked. Each title is asked about again after a day; at most 5,000 are kept. Not filed per profile: it holds the ids of titles Netflix's pages showed in this browser, with no note of which page, row or profile. Never sent. |
tidywl_badge_mode | From version 1.5.0. Where the badges on Netflix's own cards show, as you set it in the toolbar popup: all, lists-off (not on the My Netflix page or the My List page) or off. Absent until you change it, which means all. One setting for the browser, not per profile. Which of the three it is goes in the usage report, as badge_mode. |
tidywl_badge_look | From version 1.5.0. How the badges look, chosen beside that setting: split, the yellow and black tab; meter, the same with a score bar; or pill, a black badge like the dashboard's. One for the browser, not per profile. Never sent. |
tidywl_mobile_interest_clicks | A count of how many times you pressed the Sync to mobile button, which opens Pro in the About window, or Pro's offer if you do not have Pro. Since version 0.2.0 it is sent, as one of the usage report's counts — it is how the developer learns whether mobile sync is wanted. |
tidywl_install_id | The random identifier the usage report carries. Made once, in your browser; linked to nothing that identifies you. From version 1.6.1 it also goes in the address of the page that opens when you remove the extension. |
tidywl_usage | The usage report's other counts, listed field by field below. |
tidywl_usage_open_day | The last day the dashboard was counted as opened, so it is counted at most once a day. Never sent. |
tidywl_usage_badge_day | From version 1.2.2. The last day the rating badges were counted as shown, so that is counted at most once a day too. Never sent. |
tidywl_usage_mylist_day | From version 1.4.0. The last day the My List page was counted as opened, so that is counted at most once a day too. Never sent. |
tidywl_usage_failure_sent_at | From version 1.5.0. When this browser last asked for the usage report to go out early, after something failed, so it asks at most once every ten minutes. A timestamp and nothing else. Never sent. |
tidywl_usage_sent | The counts as they stood at the last report that arrived, so an unchanged report is not sent again. Never sent. |
tidywl_license_token | Pro only. A sign-in our server gave this browser, good for 24 hours, so a sync does not send your key every time. Never shared between browsers. |
tidywl_cloud_sync | Pro only. Whether you switched sync on in this browser — it is off until you do — and when the last sync ran and whether it worked. |
tidywl_sync_deleted_<profile> | Pro only. The ids of playlists you deleted in this browser, with when, so the deletion reaches your other browsers instead of the playlist coming back from one of them. An id and two times each, no name; kept 90 days, at most 200. |
tidywl_removed_<profile> | Pro only — a free install writes nothing here. Removal history, for Undo and Restore: each title you removed from My List through the extension, as its id, name, type, year, box-art address, the date this extension first saw it in your list, and, for a Move, the playlist it went to. Pruned to the last 90 days on every read and write. |
tidywl_stats_<profile> | The Stats tally, kept for everyone after a Sync so that the numbers exist if you turn Pro on later: the ids that were in My List at the last Sync, the ids not yet started or partway through, and for each month a count of titles added, watched and removed. Counts and ids, no names. |
tidywl_tonight_<profile> | Pro only, from version 1.1.0 — a free install writes nothing here. What Tonight remembers for this profile: your occasions, up to five — the name you give each one, the who's watching, how long and mood it stands for, its icon (before version 1.2.0) and when you last used it; your last answers, when you gave them and the picks they dealt, so opening Tonight again within four hours shows the same picks; the films you pressed Play on in the last day, so they leave the picks; for With family, the youngest viewer's rating level you chose; whether surprises from outside My List are on; the poster or the cards layout; each title you put off with Not tonight and until when (seven days), when you did so over the last thirty days — so a title you keep putting off can be marked in My List — and the id of the last main pick shown, so the next one is a different title. Titles by id; the only names are the ones you give your occasions. Pruned on every read and write. Never sent. |
tidywl_tonight_pool_<profile> | Pro only, from version 1.1.0. Today's surprises for Tonight: the rows it read from Netflix's genre catalogues — each title's id, name, type, year, maturity rating, season count and box-art address as Netflix returned them, and each genre's name — with the IMDb rating and votes found for each title, the runtime of the few films it read one for, and which moods were asked for today. Anything older than a day is dropped on the next write. Never sent. |
tidywl_viewed_<profile> | Pro only, from version 1.1.0. What Tonight knows you have already watched or rated on Netflix, so it does not offer it: for each title id — a film's, or the show's for an episode — when it was last played, and each rated title's thumb (down, up or love), with when it was last read. At most 5,000 of each, newest kept. Never sent anywhere; removed when you uninstall. |
tidywl_tonight_phone_<profile> | Pro only, from version 1.1.0 — a free install writes nothing here. The one title you sent to your phone with Later, on my phone in Tonight: its id, name, type, year and box-art address, when you sent it, when you undid it, and when it reached our server. It is kept apart from your playlists, so Chrome's own sync does not copy it. Forgotten once its 5 am has passed or it was undone, and nothing is left to send. |
tidywl_leaving_<profile> | From version 1.2.0. The titles in this profile's My List that Netflix says are leaving: each one's Netflix id, Netflix's sentence as Netflix wrote it, and when TidyWL first saw it leaving. Also the time of that Sync, the profile's name, and whether it is a Kids profile. Replaced at every Sync. Never sent. |
tidywl_leaving_seen_<profile> | From version 1.2.0. When this profile last opened the toolbar popup, opened Tonight, and saw the "leaving" notice, so "new" means new since you last looked. Times only. Never sent. |
tidywl_last_profile | From version 1.2.0. The id of the Netflix profile last used in this browser, and when, so the toolbar badge and popup show that profile's list. Never sent. |
tidywl_installed_at | From version 1.2.1. When the extension was installed in this browser, so the page Chrome opens after a removal can say roughly how long you had it: under an hour, a day, a week, a month, or longer. Only that rough span ever leaves, and only if you press Send there. Installs from before 1.2.1 have none. |
tidywl_playlist_cap_exempt | true in a browser that had the extension before version 1.0.0, so it keeps making up to 50 playlists without Pro. Nothing else. |
tidywl_rating_ask_dismissed | true once a rating ask has been answered or declined, so no rating ask is shown again in this browser: the one on a removal's summary and, from version 1.4.0, the band at the top of the dashboard or the strip in the My List page's heading. |
tidywl_rating_band_shown | From version 1.4.0. true once the rating ask at the top of the dashboard or in the My List page's heading has been shown, so it appears at most once in this browser, answered or not. Never sent. |
tidywl_support_ask | What the Ko-fi ask on a removal's summary needs in order to appear rarely: a count of titles removed, added or copied into a playlist, the count at the last time it was shown, how many times it has been shown, and whether its tile was pressed. Never sent. |
tidywl_announcements_read | From version 1.5.0. Which of the dashboard's announcements you have read, so the bell's dot and the window that opens once know what is new: their ids only, the newest 200. One list for the browser, not per profile. Never sent. |
tidywl_issues_seen | From version 1.6.0. What the dashboard has already shown you of the known issues, so a closed notice stays closed until the issue changes and an issue opens as a window only once: four short lists of the issues' ids (and, for the closed notices and the bell's dot, which revision of each), the newest 100 in each. Ids from the settings file only, nothing about you. One record for the browser, not per profile. Never sent. |
tidywl_feedback_ask | From version 1.6.1. When a clean-up of several titles queued the feedback card, and whether the card has been shown, so it appears at most once in this browser, answered or not. One record for the browser, not per profile. Never sent. |
And in chrome.storage.session, which Chrome clears when it closes: tidywl_popup_intent,
from version 1.2.0 — a popup button you pressed while not on Netflix (which button, for which tab, and when),
held for two minutes until the Netflix tab opens.
