Privacy policy
In effect since 2026-07-31.
At a glance
moviemoood shows no ads, neither sells nor shares your data, and puts nothing in your browser without asking you first. What we store serves one purpose: making the app work. And everything we know about you can be read, taken away and erased from the settings.
Who is responsible
The app is published by Alexandre Pletty, data controller. For any question about your data: [email protected].
What we store
Your email address (it is how you sign in, without a password, and how our letter reaches you), the name, handle, photo and line you choose, your language. What you watch: your viewing journal, your watchlist, your ratings, the tastes declared at sign-up. What you write: your posts, replies, likes, the photos you attach. And your ties: who you follow, who follows you, who you blocked. Photos are stripped of their metadata (location, device) the moment they reach our servers: a profile picture should not say where you live. Finally, at each sign-in we note the approximate city and country derived from the connection address, to watch over the service’s activity; that address itself is never kept.
What we do not do with it
No advertising, no profiling, no selling or sharing for commercial purposes, no advertising trackers. The only measurement we do is of the website’s audience, and it only starts if you accept it. The app collects neither your device’s location nor your contacts, nor anything that does not show on screen.
The emails we send
Two kinds, and not one more. Your sign-in code first: without it you cannot open your session, so it only ever leaves at your request. Then our letter, a few messages a year about what changes in the app: opening your account signs you up, the welcome email says so, and every message carries a link that takes you off it in one click, without signing in. The same switch lives in your settings. For this we keep your address and the date you joined, which is the record proving that it happened. This letter rests on our legitimate interest in keeping the people who use the service informed; you may object at any time, and your refusal is kept so that nothing undoes it by accident. We will never write to you on someone else’s behalf.
Notifications on your phone
The app can reach out to you, and only if you have let it: it does not ask on first launch, but in its settings, under the text that says what it would send. Two things, and not one more. An evening check-in, at 7pm where you are: what airs today in your library, and what is waiting for you. And a word when someone addresses you on the Feed, grouped so that ten reactions in a minute make a single notification. Likes and follows start off; three switches, in the settings, decide the rest, and your phone always has the last word. For this we keep a technical identifier for your device, provided by the system, and its time zone, which is how we know when it is 7pm where you are. That identifier says nothing about you and lets us read nothing on your phone; it disappears when you sign out, when you uninstall the app, or when you turn notifications off. A notification never carries the text of a post or the name of a series someone else wrote: it appears on a locked screen, which anyone can read over your shoulder.
Audience measurement, and the choice we leave you
On the website, we measure what gets read and how: page views, where visits come from, what kind of device, how far down a page people go, the links that lead elsewhere and the searches made here. We also measure the gestures that make the product: asking for an entry code, coming in, ticking an episode, saving a work to your list, seeing a Mood through, importing a library. **We count that they happened, never what they contained**: not the words you search for, not the series you tick, not what you save. We also record two purely technical things: how fast pages render for you, and the site’s own errors when it hits one, along with the address where it happened. They exist to be fixed, and they say nothing about you. It tells us what is missing and what is broken, never who you are elsewhere. Two tools do it: Google Analytics, loaded by Google Tag Manager, and PostHog, hosted in the European Union. **None of it starts before you agree**: on your first visit you are asked, and until you answer, not one of those scripts is even downloaded. You may refuse, the site works exactly the same, and you may change your mind at any time from the link at the foot of the page. Your choice is kept in your own browser and nowhere else, which is why another device will ask you again. The mobile app measures nothing at all.
Where your data lives
In Germany, on a server rented from Hetzner (Falkenstein), which carries the app, its database and the site’s traffic. Around it, processors that see only the strict minimum: Cloudflare routes the visits, hosts the images you upload and the daily database backups; Resend sends our emails and therefore holds your address and whether you are subscribed to our letter; Expo routes notifications to your phone, and for that sees your device identifier and the text of the notification, which Apple or Google then delivers. Both companies are established in the United States: the resulting transfers are governed by the European Commission’s standard contractual clauses. If you accept audience measurement, Google receives the site’s visit data (Analytics, in the United States) and PostHog receives its own, on European servers. Series and film pages come from TMDB: we ask them about works, nothing personal is ever sent to them.
For how long
As long as your account exists. Deleting your account (Settings) erases everything, immediately and permanently: your posts, your photos, your journal, your ties, and your address at our email sender. There is no trash bin and no hidden retention. One caveat, which we would rather write than leave unsaid: the database is backed up every day, and those copies are kept for thirty days before being destroyed in turn. Your data may therefore remain in them for a few weeks after being erased. Nothing is ever taken back out of them, except to bring the service back after a failure.
Your rights, and where the buttons are
Read and take your data with you: Settings → Export my data (a readable file, with the identifiers that make it reusable elsewhere). Rectify: Edit profile. Erase: Delete account. Choose who reads you: Private account, under Privacy. Stop receiving our letter: the link at the foot of every message, or the switch in Settings. For everything else (objection, restriction, complaints), write to us; you may also contact your data protection authority.
If this text changes
The date below changes with it, and changes that matter will be announced in the app, not buried in a page.