Back to home

Privacy Policy

Last updated 29 October 2026

This covers the Cinefliq app and this website. The website you are reading asks you for nothing: it has no form and no account. It runs no analytics today, though we expect to add some, and this page will say so before we do. The app is on the App Store for iPhone, though not in the European Union, and it is not on Google Play.

What the website collects

Nothing from you. There is no form on this website, no account to create and nothing to submit. A waitlist form used to sit on the home page and it was removed; no addresses were ever collected through it, and there is no stored list of any kind.

Three other parties still see your IP address simply because they serve you the page, its images and its film information, which no website can avoid: our host, Cloudflare; our database provider, Supabase, which answers the swipe demo on the home page; and TMDB. All three are described under Who else is involved.

Analytics, cookies and advertising on the website

As it stands today: no analytics product, no advertising, and no advertising pixels. The site sets no cookies and stores nothing in your browser. We do not build a profile of you, and we cannot see what you do on other websites. Its fonts are served from this site itself, so no font service sees your visit.

One thing does belong in this section, because it is a script and it is on every page. Cloudflare, who serve this site, add their own bot detection code to the pages they send you. It looks at browser characteristics to tell a person apart from an automated crawler. We do not choose its contents, receive nothing from it, and cannot switch it off on our plan; our own security policy blocks it from running in your browser, which is where that currently ends. It is Cloudflare's, described under Who else is involved, and it is not something we use to learn anything about you.

This is likely to change, and saying so now is the point of this paragraph. We expect to add analytics to this website so we can see which pages are worth keeping, and we may carry advertising here in future. If either happens we will update this page before it goes live rather than after, we will prefer measurement that does not follow you between websites, and where the law requires your consent we will ask for it rather than assume it. A policy that describes what a site used to do is worse than no policy, so treat the date at the top as the date this was last true.

None of the above describes the app, which is a separate question and has its own section below. The app does not track you across other apps or websites.

The site reads film information from our database in two places: the swipe demo on the home page, which fetches a handful of popular films so it shows real artwork rather than placeholders, and the page behind a shared title link. Neither sends anything about you, and nothing on this website can store anything about you in our database.

What the app collects

Without an account. You do not need one. When you start using the app without one, it creates an anonymous guest record on our server, so that your swipes have somewhere to live. It holds no name, and no email address or password unless you start creating an account by email, as described below. Against it we keep:

• Your swipes and ratings. Which title, which of the four decisions you gave it, and when, and a rating out of ten if you gave one.
• The streaming services you pick, if you pick any.
• Which country you are in, described below.
• Your session. Our sign in provider records the IP address and the app and device description of the session, and keeps them for as long as the session lasts.
• Notices based on your swipes, which our daily checks create, about titles on your watchlist and new titles from directors whose films you swiped. The app shows them only to accounts.

A clean up that runs once a day deletes a guest record that holds no swipes or ratings once it is 30 days old and nobody has used it for 30 days, and any other guest record once nobody has used it for six months. Until then it is kept, unless it becomes part of an account or is deleted as described under Deleting your account. If you can no longer reach it, for example after reinstalling the app, it stays on our server with nothing linking it to you until that clean up removes it. If you start creating an account by email, the address you typed and your password, stored only as a hash, are kept against the guest record until you confirm it, or, if you never do, for as long as the guest record exists.

What you tell the app before you start. The first time, the app asks which films and series you have watched and which genres you love, and you can skip it. Your answers stay on your phone, not in your guest record. The app sends them with each request for your Discover and Explore cards so the cards can be ranked, and our server does not keep them. When you create an account or sign in, the titles you picked are saved to it as watched and the genres become its favourite genres. Delete my data in Settings removes them from your phone as well.