From version 1.2.0 the toolbar popup shows each leaving title's picture. It loads from Netflix's image servers, at the address saved at Sync, the same way the dashboard's pictures do.
One more thing is held locally and is not a key: the browser's own Cache Storage keeps a copy of
IMDb's ratings file under tidywl-imdb-dump for twelve hours, so that a page of results does not
pull 8.6MB again. It is IMDb's public file, identical for everyone, and it says nothing about you.
Every key that holds something about your account carries your Netflix profile's id in its name. There is
deliberately no shared fallback key: an adult profile's list cannot appear under the kids profile on the same
account, because there is no place for the two to meet. If the extension cannot tell which profile is active,
it stores nothing. The keys without a profile in their name — the settings copy, the dashboard's view, the IMDb
ratings, that file's download time, the badges' ratings, setting and look, the count of Sync-to-mobile presses, the seven usage-report keys, the three
Pro keys without one, the note that this browser had the extension before 1.0.0, the three records of the rating and
Ko-fi asks, when the extension was installed, the announcements you have read and the known issues you
closed or were shown — hold nothing that belongs to a profile, with one exception:
tidywl_last_profile holds the id of the Netflix profile last used in this browser, and when, so the
toolbar badge and popup know whose list to show. It is one record for the whole browser, not one per profile; it
holds no name and no list, and it is never sent. The usage counts are added up across every profile that used the extension
in that browser, and never say which.
Custom playlists, pins, and Chrome's sync
A custom playlist is a name you typed and a list of Netflix title ids. Nothing else — no titles, no images, no descriptions. Those are looked up again each time the playlist is shown.
Playlists are held in chrome.storage.sync rather than local storage, under
tidywl_playlists_<profile> and tidywl_playlist_<profile>_<id>.
Two smaller things sit there with them, for the same reason — so that they follow you to your other computer:
tidywl_pinned_<profile>, the title ids you have pinned so that a bulk remove cannot take them,
and tidywl_archive_playlist_<profile> and tidywl_archive_playlist_stale_<profile>, which playlist each of the two clean-up rules moves titles into — a single id each.
That is Chrome's own sync, which means Google replicates them between the Chrome browsers you are
signed in to, under Google's terms and Google's encryption, exactly as it does your bookmarks. It is a
feature — your playlists follow you to your other computer for free — but it is also the one place anything
you made in this extension leaves the machine, so it is worth stating plainly:
- It goes to Google, not to us. Chrome's sync gives us no copy, no key and no way to read it. Pro sync is a separate, second copy, described in the next section, and only exists if you switch it on.
- It is playlist names and numeric title ids. Name them whatever you like — a playlist name is text you wrote, and it travels with the ids. A pin is an id alone.
- You can turn it off in Chrome's own settings, under You and Google → Sync and Google services, by excluding extensions from sync. Playlists and pins then stay on that machine.
Playlists are never written to your Netflix account. Nobody else on the account sees them, and Netflix is not told they exist.
A Pro key is kept here too, under tidywl_license: the key itself, whether the
subscription is active, this browser's seat number and the name you gave it, and the names of the other
browsers using the key — so the key follows your Chrome profile to your other computers, as a bookmark would.
Pro: your playlists on our server
TidyWL Pro keeps your playlists in step between browsers that Chrome's own sync does not reach — Brave, another Google account, another computer — and shows them on your phone. To do that it has to send them to a server, and the server is ours. Everything in this section happens only with a Pro key, and only in a browser where you switched on Sync playlists to your phone and other browsers under About → Pro. It is off until you do.
What a sync sends, for the Netflix profile open in that tab and no other:
- the profile's id and its name, as Netflix shows it — so your phone can say whose playlists they are;
- each playlist's id, name, and when it was made and last changed — the newest change wins when two browsers disagree;
- each title in it: Netflix's id, and, where this browser knows them, its name, whether it is a film or a series, its year, and the address of its picture on Netflix's image servers. The picture itself is never copied to us;
- for a playlist you deleted, its id and two times, and nothing else — so it does not come back from a browser that still has it.
When: when you open the dashboard, a few seconds after you change a playlist, and when you press Sync now. Each sync first asks the server for its copy, then sends what is newer here.
Not sent, even with sync on: your My List — except the one title you send to your phone, below — your watch state, your searches, your pins, your IMDb ratings, or another profile's playlists. Your Netflix password is never seen by the extension at all.
Your phone
Under About → Pro → Phones, Pair a phone shows a six-character code and a QR code. The code works once,
for ten minutes. Your phone opens tidywl.com/netflix/app/ — scanning the QR code carries the code
in the part of the address after #, which is never sent to any server — and swaps the code for a
pass of its own. Your licence key never reaches the phone.
- A pass reads the synced playlists of every profile under your key, and nothing else — so a paired phone shows all of them, as the Netflix app does, including a kids profile's. It cannot change anything, and it cannot be used to sync.
- The phone tells our server what kind of device it is and, on an iPhone, where the page runs — "iPhone · Safari", "iPhone · Home Screen app", "Android phone" — so you can tell your phones apart in the list. Nothing more specific.
- Scan code uses the phone's camera only while the scanner is open, and reads the QR code on the phone. Nothing from the camera is sent anywhere; the code reader itself is served from tidywl.com, not from a third party.
