Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Daniel Grauf
Fuchsklinge 19
74535 Mainhardt
Germany
Email: kontakt@viewgether.app

Viewgether is a private, non-commercial project. There is no data protection officer because none is required. If you have any privacy questions, just write to the email address above.

2. Data on your phone

The app stores the following in its own storage on your device, which other apps can't access:

• Your lists: watchlist, seen and passed (swiped away) - each with the title information so the lists also work offline, and for titles from a duo hit with your duo partner's name.
• Your settings: region, your streaming services, “Only my services”, genres, movies/series, appearance (system/dark/light) and whether you've seen the intro.
• Sign-in data: a randomly generated device identifier, your user ID and the access and refresh tokens for the anonymous sign-in (see section 3.1).
• Image cache: posters and logos already loaded, so they don't have to be downloaded again.

Your lists and your solo filters are not stored on our server. One exception: when you open a duo, the app sends the IDs of the titles on your watchlist and on your seen list to that duo (see section 3.3). Your passed list is never stored on our server (only its title IDs travel briefly with deck requests, see section 3.5).

Storing this data on your device is strictly necessary for the app's functions (Section 25(2) no. 2 of the German TDDDG).

Android backup: the app takes no part in Android's automatic backup and doesn't transfer its data when you move to a new device. After a reinstall it starts with a new anonymous account.

3. Data on our server

The app only talks to our own server at api.viewgether.app (exceptions: images, trailers and links, see section 4). The following data is processed there:

3.1 Anonymous account

On first launch, the app generates a random device identifier (not a hardware or advertising ID). The server creates an anonymous account for it and stores:

• a random user ID and the random device identifier,
• the time of creation and of the last sign-in (for the automatic deletion after 12 months without use),
• refresh tokens for signing in - only as a cryptographic hash, each valid for 30 days and replaced by a new one every time it is used.

The short-lived access tokens (valid for 1 hour) are not stored. There is no email address, no phone number, no password and no sign-in with other services.

3.2 Display name (optional)

For duo and group night you can set a display name of up to 24 characters (e.g. a first name or nickname - it doesn't have to be your real name). It is stored in your account and in every duo or room you join, and is visible to your duo partner and the members of your rooms. You don't need a name to use the app solo.

3.3 Duo

A duo is a lasting connection between two people. For it, the server stores:

• the membership (slot in the duo, display name, when you joined, when you last looked at the hits, whether you removed the duo from your list, whether your hits go straight to your watchlist),
• the duo's shared filters (region, streaming services, genres, movies/series, language), who created the duo and, if applicable, who dissolved it,
• the shared deck (title IDs in a fixed order),
• your votes on titles (yes, pass or seen) with a timestamp,
• hints from your watchlist (title IDs only; they move these titles forward in the duo deck and don't count as a vote),
• the IDs of the titles on your seen list (stored as “seen” so they aren't shown to you in the duo),
• the hits (titles you both said yes to) with a timestamp,
• invite codes (valid for 30 days) and codes for moving a slot to a new device (valid for 24 hours); both can be used only once.

Your duo partner sees your display name and your shared hits. Titles you said yes to come up earlier in your partner's deck.

3.4 Group night (rooms)

Group night rooms exist only in the server's memory and are not stored in the database. While a room exists, the following is processed: your display name, a colour, the room's filters, your votes and your progress. Room members see each other's names and progress and, in the ranking, who said yes to which title. A room is deleted once everyone has left it for 10 minutes, at the latest 24 hours after it was created, or when the server restarts.

3.5 Catalog requests

To load movies and series, the app sends your region, language and filters (streaming services, “Only my services”, genres, movies/series) to the server. These requests are sent without a user ID or token and are not linked to your account. The server loads the title data from TMDB and caches it (title details for up to 60 days, streaming availability for up to 3 days); no data about you is sent to TMDB in the process. When loading the deck, the app also sends the IDs of the titles you have already rated so they aren't shown to you again; the server uses them only for that request and doesn't store them.

3.6 Abuse protection

To prevent codes from being guessed, the server counts join attempts per user ID (at most 10 per minute). This count is only kept in memory and is gone after one minute. To stop automated mass sign-ups, the server also counts newly created accounts per IP address, in memory only and for at most one hour, without storing or logging the IP address (Art. 6(1)(f) GDPR).