If you create an account or sign in. Creating an account by email turns your guest record into the account, so everything you did as a guest is simply yours. Signing in with Google, Apple or a password, whether to a new account or one you already have, copies your guest swipes, ratings and services into it, keeping the account's own choice wherever the two differ, and then deletes the guest record. If the sign in is interrupted before that finishes, for example by closing the app, the guest record is left as it was. An account gives us:

• Your email address. Every way of signing in uses one.
• Your password, if you chose that route. It is stored only as a cryptographic hash by our authentication provider. It cannot be read back, by us or by anyone else, and we never see what you typed.
• What Google or Apple sends, if you chose one of those. From Apple, your email address and an identifier for your Apple account; if you choose to hide your address, we only ever receive Apple's private relay address, never your real one, and we store no name from Apple. From Google, your email address, an identifier for your Google account, your name and the address of your Google profile picture. That name and picture fill in your profile automatically, where other people can see them, and you can change or remove either.
• Your sessions. As for a guest, the IP address and the app and device description of each signed in session, kept until you sign out of it or delete your account.

Then, as you use it:

• Your swipes. Which title, which of the four decisions you gave it, and when. If you also gave it a rating out of ten, that too. It is what makes your watchlist a watchlist.
• What you choose to put in your profile. A display name, a handle, a short bio and a picture, if you upload one. The favourite genres you pick when you set up your account, and the titles you tap there, which are saved as swipes so your watchlist does not start empty. None of this is required beyond a handle, and a handle is what makes you findable.
• A count of your film lookups. How many times in the last hour we had to ask TMDB for a title, a person or a search on your behalf, so that one account cannot use up our allowance.

Which country you are in, with or without an account. For this we only ever use the country, never anything finer. Streaming rights are sold country by country, so this is what decides whether a film is listed as being on Netflix or on nothing at all. Unless you have pinned a country, the app asks our own server which country your connection is coming from. Our code there reads the country our hosting provider has already worked out from your connection and sends back those two letters. It saves nothing: not your IP address, and no record of the request. Cloudflare, which runs it, handles your IP address in order to answer, as described under Who else is involved. If that fails, the app uses the country it last worked out on this phone. If it has never worked one out, it uses your phone's region setting, and if that gives no country either, India. A country you pin yourself comes before all of these.

The two letters are saved against your guest record or account, and nobody else can see them. Our server uses them to fill your deck, Explore and your Wrapped. Once you have an account, it also uses them so that notices in the app about something on your watchlist starting to stream are about the right country. You can change the country or pin your own at any time under Settings, then Streaming.

Some things are kept only on your phone: which theme you chose, a copy of the country the app last worked out and of any country you pinned, which swipe hints you have seen along with a note of your last few swipes, copies of your Discover cards and Explore shelves so they open quickly, and the posters it has already shown. The phone does not send us these copies, although the country in use and every swipe are also saved on our server, as described above. Nothing in the app clears them when you sign out or delete your account. They go when you uninstall the app, and the saved posters can be cleared sooner as the phone makes room. Your session, as a guest or signed in, is kept in the iOS Keychain, or on Android encrypted with a key held in the Android Keystore, rather than in ordinary readable app storage. Signing out or deleting your account removes it from the phone.

What other people can see

The app has social features, so some of what you put into it is meant to leave your own account. This section is the whole of it.

Your profile. Anyone in a Decide together room with you, anyone in a shared list with you, anyone you follow and anyone who follows you can read your profile: your display name, handle, bio, picture and the favourite genres you picked. In the app they see your name and picture, and also your handle in search and in lists of followers. Your name, your handle and your picture also appear in search, so anybody with an account who types the start of your handle, or of any word in your name, can find you and follow you without knowing you. Your bio is not in search results. If you never choose a handle you are not in search at all. Your email address is not part of your profile, so it cannot be searched for or shown to anyone.

Your votes in a Decide together room. Everyone in the room can see every vote you cast in it, yes or no, not only on the titles the room agreed on. That is the feature working: the point of the room is knowing what the room thinks. The titles you vote on come from your own deck, which is chosen using your swipes. Your votes are kept apart from the four swipe decisions you make on your own, which stay yours.