- The phone keeps its pass and the last copy of the playlists in that page's own storage, so the page opens straight away, and whether you chose not to add it to your Home Screen. Forget this phone removes both from the phone, and the phone's row from our server.
- Titles' pictures load on the phone straight from Netflix's image servers, which see the request as they would from the Netflix app.
- Remove, beside a phone in the extension, stops that pass for good. The next time the phone opens the page, it deletes what it kept.
Tonight's pick, on your phone — from version 1.1.0. When you press Later, on my phone under a pick in Tonight, that one title goes to our server at once — if sync is off in that browser, Tonight asks you to switch it on first, and sends nothing until you do: its Netflix id, name, whether it is a film or a series, its year and the address of its picture, as a playlist named Tonight's pick in the same copy your paired phones read. Nothing else from Tonight or your My List goes with it, and nothing goes unless you press it. Your phone shows it above your playlists and hides it after 5 am. It is deleted from our server by the next sync after 5 am of any of your browsers on version 1.1.0 or later, or by the next sync after you press Undo; a title sent later replaces it. A browser still on version 1.0.0 lists it as an ordinary playlist until the deletion reaches it. The phone remembers when the last pick it opened onto was sent, so it opens on that pick's profile once.
The requests that leave your browser
These are every outbound request the extension makes other than to netflix.com. There are no others; they are
the only fetch calls in the extension's background worker, nine of them, because the sixth has
two. The first four carry no
identifier, no cookie, no account, and nothing that distinguishes your copy from anyone else's. The fifth, the
usage report, carries the random identifier described with it — and nothing else about you. The sixth and
seventh are Pro's, and a free install never makes them. The eighth, new in version 1.1.0, carries Netflix
title ids and, like the first four, no identifier, no cookie and no account.
1. A public settings file, from tidywl.com
The extension fetches https://tidywl.com/config/netflix-config-v1.json when you open the dashboard
or press Sync; from version 1.1.0, the first time a Netflix page shows title cards after it loads; and, from
version 1.3.1, while you use Netflix with it, each tab looking at most every ten minutes at how old its copy
is. It is fetched at most once an hour in all, and the extension never waits for it. It holds a handful of values, such as the support
links shown in the About dialog and the Pro prices on the upgrade card, so that small things can be corrected
without shipping a new version. From version 1.1.0 it can also switch IMDb ratings off: while it does,
requests 2, 3, 4 and 8 are not made, the badges come off Netflix's cards, and the dashboard hides the ratings
it saved. It can switch Tonight's reading of your viewing history off the same way, and correct the address
that reading uses on netflix.com if Netflix moves it — never to anywhere outside netflix.com.
From version 1.3.1 it can also correct the names, ids and settings the extension uses with Netflix, the ones a Netflix update can change, so that a break like the one that stopped Search on 8 October 2026 can be fixed without a new version. These corrections are bounded in the extension's code: they can only point at netflix.com, they never choose which titles are added to or removed from your list, and a value that fails its check is ignored in favour of the built-in one. The file carries none of them except while Netflix has broken something.
From version 1.5.0 it also carries the dashboard's announcements: what is new, listed under the bell in the dashboard's header, and now and then opened once as a window. Each is a title, a few lines of text and perhaps a button; a link in one opens only if you press it, and can only lead to tidywl.com, Discord, the Chrome Web Store or Ko-fi. They are words, never code or pictures, and they come with the file, so they add no request. Which ones you have read stays in your browser. The usage report counts how often such a window opened and how often the button with its link was pressed, never which announcement. The same file can also stop the usage report going out early after a failure, described under request 5.
From version 1.6.0 it also carries a list of known issues: which part of the extension is affected, whether we
are still looking into it or know the cause, a workaround if there is one and, once it is fixed, what was done
and when. Like the announcements it is words only and comes with the file, so it adds no request. The
dashboard shows it, and an issue that affects everyone can open once as a window. Which issues you have closed
and which have been shown to you stays in your browser, in tidywl_issues_seen. None of it is
counted in the usage report.
Each known issue has a Report button. It opens a ready-made email to [email protected] in your own mail app, or copies the same text, and the text holds only the issue's title, the extension's version, Chrome's version and your operating system. You read it and send it yourself; the extension sends nothing. The sheet also links to our Discord, which opens only if you press it.
The request carries no identifier and no payload; every install receives the same bytes. Nothing in the file is executed as code, and the extension works normally with the file deleted, unreachable or malformed — every value in it has a built-in default. Like any web request it reaches our host with your IP address, which is not recorded against anything and is not retained.
2. IMDb's public ratings file
To show an IMDb rating on a card, the extension downloads
https://datasets.imdbws.com/title.ratings.tsv.gz — IMDb's own daily public dataset, about 8.6MB,
covering every title IMDb rates. It is downloaded at most once every twelve hours, kept in the browser, and
searched in your browser for the ids you need.
The important consequence: this download tells IMDb nothing about which titles you have. The extension asks for the whole file, exactly as anyone else does, and does the matching itself. IMDb sees a download, not a request about you. The one request that does name a title to IMDb is the fourth, below, and it is made only for a title that cannot be matched by its id.
3. Netflix title ids — and sometimes a title's name — to Wikidata
IMDb's file is keyed by IMDb id, and Netflix's titles are not. To bridge the two the extension queries
https://query.wikidata.org/sparql, Wikidata's public query service, with a list of
Netflix's numeric title ids — up to 250 at a time — and asks which IMDb id each corresponds to.
Some titles are on Wikidata without their Netflix id recorded, so an id finds nothing. For those, and only
those, the extension searches Wikidata by the title's name, as Netflix shows it, one title
per request, with the language to search in taken from your Netflix profile (for example en). It
accepts an answer only when exactly one film or series has that name, that kind and a matching year; otherwise
the title simply has no rating. The year is compared in your browser, against what Wikidata sends back — it is
not sent. A title with no year to go on is never searched by name.
What Wikidata receives is numbers, or a title's name and a language code, plus the extension's name. A name says nothing its id did not — the id already names the title. Not your profile, not your account, not an identifier of any kind, and nothing that says the titles are a personal list rather than any other set. Wikidata's own privacy policy governs what Wikimedia does with the request.
