Untitled

RateSync — Privacy Policy
Last updated: April 23, 2026

Overview
RateSync is a Chrome browser extension that syncs your Letterboxd film ratings to IMDb automatically. This policy explains what data the extension accesses, how it is used, and what is never collected.

Data We Do Not Collect
RateSync has no backend server, no analytics, and no telemetry. The following data is never collected, transmitted, or stored by the developer:

Your name, email, or any account credentials
Your Letterboxd or IMDb account details
Your browsing history
Your sync activity or film ratings
Any personally identifiable information
Data Accessed Locally
All data RateSync accesses stays on your device. Nothing is sent to the developer.

IMDb Session Cookie (at-main)
What: Your IMDb login session cookie
Why: Used to authenticate rating submissions to IMDb's API on your behalf
Where it goes: Sent only to api.graphql.imdb.com — the same endpoint IMDb uses internally — to submit your rating. It is never stored by the extension beyond the duration of a single sync.
TMDb API Read Access Token
What: A personal API token you optionally provide from The Movie Database (TMDb)
Why: Used to look up IMDb IDs for films where Letterboxd does not carry a direct IMDb link
Where it goes: Stored locally in Chrome's extension storage (chrome.storage.local) on your device. Sent only to api.themoviedb.org when an IMDb ID lookup is needed. Never sent to anyone else.
Sync Log
What: A local record of your recent syncs — film title, IMDb ID, rating, success/failure status, and timestamp
Why: Displayed in the extension popup so you can see what was synced
Where it goes: Stored locally in Chrome's extension storage on your device only. Capped at 100 entries. Never transmitted anywhere.
Letterboxd Rating Requests
What: The rating value and film ID from your Letterboxd rating submissions
Why: To know what rating to submit to IMDb
Where it goes: Used in memory only for the duration of a single sync. Not stored persistently.
Third-Party Services
RateSync communicates with the following third-party services on your behalf:

Service	Purpose	Their Privacy Policy
IMDb (api.graphql.imdb.com)	Submit your rating	imdb.com/privacy
TMDb (api.themoviedb.org)	Look up IMDb IDs (fallback)	themoviedb.org/privacy-policy
Letterboxd (letterboxd.com)	Resolve film details	letterboxd.com/privacy-policy
These services have their own privacy policies. RateSync only contacts them to perform the sync you triggered.

Permissions Justification
Permission	Reason
cookies	Read the IMDb at-main session cookie to authenticate with IMDb's API
storage	Store your TMDb token and sync log locally on your device
webRequest	Detect when you submit a rating on Letterboxd
https://*.imdb.com/*	Required to read the IMDb session cookie, which is set at the root .imdb.com domain
https://letterboxd.com/*	Intercept rating events and fetch film detail pages to resolve IMDb IDs
https://api.themoviedb.org/*	Look up IMDb IDs via TMDb when Letterboxd does not carry a direct link
Data Retention
Sync log: stored locally, capped at 100 entries, clearable at any time via the extension popup
TMDb token: stored locally, removable at any time via the extension settings
All local data is deleted when the extension is uninstalled
Changes to This Policy
If this policy changes, the updated version will be published at the same location with an updated date.
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1ifNm-s74mX7GChaEzSJ1dVQCy1SrSxlMVRYi8ys0rgQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).