A shared list. Everyone in a collaborative list can see its name, every title in it, who added each title, and the name and picture of every other member. Anyone holding the six character code can let themselves in, so the code is worth treating like the address of a room rather than a password. The owner can remove members and delete the list. Anyone in it can add titles and remove the ones they added.

Following someone is visible to them. They are told when you follow them, and you appear on their followers list with your name, your handle and your picture. Following needs nobody's approval. They can remove you from their followers, and if they block you, you can no longer follow them. You can see who you follow and who follows you. You cannot see the follows of anybody else, and nobody else can see yours.

Anything you send on purpose. Sharing a title, a list, your Wrapped or your Taste DNA puts it in that person's notifications along with your name and whatever note you typed. You can only send to somebody you follow or who follows you. Following needs no approval, so somebody who finds you in search and follows you can send you things too. Removing them as a follower or blocking them stops it.

Your picture is stored in the open. A picture you upload goes to Supabase storage, in a bucket that anyone holding the link can read. It has to be readable by people who are not signed in as you, because otherwise your picture could not be drawn next to your name in somebody else's room. Nobody can list the bucket to discover other people's, so a picture is reachable only by its own link. Treat it as a public photograph rather than something we hold privately for you. If you remove or replace it, the app stops showing the old one, but that file stays at its link. When you delete your account in the app, it deletes the pictures you uploaded just before the account goes. If that step fails, your account is still deleted and a picture can remain at its link, so write to us and we will remove it. Phones that already showed a picture may keep a cached copy for a while. If your picture came from Google, it stays on Google's servers, and other people's phones load it from there.

Blocking and reporting. If you block somebody we store the fact that you did, so we can keep them away from you. We do not tell them, though they may notice that they can no longer find you, follow you or send you anything. If you report somebody we store what you chose, anything you typed, who or what you reported and that it was you, because a report nobody can trace is a report nobody can act on. Reports are kept for us to read and are never shown to the person reported. If you delete your account, the reports you made are deleted with it.

A yearly count, never a name. To tell you in Wrapped what share of Cinefliq users you watched more than, we count how many titles each guest record and account marked as watched or loved that year. The result appears only as a percentage, only once at least twenty people have swiped that year, and it never names anyone.

Apart from that, your swipes, your ratings, your watchlist, your streaming services, the country your availability is worked out for and your email address are yours, and the database returns them to nobody else. There is no feed of what the people you follow are watching. A notification only ever reaches you because of something aimed at you, at a list or room you are in, or because of your own swipes, such as a title on your watchlist or a new title from a director whose films you swiped.

What the app does not collect

No analytics, no advertising identifiers and no third party tracking of any kind. It does not track you across other apps or websites. On an iPhone, doing so would require your permission through the prompt the phone shows for exactly that.

One more identifier leaves the app. It identifies this installation, not you or your account. So that fixes can arrive without a full app update, the app checks Expo's update service each time it starts. Expo receives a random identifier made for this installation, which version of the app and which update it is running, and your IP address. If the app failed while starting, Expo also receives a short description of the error. Nothing in that check names your account or describes what you do in the app.

Crash reporting is switched off. The app contains a crash reporter, but it needs a key that has not been issued, so nothing has ever been sent from it and nothing can be until that changes. If we turn it on, this page will say so on that day and describe exactly what it sends. Separately, if you have allowed your iPhone to share analytics with app developers, Apple sends us crash reports and usage figures for the app. They come from Apple, do not identify you, and you can turn them off in your iPhone's Settings under Privacy and Security, then Analytics and Improvements.

Otherwise: the app never asks your phone where you are. It requests no location permission and contains no code that could read GPS or anything like it. The country described above is worked out from your connection, is only ever a country, and is something you can override yourself. It does not ask for your contacts or your calendar, and contains no code that could read either. It asks to open your photos only at the moment you tap to change your picture, and only so you can choose one: it reads the single image you pick and never looks at the rest of your library. It asks for the camera only when you choose to scan a QR code to join a list or a Decide together room, and only to read that code: nothing is photographed, nothing is recorded, and nothing is uploaded. The short code inside it is the only thing that ever leaves the viewfinder. It sends no push notifications. It is not connected to any streaming service, so it cannot see what you actually watch.