4. A title's name — to IMDb's search, when its id cannot be matched
Some titles are not on Wikidata at all yet — most often ones released in the last few months — and some are
there without their Netflix id. In the dashboard, for a title that both Wikidata requests above have tried and
failed to match, and only for those; for the badges on Netflix's own cards, for a title neither our ratings
table nor Wikidata could match by its id, before Wikidata's name search, because IMDb answers in under a second
and Wikidata can take most of a minute. For those titles, and only those, the extension sends its
name, as Netflix shows it, to https://v3.sg.media-imdb.com/suggestion/, the
address behind the search box on imdb.com, one title per request. It accepts an answer only when exactly one film
or series comes back with that name, that kind and a matching year; otherwise the title simply has no rating. As
with Wikidata, the year is compared in your browser and not sent, and a title with no year is never searched
by name.
What IMDb receives is the title's name, in the address of the request, and nothing else. The request is made with cookies switched off, so even if you are signed in to IMDb in this browser it is not tied to your IMDb account. Not your profile, not your Netflix account, not an identifier of any kind. Like any web request it reaches IMDb with your IP address. IMDb's own privacy notice governs what IMDb does with the request.
When requests 2, 3 and 4 happen: when you press Sync, for the titles in your list; when a page of search or genre results is drawn, for the titles on it; for Tonight, for the few films whose details it reads; and, from version 1.1.0, for the badges on the Netflix cards on your screen, for the titles their ids could not match. All three are answered from the browser's own copy once a title has been matched, so a matched title is never asked about again; a title that could not be matched is asked about again after a week — by id, then by name on Wikidata, then by name on IMDb — at most 40 names at a time for each.
From version 1.1.0, requests 2 and 3 also stand in for our ratings table, request 8, when it refuses, is down or does not answer within eight seconds. For the badges, the ids it could not answer go to Wikidata by id, and their ratings come from IMDb's file; a title that neither the table nor Wikidata can match by its id is then searched by name, as above, at most 40 at a time, and a title neither name search finds is not searched again for a week. Tonight does the same by id for its surprises; only the few films whose details it reads can also be searched by name, as above. After such a failure the badges leave the table alone for a quarter of an hour and use these two instead, and they ask Wikidata again about a title it had no match for only after a week.
From version 1.5.0 you can turn the badges off yourself: in the toolbar popup's Settings, Off everywhere stops the badges on Netflix's own cards and every request for their ratings, and Off on My Netflix and My List does the same on those two pages only. The setting does not reach the dashboard or Tonight, which look ratings up as described above whatever it says. The dashboard's IMDb switch hides the ratings on its own cards and changes nothing about how they are looked up.
5. A usage report, to tidywl.com
From version 0.2.0, each install carries a random identifier, made in your browser the first time a report is sent. It is not derived from, linked to, or stored alongside your Netflix account, a profile, your email or anything else about you, and it is not shown anywhere in the extension. Reinstalling makes a new one. From version 1.6.1 it also goes in the address of the page that opens when you remove the extension, so an answer there can be read alongside these counts (the page that opens when you remove it).
Whenever one of your lifetime counts has changed, the extension sends that identifier and the counts to
https://tidywl.com/api/netflix/installs. It checks on each Netflix page load, after a Sync, after a
removal, the first time you open the dashboard on a given day, the first time the rating badges show on a given day,
and, from version 1.4.0, the first time you open the My List page on a given day.
From version 1.5.0 it can also go out shortly after something fails. When one of the five failure counts in the table below goes up, the extension asks for the report at once instead of waiting for one of those moments, so that a Netflix change that breaks something shows up within minutes. This browser asks that way at most once every ten minutes, so at most 144 times in a day; on a day when nothing fails, never. It is the same report to the same address, with nothing added. The settings file, request 1, can switch this early asking off; that stops only the early asking, and the report then goes at the moments above, as before. The report is exactly this, and nothing else:
| Field | What it is |
|---|---|
| identifier | The random install ID described above. |
| open_days | On how many days you have opened the dashboard, ever. It goes up by one at most once a day, however many times you open it that day. |
| syncs | How many times you have pressed Sync and it completed. |
| list_size | How many titles were in your My List the last time it was read — the latest number, not a total, and not which profile's list. |
| removed | How many titles you have removed from My List with the extension, ever — one by one, in bulk, or by moving them to a playlist. |
| removal_runs | How many removals you have run — one per batch, whatever its size. |
| added | How many titles you have added to My List with the extension, ever, from search, a category, or an imported file. |
| searches | How many searches you have run in the Search tab. Not what you searched for. |
| genres_opened | How many categories you have opened in the Search tab. Not which ones. |
| playlists_made | How many playlists you have created by hand. |
| playlist_adds | How many titles you have copied or moved into a playlist. |
| pins | How many titles you have pinned. |
| imports | How many files you have imported into My List or Playlists. |
| exports | How many files you have exported. |
| mobile_clicks | How many times you have pressed Sync to mobile, the same number the popup shows you. It includes presses from before version 0.2.0. |
| paywall_pin | How many times Pro's offer has been shown because you tried to pin a title without Pro. |
| paywall_undo | The same, for Removal history, where Undo is. |
| paywall_stats | The same, for Stats. |
| paywall_rules | The same, for either clean-up rule. |
| paywall_sync | The same, for the Sync to mobile button. |
| paywall_playlists | The same, for a new playlist past the free limit. |
| paywall_tonight | The same, for Tonight. |
| upsell_views | How many times Pro's offer has been shown for any reason, including from the About window. |
| upgrade_clicks | How many times you have pressed Upgrade to Pro on that offer, which opens the checkout. Not whether you went on to buy. |
| demo_clicks | How many times you have pressed a feature's demo on that offer (its picture, or See … in action), which opens that feature's section on tidywl.com. Not which feature. |
| tonight_opens | How many times Tonight has opened with a pick to show. |
| tonight_plays | How many times you have pressed Play on one of Tonight's picks. Not which title. |
| tonight_plays_outside | How many of those were a surprise from outside My List. |
| tonight_rerolls | How many times you have pressed Re-roll. |
| tonight_snoozes | How many times you have pressed Not tonight. Not on which title. |
| badge_days | On how many days the IMDb rating badges have shown on Netflix's own pages, ever. It goes up by one at most once a day, like open_days. Not which titles, and not how many badges. |
| mylist_days | On how many days you have opened the My List page the extension puts back in Netflix's menu, ever. It goes up by one at most once a day, like open_days. |
| mylist_title_clicks | How many times you have clicked a title on the My List page to open it. Not which title. Nothing you press inside Netflix's own preview is counted. |
