Privacy Policy

What we collect & why

• Account details — your email address and password, to create and secure your account. Passwords are hashed and managed by our authentication provider; we never see or store your raw password.
• Profile — your display name, username, and optional profile photo, so friends can recognise you.
• Your movie data — your rankings, watchlist, and custom lists. This is the core of the app: it powers your personal lists, recommendations, and taste comparisons with friends.
• On-device data — if you use Popcorn without a cloud account, your data is stored only in your browser/device storage and is never sent to us.

We do not collect location, contacts, or advertising identifiers, and we do not use third-party ad or analytics trackers.

How it’s stored & for how long

Cloud account data is stored with Supabase — your profile and movie data in a Postgres database, and profile photos in secure file storage. Data is processed on servers in the EU and/or US. We keep your data only for as long as your account exists.

You can delete everything at any time. In the app, go to Profile → Delete account to permanently remove your account and associated data, or Reset all movie data to wipe your rankings, watchlist, and lists while keeping your account.

Third parties we use

• Supabase — authentication, database, and file storage for cloud accounts (EU/US data processing).
• TMDB — we read movie metadata (titles, posters, cast, etc.) from The Movie Database API. We send no personal data to TMDB.
• Google Sign-In (optional) — if you choose to sign in with Google, Google verifies your identity and shares basic profile information (such as your email) so we can create your account.

We never sell your personal information.

Your rights & choices

• Access & correction — view and edit your profile and data directly in the app.
• Deletion — delete your account and data in-app at any time (see above).
• GDPR (EEA/UK) — you have the right to access, rectify, erase, restrict, export (portability), and object to the processing of your personal data.
• CCPA (California) — you have the right to know what we collect, request deletion, and opt out of the “sale” of personal information. We do not sell personal information.

To exercise any of these rights, contact us at the.popcorn.app.josh@gmail.com.

Children

Popcorn is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the app evolves. We’ll revise the effective date above and, for significant changes, surface a notice in the app.

Contact

Questions about your privacy? Email the.popcorn.app.josh@gmail.com.