Deleting your account

Open the Profile tab and tap the gear icon to open Settings, then choose Delete account. Type the word DELETE and tap Delete my account permanently; typing the word means it cannot happen by accident. Nothing else is required: no email to us, no waiting, and no explanation.

It takes effect immediately and removes your account and the link between it and your Google or Apple sign in, every signed in session, every swipe and rating you ever made, your profile, the country and services you saved, the people you blocked, who you follow and who follows you, your notifications, the reports you made, and your votes in any Decide together room. A room you started goes too, with everyone's votes in it. Any list you own goes with it, including titles other members added. A list cannot be passed to somebody else, so if a shared list matters to its members, tell them before you delete. Lists you were only a member of survive without you, and without the titles you added to them. The app also deletes the pictures you uploaded, as described above. It cannot be undone, and there is no grace period during which we quietly keep it.

A few things are left, and none of them is linked to your account any more. Notifications your activity created for other people, such as a shared title and any note you typed with it, stay in their feeds without your name. A report somebody made about you stays, without the link to your account. Our database provider's request logs, which include your account id and IP address, are deleted after about a week. If you used the app as a guest and then signed in before 14 October 2026, a copy of those guest swipes may still sit in a separate guest record; email us from your account's address and we will find and delete it. Deleting your Cinefliq account does not change your Google or Apple account; if you used Sign in with Apple, you can remove Cinefliq from the apps using your Apple ID in your iPhone's Settings.

Without an account. Open Settings in the app and tap Delete my data. Your guest record and everything kept against it, including an email address you began adding and did not confirm, are deleted at once, along with the answers the app kept on your phone. A guest record is also deleted automatically by the daily clean up: one with no swipes or ratings once it is 30 days old and unused for 30 days, any other once nobody has used it for six months.

One honest caveat: our database provider keeps routine backups, so a copy may survive in them for a short time, and is gone within thirty days as they rotate out. We never read them except to restore the whole service after a failure.

If you have an account and would rather not do it yourself, email [email protected] from the address on the account and we will do it for you. If you used Hide My Email, our delete account page explains what to send instead.

Why we hold it

The guest record exists so the app works before you decide whether you want an account. Your account exists so that your watchlist and everything you loved follow you to a new phone. Your swipes exist to give you back your own shelves, to order what you are shown next, to build your Wrapped and Taste DNA, and to create the notices in the app that are based on your swipes. They are not sold, not shared, and not used to advertise to you.

We hold this information because the app cannot do what you ask of it without it. The request logs and session records exist so that we can keep the service running safely, which is our legitimate interest.

We will not add you to a newsletter, send you marketing about other products, or pass your address to anyone else for their own use.

Where it is stored

What we store about you is held in one Supabase database in Seoul, South Korea, and the pictures you upload are kept in the same Supabase project. If you use the app from anywhere else, India included, your information is processed outside your own country. It is held by Supabase on our behalf under their terms, and it is not sold or handed to anyone else. What stays on your phone stays there, and the services named under Who else is involved handle what they receive where they operate.

Access is restricted at the database itself rather than by the app being polite about it. Without signing in, the database lets the website, or anyone else, read only the public film catalogue and store nothing about anyone. In the app, your private rows, such as your swipes, ratings, services and country, carry your account, and the database returns them to nobody else. Other people's profiles, votes and shared lists are returned only to the people described under What other people can see. This was checked by having one test account try to read another's private rows and fail.