| rating_asks | How many times the extension has asked you for a rating: on a removal's summary, at the top of the dashboard, or in the My List page's heading. |
| rating_clicks | How many times you have pressed Rate it, on one of those asks or on the tile in the About window, which opens the extension's page on the Chrome Web Store. Not whether you went on to rate it. |
| badge_mode | Which setting you chose for the IMDb badges on Netflix's own cards: 0 for on everywhere, 1 for off on My Netflix and My List, 2 for off everywhere. The setting as it stood at the last report, not a total. |
| announce_views | How many times an announcement has opened as a window on the dashboard. Not which one. Opening the bell's list is not counted. |
| announce_clicks | How many times you have pressed the button on such a window that opens its link. Not which one, and not Not now or Got it. |
| sync_short | How many times a Sync finished but left part of its reading undone, and the dashboard said so: watch state it could not finish reading, shows left unchecked, or a Leaving soon check Netflix did not answer in full. At most one per Sync. |
| reads_refused | How many times Netflix did not answer something the extension asked it to read — My List, a search, a category, the details of their results, watch state, Leaving soon, or the My List page — and the extension told you so. Not what was being read. |
| ops_rejected | How many times Netflix refused one of the extension's requests outright, as it does when a Netflix update changes what it expects, rather than simply not answering — and the extension told you so. Not which request. |
| removals_failed | How many titles a removal, a Retry or a Move asked Netflix to take out of My List and Netflix refused, as the removal's summary then says. Not which titles. A title left alone because you pressed Stop is not counted. |
| mylist_page_failed | How many times the My List page could not show your list and said so. |
| leaving_opens | How many times you have opened the toolbar popup while it listed titles leaving Netflix. |
| preview_dwells | How many times resting the pointer on a title in the dashboard asked Netflix about that title: the extension's own preview request, or Netflix's own preview opening on it for the first time on that page. Not which title. |
| badges_rated | How many titles have shown an IMDb rating badge on Netflix's own pages, each title counted once each time a Netflix page loads. Not which titles. |
| badges_blank | The same, for titles whose every lookup finished without a rating to show. |
| sync_short_reason | Why sync_short last went up, as the number of one word on the list below. Not a total. |
| reads_refused_reason | The same, for reads_refused. |
| ops_rejected_reason | The same, for ops_rejected. |
| removals_failed_reason | The same, for removals_failed. |
| mylist_page_failed_reason | The same, for mylist_page_failed. |
| feedback_asks | How many times the extension has shown the feedback card, the ask that appears once after a big clean-up. |
| feedback_clicks | How many times you have pressed Answer one question on that card, which opens the feedback page. Not whether you went on to answer. |
The fifteen from paywall_pin to tonight_snoozes were added in version 1.1.0. Before
it, the report was the identifier and the fourteen above them. badge_days was added in version
1.2.2, because someone who only
uses the badges never opens the dashboard, and without it would look like someone who stopped using the
extension. The four from mylist_days to rating_clicks were added in version 1.4.0: the
My List page, like the badges, is used without opening the dashboard, and the last two show how often a rating
is asked for and how often the ask is taken up. The twelve from badge_mode to
badges_blank were added in version 1.5.0. Five of them, from sync_short to
mylist_page_failed, count failures the extension has already shown you, so that a Netflix change
that breaks something is seen within minutes rather than when someone writes in; the others show whether the
badge setting, announcements, the popup's Leaving soon list and hover previews get used, and how often a badge
finds a rating.
From version 1.6.0 the report also says why. The five from sync_short_reason to
mylist_page_failed_reason give, for each failure count, the reason of the latest failure of that
kind, so that a count of failures also says why they happened. Each is sent as the number of one word on a fixed
list built into the extension, and nothing else: never a title, never an id, never an error message or any other
text. The list, in order from 0: unknown (the extension cannot tell), timeout (Netflix
did not answer in time), no_answer, server_error (Netflix answered with a server
error), rate_limited, signed_out, netflix_error (another error from
Netflix), stopped (Netflix stopped answering partway), partial (some titles went
unanswered), refused and id_not_found (Netflix refused one of the extension's
requests), needs_variable (a request Netflix now expects more from), write_not_found
(Netflix's code for removing a title was not found), no_data_layer (Netflix's page had not loaded
its data), watch_state and leaving (the part of a Sync that came short).
From version 1.6.1 the report also counts the feedback card. The two last in the table,
feedback_asks and feedback_clicks, show how often the card is shown and how often it is
taken up, as rating_asks and rating_clicks do for the rating ask. Like those, they are
lifetime totals.
Never sent: a title, a Netflix or IMDb id, what you searched for, a category's name or id, a
playlist's name or contents, a profile's name, id or how many profiles there are, a rating, your watch state,
the time you did anything, the extension's settings other than the badge setting in badge_mode, or
an IP address the extension has read. The report has no
field that could hold any of these, and the server refuses a report carrying anything it does not expect, so
none can be sent by mistake.
Days opened is a number, not a diary. The report carries how many days, never which days, what time or for how long. The server does note the date each report arrives and, from version 1.5.0, the hour of one in which a failure count went up; see How long anything is kept.
There is no timer and no install beacon. A report is sent only when one of the numbers above has changed. An install that has never done anything counted above sends nothing at all, and an install that is idle sends nothing while it is idle. If a report cannot be delivered it is not retried or stored; the same counts simply go the next time one of the moments above comes round.
Why: to know how the extension is actually used — how many people open it in a week, which of its three tabs they use, how large a My List gets, and whether anyone wants mobile sync enough to press a button for it; from version 1.1.0, which of Pro's features people reach for and whether Tonight gets used; from version 1.4.0, whether the My List page gets used; and, from version 1.5.0, whether a Netflix change has just broken something — which decides what gets built, and fixed, next. Store reviews come from a self-selected few; this is the only other signal. The numbers are not sold, not shared with anyone, and not used for advertising.
6. A licence check, to tidywl.com — Pro only
When you enter a key, the extension sends it to https://tidywl.com/api/netflix/license/activate with
the name for this browser, pre-filled as something like "Chrome on Mac" and changeable. The server answers with
the subscription's status, the browsers using the key, and a 24-hour sign-in for this browser. Later checks, when
you open the dashboard at most once every 15 minutes, send the key and this browser's seat number. Deactivate
this browser, and Remove beside another browser, send the key and that seat's number.
Manage subscription sends the key and this browser's seat number to
/api/netflix/license/portal.
If you enter a Transaction ID from a Paddle receipt instead of a key, the extension first sends that ID, and
nothing else, to https://tidywl.com/api/netflix/license/claim, which answers with the key it paid for;
that key is then activated as above. Both are described under Paddle, who takes the money.
