Privacy
Policy

Posterium ("we", "our", or "the Service") is a free, open-source poster-generation API and visual editor operated by SpicyDevs. We do not sell your data. We do not display advertising. We do not require an account to use any part of the Service.

By accessing posters.spicydevs.xyz or the API at api.spicydevs.xyz, you agree to this Privacy Policy. If you disagree, please discontinue use of the Service.

Automatically collected — API requests

Every request to api.spicydevs.xyz is routed through Cloudflare Workers at the network edge. Cloudflare automatically processes your IP address, geographic region (country and city-level), and user-agent string to route traffic and protect against abuse. This data is processed by Cloudflare under their own privacy terms (see Third-Party Services) and is not directly accessible to us in raw form on a per-request basis.

Our internal analytics pipeline additionally records the following aggregated data per API request:

• Country of origin (two-letter country code — no city or postal data)
• Device category inferred from user-agent (desktop, mobile, tablet, TV)
• Requested media type and format (movie/tv/anime, svg/png/jpg/webp)
• Which rating badge providers were requested (e.g. r=imdb,rt)
• Cache hit or miss status
• Response time bucket (latency band, not exact millisecond)

We do not log individual IP addresses in our own database. No data is attributed to a persistent user identifier.

Voluntarily provided — API keys

The visual editor provides optional fields where you can enter your own TMDB API key or Fanart.tv API key to override the default shared keys. If you enter these values:

• They are stored in a browser cookie on your device only (posterium_apikeys_v1).
• They are appended as query parameters to API URLs you generate.
• They are never transmitted to our servers independently of the URL you construct.
• We never store, log, or process third-party API keys on our servers.

Voluntarily provided — builder preferences

The builder stores your most recent poster configuration (badge positions, style settings, selected media) in browser localStorage under the key posterium_config_v2. This data never leaves your device unless you explicitly copy an export URL and share it.

What we do not collect

• Names, email addresses, or any contact information
• Account credentials (there are no accounts)
• Payment information (the Service is free)
• Precise location data (only country-level)
• The specific movie or TV titles you search for or generate posters of

Aggregated analytics data is used exclusively to:

• Monitor API availability and performance across global edge nodes
• Understand which rating sources and export formats are most popular
• Detect and mitigate abusive traffic patterns
• Plan infrastructure capacity

We do not use this data for targeted advertising, profiling, or sale to third parties. All analytics are reviewed in aggregate form only.

Posterium uses the browser storage mechanisms listed below. No third-party tracking cookies are set.

You can clear all of the above at any time by clearing your browser's cookies and site data for posters.spicydevs.xyz. Doing so will reset the builder to default settings.

The Service integrates with the following external services to function. Each is governed by its own privacy policy.

Cloudflare

All traffic is proxied through Cloudflare's global network for DDoS protection, CDN delivery, and edge compute. Cloudflare processes request metadata (IP addresses, headers) in accordance with their Privacy Policy.

TMDB — The Movie Database

Poster artwork, media metadata, and ratings are fetched from the TMDB API when generating poster images. Requests include a shared API key maintained by SpicyDevs (or your own override key if you provide one). TMDB's Privacy Policy applies to data originating from their platform.

Fanart.tv

Textless poster artwork and logo overlays are optionally fetched from Fanart.tv. Their Privacy Policy applies. You may supply your own Fanart.tv API key in the builder.

Other rating data providers

Rating data is sourced from IMDb, Rotten Tomatoes, Metacritic, Letterboxd, MyAnimeList, and AniList via public data aggregation. We do not have a data processing relationship with these services — their ratings are displayed informational only and are subject to change at any time.

Google Fonts

The frontend loads fonts (Bebas Neue, Syne, DM Sans, JetBrains Mono) from Google Fonts, which may set its own cookies. See Google's Privacy Policy.

Aggregated analytics records (country, device type, format, cache status) are retained for a rolling 90-day window in our Cloudflare Analytics Engine dataset. They are deleted automatically after this period.

Data stored in your browser (localStorage, sessionStorage, cookies) is retained until you clear it. There is no server-side copy of this data.

Because Posterium does not collect personally identifiable information and does not maintain user accounts, there is no personal data profile associated with you on our servers that we can access, export, or delete on request.

Data stored in your own browser is entirely under your control — you can delete it at any time via your browser settings. If you have questions or concerns, please open a GitHub issue.

If you are located in the European Economic Area or the United Kingdom and believe any data processing affects you, you may have rights under the GDPR or UK GDPR. Given the absence of personal data collection described above, these rights are unlikely to be applicable to the Service, but we are committed to responding to any enquiry in good faith.

The Service is not directed at children under 13 years of age. We do not knowingly collect data from children. If you believe a child has submitted data through the Service, please contact us and we will address the concern promptly.

We may update this policy to reflect changes to our practices or for legal reasons. Material changes will be noted in the repository commit history and the "Last updated" date at the top of this page will be revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

For privacy-related questions or to report a concern, please open an issue on the project repository:

github.com/xdaayush/freeposterapi/issues →