Who else is involved

These services act on our behalf and receive only what is technically necessary:

• Supabase stores the film catalogue, and guest records, app accounts, swipes, profiles, lists and everything social described above. It stores uploaded profile pictures. It also runs the sign in itself, including the password hashing. Like any server it keeps logs of the requests made to it, by the app and by the swipe demo on this website. Each entry holds your IP address, the city, region and country your connection appears to come from, your network provider, your device or browser type, the address requested and, once you have a guest record or an account, its id. Supabase holds those logs for about a week. Separately, its sign in service records the IP address and device type of each session and keeps them until that session ends.
• Cloudflare hosts and serves this website, and answers the app's question about which country you are in, described above. Like any web host, it processes your IP address and browser details in order to do that. It also adds its own bot detection script to every page of this website, and on pages that show our email address it hides the address from spam robots with a small script of its own. We do not control either, and we receive nothing from them. Cloudflare also receives email sent to [email protected] and forwards it to the mailbox where we read it.
• Expo serves the app's updates, as described under what the app does not collect.
• Google and Apple, when you choose to sign in with one of them. They tell us who you are, and we tell them nothing about what you do afterwards. Google also serves the profile pictures of people who signed in with Google, so it sees the IP address of any phone that shows one, whoever that phone belongs to. A trailer opens on YouTube, which is Google's, but only when you tap it.

Film information on both surfaces comes from TMDB and is stored in the Supabase database described above. When you search for something we do not hold, or open a title we do not have yet, our server asks TMDB for it, which sends TMDB the words you searched for but not your IP address or your account. Poster images load directly from TMDB's image servers, so TMDB receives your IP address when a poster loads, on this site and in the app alike. No cookie is set by those requests, and TMDB is not told which account is looking.

How long we keep it

App accounts, swipes, profiles and everything social: for as long as the account exists. Delete the account and they go with it, immediately, apart from the leftovers and backup copies described under Deleting your account, and the request logs below.

Guest records: deleted automatically by a clean up that runs once a day: one that holds no swipes or ratings once it is 30 days old and unused for 30 days, and any other once nobody has used it for six months. Sooner if it becomes part of an account or is deleted as described above.

Sessions: the IP address and device description of each one are kept until that session ends: when you sign out of it, delete your account, or the guest record is deleted.

Decide together rooms: a room can no longer be joined twenty four hours after it is made, but the votes cast in it stay on your account until you delete it, or until the person who started the room deletes theirs, because they are the record of what you decided rather than something the room owns.

Reports and blocks: a report you made is kept until you delete your account. One made about you is kept with no time limit, without the link to your account once it is deleted. A block lasts until you unblock the person or either account is deleted.

Request logs: about a week, kept by Supabase as described above.

Email you send us: for as long as we need it to deal with your request.

Your choices

Settings lets you delete your account yourself, or your guest record if you have no account, as described under Deleting your account. Settings is the gear icon on the Profile tab.

For anything else, email [email protected] from the address you signed up with and we will, without asking you why:

• tell you exactly what we hold about you,
• correct anything that is wrong,
• send you a copy of it,
• delete your account.

If you used Hide My Email, write from any address and tell us your handle and the relay address shown for Cinefliq in your iPhone's Settings. Without an account we have no address to match you to, so we cannot find your guest record from an email; delete it yourself in Settings, or create an account by email first and then write to us from it.

Depending on where you live you may have further rights under local data protection law, including the right to complain to a supervisory authority. Write to us first and we will try to resolve it.

Children

Neither the site nor the app is aimed at children under 13, and we do not knowingly hold their information. If you believe a child has created an account, email us and we will remove it.

Security

Data is sent over an encrypted connection. Supabase stores it with access controls enforced by the database itself: apart from the film catalogue and the pictures described above, nothing can be read without signing in, and one account can read another's data only where this policy says so. Passwords are hashed, not stored. Your session is kept in the iOS Keychain, or on Android encrypted with a key held in the Android Keystore, rather than in ordinary readable app storage.

No system is perfectly secure, and we will not pretend otherwise. If you find a vulnerability, the Contact page explains how to report it.

Changes

If this policy changes in a way that affects how we use your information, we will update the date at the top of this page. If the change is significant and you have an account, we will email you where we can. If you used Hide My Email, our email may not reach you, so the date at the top of this page is the reliable signal.

Contact

Cinefliq is operated by Vishal Arora, an individual based in India, who is responsible for the information described here. For anything relating to your data, write to [email protected].