From version 1.1.0 you do not have to paste the key after buying. The page tidywl.com shows after checkout,
/netflix/checkout/success/, hands the key it shows you to the extension, if the extension is
installed in that browser, and the extension activates it exactly as above, with the same pre-filled browser
name. This is the only page on tidywl.com the extension runs anything on. It tells the page only whether Pro
was switched on — never the key back, and nothing else from your browser. A different key already active in
the browser is never replaced.
7. Playlist sync and phones, to tidywl.com — Pro only
Syncs go to https://tidywl.com/api/netflix/sync and carry exactly what Pro: your playlists on
our server lists. Pairing a phone asks /api/netflix/pair for a code and sends nothing else; the
phone list and Remove use /api/netflix/phones. All of them carry this browser's 24-hour sign-in, never
the key.
8. Netflix title ids, to our ratings table at tidywl.com — from version 1.1.0
To put an IMDb rating on Netflix's own title cards, the extension sends
https://tidywl.com/api/netflix/ratings a list of Netflix's numeric title ids, up
to 200 in a request, and the server answers with the IMDb id, rating and number of votes it has for each. It
asks about the cards on the Netflix page you are looking at as they appear, one request at a time, never about
the same title twice in one page load, and not at all about a title it rated in the last day. Tonight, in Pro,
uses it too: one request for the surprises it found in Netflix's catalogue, which leave out every title in your My
List as of your last Sync.
The ids are those of whatever cards Netflix shows on the page, in any row; nothing in the request says which row a card was in.
What the server receives is the ids, and nothing else — no install identifier, no profile, no title's name, nothing from the dashboard's copy of your list, and no cookie: the request is sent from the extension's background worker with cookies switched off. The server writes nothing down about it — no log of the request and no record of which ids were asked for. Like any web request it reaches our host with your IP address, which goes only to a rate limiter, 60 requests a minute from one address, and is not stored.
The ratings in the answer are IMDb's, matched to Netflix ids on our server from Wikidata and IMDb's daily public file — the sources of requests 2 and 3 — for every title Wikidata links, not for the titles anyone asked about. When the table cannot answer, the extension uses requests 2 and 3 instead, as described under them. The settings file, request 1, can switch it off.
What the extension does not do
- No record of what you watch or search for. The usage report above counts how often you did things, never what they were done to. The only titles we keep are the ones in playlists you chose to sync with Pro. The ratings table, request 8, receives title ids to answer and keeps none of them.
- No account. Pro is a key, not an account: no password, no email, no profile with us.
- No third-party analytics, tag manager, advertising pixel or session recorder. None, anywhere, including on this page.
- No reading of other sites. It runs on netflix.com and nowhere else.
- No video. It does not download, record, decrypt or touch Netflix video in any way.
The permissions it asks for, and why
| Permission | Why |
|---|---|
storage | The cache and the playlists described above. Nothing else uses it. |
https://*.netflix.com/* | The product. The dashboard is injected into Netflix pages and reads your list through Netflix's own endpoints, and the rating badges are drawn on Netflix's own title cards. |
https://datasets.imdbws.com/* | The IMDb ratings file. It has to be a host permission because IMDb's server sends no cross-origin headers, so an ordinary page request for it is refused. |
https://v3.sg.media-imdb.com/* | IMDb's title search, request 4 above. A host permission for the same reason as the ratings file: IMDb's server sends no cross-origin headers. |
https://tidywl.com/* | The public settings file, the usage report and the ratings table; for Pro, the licence check and playlist sync. |
Wikidata does not appear in that list because it does not need to: its server permits cross-origin requests, so no host permission is required to reach it. It is described above all the same, because what a request carries matters more than whether Chrome made us ask for it.
The page that opens when you remove it — from version 1.2.1
When you remove TidyWL for Netflix from Chrome, Chrome opens https://tidywl.com/netflix/removed/ in
a new tab and asks what made you remove it. The extension is gone by then: this is not one of its requests.
While it was installed it gave Chrome the page's address, and Chrome opens it itself. Answering is optional.
What the address carries. Up to eight short fields, after a #:
| Field | What it is |
|---|---|
| a | Roughly how long the extension was installed: under an hour, a day, a week or a month, or longer. The extension works it out from the day it was installed, which from version 1.2.1 it keeps in your browser for this alone. An install from before 1.2.1 has no such day and says so. |
| v | The extension's version number. |
| l | Your browser's language, as two letters, such as en. |
| p | trial or pro while a Pro trial or subscription was on; absent otherwise. |
| d | On how many days you opened the dashboard: none, one, or two or more. |
| r | From version 1.4.0. How many titles you removed from My List with the extension, ever: the usage report's removed. Absent when none. |
| n | From version 1.4.0. On how many days you opened the dashboard, exactly: the usage report's open_days, where d gives only none, one, or two or more. Absent when none. |
| i | From version 1.6.1. Your install's random ID, the same one the usage report carries (see A usage report, to tidywl.com, above). Absent when your install has none yet, which is the case until its first usage report. |
What happens when the page opens. A browser never sends the part of an address after a
# to the server it asks for the page; the page's own script reads the fields in your browser. Then:
- It adds one to a daily count of visits to the page, at
https://tidywl.com/api/netflix/feedback/visit. That request carries the page's name and nothing else. - From version 1.6.1, if the address carries an install ID, it also sends a row that says no reason was picked yet, to
https://tidywl.com/api/netflix/removed, with that ID anda,v,l,d,randn. That way I can see that the extension was removed, and how that install was used, even if you close the tab. It is written only if your install has no row yet. - Without an install ID, nothing else leaves your browser until you press Send.
The plan, p, never leaves your browser: the page reads it to tell a subscriber that removing the
extension did not cancel the subscription, and how to cancel, and never sends it anywhere. If you answer that the
extension did what you needed, the page also shows the two counts, r and n, back to you
beside its rating button, for example "You opened it on 12 days and cleared 43 titles from My List."
What Send stores. Pressing Send sends your answer to
https://tidywl.com/api/netflix/removed, with a, v, l and
d, and from version 1.6.1 how many titles you removed and how many days you opened the dashboard
(r and n) and your install's ID, when the address carries them. It keeps one row per
visit, so your answer replaces the "no reason picked" row from when the page opened:
| Field | What it is |
|---|---|
| reason | The reason you picked, if you picked one, or "none" for the row sent when the page opened. |
| chips | The follow-up answers you tapped, if any. |
| text | What you typed, if anything, up to 1,000 characters. |
| a, v, l, d | From the address, as above; empty where the address did not carry one. |
| r, n | From version 1.6.1. How many titles you removed and how many days you opened the dashboard, from the address; empty where it did not carry them. |
| install | From version 1.6.1. Your install's random ID, from the address; empty where it did not carry one. |
| day | The day the row arrived — the day only, never a time. |
| id | A random id the page makes for your visit, so your answer replaces the "no reason picked" row, and an email you leave is attached to your answer. |
Joined to your usage counts, from version 1.6.1. A row with an install ID is read alongside that install's usage record (A usage report, to tidywl.com, above), so I can see how the extension was used before it was removed, for example whether it was ever synced or searched. The usage record names no title, no search, no profile and no Netflix account, and neither does the join.
