Boxd Card

Privacy Policy — Last updated: May 2026

What this extension does

Boxd Card is a Chrome browser extension that reads your Letterboxd profile page and generates a shareable image card showing your last four watched films, favorites, recent diary entries, lists, or reviews.

By default, all processing happens locally in your browser. You can optionally enable TMDB enrichment in the extension's settings — off by default — which pulls backdrops, higher-resolution posters, and film metadata from The Movie Database via our Cloudflare Worker. Details below.

There is also a web app version of Boxd Card which uses the same Cloudflare Worker to proxy requests to Letterboxd (and, when enabled, to TMDB) on your behalf. This allows you to generate cards without installing a browser extension.

Neither version of Boxd Card collects any personal data. Both are subject to this privacy policy.

Data we collect

Boxd Card does not collect, store, or share any personal data.

• No account is required.
• The Chrome extension sends no analytics or telemetry. All processing happens locally in your browser.
• The landing page (boxd-card.com) and the web app (/app/) send anonymous usage telemetry to our self-hosted Grafana Cloud instance via a Cloudflare Worker proxy at grafana.michaellamb.dev. Details below under Web analytics.
• When TMDB enrichment is off (the default for the extension), no data leaves your browser except the poster and page fetches Letterboxd already serves publicly.
• When TMDB enrichment is on, each card generation sends one HTTPS request per film to our Cloudflare Worker containing only the film's Letterboxd slug (for example dune-2021). No username, Letterboxd account, IP identifier, or other personal data is transmitted. The worker caches TMDB responses for 7 days and does not log who fetched what.

Web analytics (landing page and web app only)

To understand which features people use and where errors happen, the landing page and web app send anonymous usage events to our Grafana Cloud project. The Chrome extension does not.

What we collect:

• Page views and clicks on links/buttons (e.g. "Chrome Web Store", "Web App", "GitHub").
• Card-generation outcomes: card type chosen, layout, whether TMDB was enabled, and whether the generation succeeded or failed.
• Errors from the scraper proxy (HTTP status code and target host, e.g. letterboxd.com).
• Default web vitals (page load timing, core web vitals) and unhandled JavaScript errors.

What we do not collect:

• The Letterboxd username or URL you paste into the web app.
• Any list slug, film slug, review text, or other content from the cards you generate.
• Generated card images — they remain in your browser memory only.

Telemetry is routed through our own Cloudflare Worker (grafana.michaellamb.dev) before reaching Grafana Cloud, which acts as the storage backend.

How the extension works

When you click Generate Card on a Letterboxd profile page, the extension:

1. Reads film titles, ratings, and poster image URLs directly from the page you are already viewing.
2. Fetches poster images from Letterboxd's CDN (a.ltrbxd.com) using your browser's built-in fetch capability — the same images your browser would load anyway.
3. Only if you have enabled TMDB enrichment in settings: sends each film's Letterboxd slug to our Cloudflare Worker (api.boxd-card.com), which looks up the matching record on TMDB and returns public film metadata and image URLs. TMDB posters and backdrops are then fetched from image.tmdb.org.
4. Draws those images onto an HTML5 Canvas element entirely within your browser tab to produce the card PNG.

The generated image exists only in your browser's memory until you choose to download or copy it. It is never uploaded anywhere.

Permissions

The extension requests the following Chrome permissions:

• activeTab — to read the URL of the tab you are on and confirm it is a Letterboxd profile page.
• clipboardWrite — to copy the generated card image to your clipboard when you click Copy.
• storage — to persist your display preferences (layout, toggles, opt-in state).
• scripting — to read the logged-in Letterboxd username from the active tab so the navigation hint can include it.
• Host access to letterboxd.com, a.ltrbxd.com, s.ltrbxd.com — to fetch poster images and static assets that are already publicly visible on the page.
• Host access to api.boxd-card.com — used only when TMDB enrichment is enabled, to fetch film metadata via our Cloudflare Worker proxy to TMDB. No requests are made to this host otherwise.
• Host access to image.tmdb.org — used only when TMDB enrichment is enabled, to fetch the posters and backdrops the worker returns.

Third-party services

Boxd Card accesses Letterboxd's publicly available web pages and CDN assets on your behalf, the same way a normal browser visit does. It is subject to Letterboxd's own Privacy Policy. This extension is not affiliated with or endorsed by Letterboxd.

When TMDB enrichment is enabled, Boxd Card additionally queries The Movie Database (TMDB) through our Cloudflare Worker and loads images from image.tmdb.org. These requests are subject to TMDB's Privacy Policy and Terms of Use. This product uses the TMDB API but is not endorsed or certified by TMDB.

Changes to this policy

If this policy changes, the updated version will be posted at this URL with a revised date.

Contact

Questions? Open an issue at github.com/michaellambgelo/boxd-card.

← Back to Boxd Card