Not stored: your IP address, which goes only to a rate limiter and is not written down; the plan; any cookie. An answer names nothing about you unless you type it.
How long it is kept. Each row, with its install ID, is deleted 12 months after the day it arrived. The daily visit count names nobody and is kept.
Your email, only if you leave it. After Send, the page offers to take your email so we can ask
you one question about your answer. If you type it and press that second Send, it goes to
https://tidywl.com/api/netflix/removed/email with the answer's random id, and is stored on that
answer's row with the day it was added. It is used for that one question, and for nothing else: no newsletter, no
list, never shared. It is deleted within 60 days of you leaving it; the answer stays, without it. To
have it deleted sooner, write to
support@tidywl.com from that address.
Why: the store counts how many people remove the extension, never why. This page is the one place a person who left can say, and the reasons decide what gets fixed or built next.
The feedback page, from version 1.6.1
From version 1.6.1 the dashboard has a link to https://tidywl.com/netflix/feedback/, which asks a
quick question or two: a Pro subscriber how they'd feel if Pro went away, and anyone else what they wish the
extension did and which Pro feature they'd want most. It opens only if you click the link, and answering is
optional. Its address carries, after a ?, whether you're on Free or Pro, the extension's version and
where you opened it from, such as the dashboard or What's New. Nothing in it is private.
The dashboard also asks once. After a clean-up that removed five or more titles (the settings
file, request 1, can change that number or switch the ask off), a card above My List's toolbar asks Got a
minute? when you next open the dashboard, between an hour and 14 days later. Its button, Answer one
question, opens the page above in a new tab, with the same address as the link; its other button, Don't
ask again, closes it. The card is shown at most once in this browser, whatever you press, and what it
remembers of that stays in your browser, in tidywl_feedback_ask. How many times it was shown and its
button pressed go in the usage report, as feedback_asks and feedback_clicks (see
A usage report, to tidywl.com, above).
Opening the page adds one to a daily count of visits to it, at
https://tidywl.com/api/netflix/feedback/visit. That request carries the page's name and nothing else.
What an answer sends. Each answer goes to https://tidywl.com/api/netflix/feedback,
which keeps one row per question:
| Field | What it is |
|---|---|
| question | Which question you answered. |
| choice | The button you tapped, if the question has buttons. |
| note | What you typed, if anything, up to 2,000 characters. |
| plan | Free or Pro, from the address. |
| version | The extension's version, from the address. |
| source | Where you opened the page from, such as the dashboard or What's New. |
| day | The day the answer arrived, the day only, never a time. |
| answer id | A random id the page makes for each question, so a changed answer, or a note added after a tap, replaces the first one rather than adding a second. It lives only in that tab and is not linked to your install. |
Never sent: your licence key, your install's ID, anything from your Netflix account or profile, and no email, since the page doesn't ask for one. Your IP address goes only to a rate limiter and is not written down. Because an answer names nobody, it can't be replied to: if you'd like an answer, ask on Discord or write to support@tidywl.com.
How long it is kept. Each answer is deleted 12 months after the day it arrived. The daily visit count names nobody and is kept.
How long anything is kept, and how to remove it
- The cache stays until you Sync again, which replaces it, or until you uninstall.
- The IMDb ratings file is replaced when it is more than twelve hours old.
- The badges' ratings are asked for again after a day, and at most 5,000 titles are kept.
- Tonight's surprises are kept for a day. A title put off with Not tonight stays put off for seven days, and the record that you did for thirty. A film you pressed Play on in Tonight leaves its picks for a day. Your occasions stay until you delete them.
- Playlists stay until you delete them, and pins until you unpin them.
- The usage report's record is kept on our server as described below, and deleted after 12 months without a report. The hour it notes for a failure, from version 1.5.0, is kept for up to two days.
- Breakage-alert records are kept, since none names an install: at most six alerts a day and one record a week.
- Pro's copy of your playlists stays on our server while your subscription is active, updated by each sync. Turning sync off stops that browser sending; it does not delete the copy, because your other browsers and your phone still use it. A deleted playlist leaves only its id and two times. When a subscription ends, the copy — every profile, playlist and phone under the key — is deleted 90 days later, so it is still there if you come back within that time.
- Tonight's pick on your phone is hidden there after 5 am, and deleted from our server by the next sync of any of your browsers on version 1.1.0 or later after that, or after you press Undo.
- A paired phone stays until you remove it in the extension. An unused pairing code is deleted when the next one is made, and cannot be used after ten minutes in any case.
- Uninstalling removes everything the extension stored in that browser, and stops the usage report. It does not delete Pro's copy on our server — see Requests about your data. If you want to be certain your playlists are gone from your other signed-in Chrome browsers as well, delete them in the dashboard before you uninstall, so the deletion is what syncs.
- An answer sent from the page that opens when you remove the extension, and from version 1.6.1 the row that says the page was opened, are deleted 12 months after the day they arrived. An email left with an answer is deleted within 60 days of being left, and the answer stays without it.
- An answer sent from the feedback page, from version 1.6.1, is deleted 12 months after the day it arrived. The daily counts of visits to that page and to the removal page name nobody and are kept.
What our server keeps. One record per install, on a server we run at tidywl.com — a Cloudflare Worker with a Cloudflare D1 database, the same one that serves TidyWL for YouTube, in separate tables. It keeps the highest value it has seen for each count, the latest My List size and, from version 1.5.0, the latest badge setting, and three dates — the day only, never a time: the day your install's first report arrived, the day its latest one did, and the latest day one of the counts for something you did (a sync, a removal, an addition, a search, a category, a playlist, a pin, an import, an export or, from version 1.1.0, Play pressed on one of Tonight's picks) went up. From version 1.5.0 it also keeps, for each of the five failure counts, the hour (in UTC) of the latest report in which that count went up, so that many installs failing in the same hour can be told apart from one failing now and then. That is the one thing it keeps finer than a day, and not for long: a nightly job clears each such hour once it is more than 24 hours old, so it is kept for up to two days, and the counts stay. From version 1.6.0 it also keeps, for each of the five failure counts, the reason of the latest failure of that kind, as its number on the list above. Once a day the server also adds every install's figures up into daily totals — how many installs reported in the last week, how many were new, how many did something and, from version 1.5.0, how many failures of each kind they had counted — kept in tables that name no install, and so kept after the records they were added up from expire. A record that has not been updated for 12 months is deleted; before deletion its install, removal and addition counts are added to a single running total, and after deletion nothing about that install remains.
Breakage alerts. When enough different installs report the same kind of failure within a few
hours, the server tells the developer, so that a Netflix change that breaks something is fixed in hours rather
than weeks. It looks only at the five failure counts above, and only installs first seen before today count.
Each decision to alert is one row in a table of its own, and every Monday one more row records that a message
saying the alerts still work was sent. A row holds the failure's name (one of the five failure counts, or
heartbeat), the first UTC hour of the window it counted, how many different installs it counted,
whether it was only noted or also emailed, when it was decided and whether the mail service accepted the
email. It names no install and holds no identifier. The email goes to the developer through Cloudflare's email
service and says which failure, how many installs and since which hour and, from version 1.6.0, how many of those
installs gave each reason; the Monday one gives the week's counts of alerts and of installs that reported. There
are at most six alerts a day. The rows are not deleted, because none of them can be traced to an install.
The server does not keep request logs, does not read or store the IP address your report arrives from, and has no error-tracking service attached. Cloudflare, which fronts the site, rate-limits the endpoint per address at its edge; that happens in Cloudflare's infrastructure under Cloudflare's own policies, and nothing about the address reaches the server or its database.
How to stop it. There is no setting in the extension to turn the report off; uninstalling stops it, and the record then expires after 12 months. We chose not to add a switch rather than add one and design around people flipping it; that trade-off is ours, and this page says so plainly.
What Pro keeps on our server, in the same database and its own tables, never joined with the usage report's: a fingerprint of your key (a bought key is also stored encrypted, so the page you land on after paying can show it to you again, and never in readable form), the plan, whether the subscription is active, past due, cancelled, expired or refunded, whether it is a trial, how many browsers it allows, when the next charge is due and when the paid period ends, and Paddle's own identifiers for the subscription and for you as their customer; one row per payment — Paddle's Transaction ID, the subscription it paid for, which licence, and when it was recorded; one row per browser using it — its name, and when it was activated and last seen; one row per synced profile — its id and name, and which browser last wrote to it; one row per playlist, holding what a sync sends; and one row per phone — what kind of device it is and where it runs, a fingerprint of its pass, and when it was paired and last opened. Not your email, your name, your address or one digit of your card.
Paddle, who takes the money
TidyWL Pro is sold through Paddle, which is the merchant of record — legally the seller, and the one that charges you, files the sales tax and handles refunds. The checkout is Paddle's own form, opened over the pricing page on this site in an ordinary browser tab, never inside the extension.
Your card details, billing address and email go to Paddle, and never to us. What Paddle tells us is: this subscription exists, this is its plan, this is whether it is paid, when the next charge is due and when the paid period ends, and here are Paddle's own reference numbers for the subscription, for you as their customer and for each payment. What Paddle does with what you gave them is covered by Paddle's privacy policy, not this one.
A free trial of 7 days, where Pro offers one, is taken through the same Paddle checkout and needs a card like any subscription: the card goes to Paddle and never to us, and all we learn beyond the above is that the subscription is a trial.
One page loads Paddle's script. The pricing page, tidywl.com/netflix/pricing/, loads
Paddle.js from Paddle's own servers so the checkout can open over it. What that script does in your browser is
covered by Paddle's policy, not this one. No other page on this site loads anything from Paddle.
The page you land on after paying. When the checkout finishes, the pricing page sends you to a page on this site with the payment's Transaction ID in the address, and that page trades the ID for your key. The address carries nothing else, and the page keeps nothing in your browser.
Finding a lost key. Every Paddle receipt, the first and each renewal, shows that Transaction ID. Paste it into Find my key on the same page, or into the key box under About → Pro in the extension, and it goes to our server once, on its own, to look your key up; the extension then activates that key as if you had typed it. The lookup stores nothing new: the ID is already on our server, recorded when Paddle told us about the payment. The ID alone is enough to see the key, so treat your receipts the way you would the key.
Manage subscription. The button under About → Pro sends your key and this browser's seat number to our server, which looks up Paddle's customer reference for the key, asks Paddle for a signed-in link to that account, and hands it straight back for the browser to open in a new tab. There you can cancel, change your card or download invoices. It happens only when you press the button. That link is a credential, so it is never written down: not stored, not logged, not kept once the tab is open.
When a subscription ends or is refunded, Paddle tells our server, the licence's status changes, and Pro switches off in each browser at its next licence check. Nothing else is sent in either direction.
Requests about your data
The usage record is linked to nothing that identifies you, so there is no way for us to find yours if you ask — we cannot look it up, export it or delete it on request. Expiry is how it is deleted. Everything else the extension holds is in your browser, where uninstalling removes it.
Pro is different, because the key identifies it. Write to support@tidywl.com from any address and quote your key, and we can tell you exactly what is stored under it, or delete it — the licence, every browser and phone on it, every synced profile and playlist, and the payments recorded against it. Deleting it is permanent: the key stops working and cannot be restored, so cancel your subscription with Paddle first. The playlists in your browsers are not touched. Anything Paddle holds, including your email and your invoices, has to be asked of Paddle.
Children
The extension is not directed at children. The usage report is counts and a random identifier, the same for a kids profile as for any other. A Netflix account may have a kids profile, and the dashboard works on one; everything it reads there stays on the machine under that profile's own id, exactly as for any other profile — unless the account holder has Pro and switches sync on while that profile is open, in which case its playlists and its profile name are synced like any other profile's, and a paired phone shows them beside the others'. The rating badges work there as on any other profile: the ids of the cards on the page go to our ratings table, with nothing to say which profile they came from.
Changes to this policy
If the extension's behaviour changes, this page changes with it before the new version ships, and the date at the top is updated. Past versions are in this site's public git history.
Who to ask
Email support@tidywl.com, or ask in the Discord. TidyWL is made by one person, Dominic Lam, and is not a company.
TidyWL for Netflix is an independent extension. It is not affiliated with, endorsed by or sponsored by Netflix, IMDb, Wikimedia or Google.