3.7 Server logs

The server logs each request with time, method, path without query parameters (the path may contain the random ID of a duo or room and a title ID), status code and processing time, for signed-in requests the first 8 characters of your random user ID, and a random request ID, plus technical error messages. The app creates a new request ID for every request; it contains nothing about you and only serves to match an error in the app to the corresponding line in the server log. The server also logs when duo and room connections start and end (the duo or room ID, the shortened user ID, the duration) and its own requests to TMDB (not related to you). Names, IP addresses, tokens, other headers and request contents are not logged; Cloudflare (section 7) does pass your IP address on to our server, but the server uses it only to count new sign-ups (section 3.6). Logs are kept for at most 14 days and are used only for troubleshooting and security. The app itself writes technical messages only to your device's system log; they are not sent to us.

4. Images, trailers and external links

• Posters and logos are loaded by the app directly from TMDB's image server (image.tmdb.org). For technical reasons, TMDB receives your IP address, the requested image address and common technical details (e.g. time, app/device type). We don't send TMDB any other data about you. TMDB's privacy policy: themoviedb.org/privacy-policy.
• Trailers are not played inside the app. When you tap “Trailer”, the YouTube app or your browser opens. From then on, Google's/YouTube's privacy policy applies.
• Links to themoviedb.org and justwatch.com (source credits) open in your browser; the respective provider's privacy policy applies there.
• Sharing and inviting uses your device's share menu. You decide what you share and with whom; we don't learn about it.

5. What we don't do

• currently no ads and no advertising ID, no in-app purchases,
• no analytics or tracking tools, no cookies in the app,
• no collection of email address, phone number, location (GPS), contacts, photos or other content on your device - the app only needs the “Internet” permission,
• no selling or sharing of your data for advertising or marketing,
• no profiling.

Ads: Currently there are no ads, no tracking and no analytics tools. If we ever need ads to cover server and licence costs, we’ll update this policy first and ask for your consent where required.

Crash reports: we don't use our own crash reporting tool. For installs from Google Play, Google provides us with aggregated technical crash and performance data (Android vitals) in the Play Console if you have allowed your device to share usage and diagnostics data with Google. Google collects this data; we only see it without reference to you as a person.

6. Purposes and legal bases

7. Recipients and service providers

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany - runs the server (located in Helsinki, Finland - EU) that holds the database and the backups. Hetzner processes the data as a processor under Art. 28 GDPR.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA - sits in front of our server and our website (DNS, encrypted tunnel to the server, protection against attacks, website hosting via Cloudflare Pages). Cloudflare processes your IP address and connection data and, for technical reasons, decrypts the traffic in order to forward it to our server. Cloudflare acts as a processor under Art. 28 GDPR (Cloudflare's Data Processing Addendum).
• The Movie Database (TMDB), USA - delivers the images directly to your device (section 4). TMDB is responsible for this itself; we have no influence on its processing.
• Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) - distributes the app through Google Play and processes installation and device data as an independent controller (privacy policy: policies.google.com/privacy). The same applies to YouTube when you open a trailer.
• Other users: your duo partner and the members of your rooms see the information listed in sections 3.3 and 3.4.
• Authorities only receive data if we are legally required to provide it.

8. Transfers to third countries

Cloudflare may also process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework; to that extent, an adequacy decision of the European Commission applies (Art. 45 GDPR). In addition, Cloudflare has included the EU Standard Contractual Clauses in its Data Processing Addendum.

TMDB is based in the USA. Your device loads the images directly from TMDB; we don't transfer any data ourselves. TMDB is operated by TiVo Platform Technologies, LLC, which is certified under the EU-US Data Privacy Framework; to that extent, an adequacy decision of the European Commission applies (Art. 45 GDPR).

Google also processes data in the USA and is likewise certified under the Data Privacy Framework.

9. Retention

Deleted data may remain in backups for up to 7 days. It is not removed from them individually, but it is no longer used and disappears when the backups are overwritten.

10. Deleting your data

In the app, Settings → Delete my data deletes with one tap your account on the server - your display name, your duo memberships, your votes and hints - and all of the app's data on your phone. Active duos are dissolved; your partner keeps the dissolved duo with its previous hits, but without your name. You are removed from running rooms.

Simply uninstalling the app deletes the data on your phone; your account on the server is only deleted automatically after 12 months without use. You can also request deletion by email. All details are on viewgether.app/daten-loeschen.

11. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR) - you can change your display name yourself at any time in the settings,
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

Write to kontakt@viewgether.app. Because we don't know your name or email address, we can only find your data through your short ID: you'll find it in the app under Settings → About Viewgether (the 8 characters after “ID”). Without it, we usually cannot identify you (Art. 11 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

12. Website viewgether.app

The website is delivered via Cloudflare Pages. When you visit it, Cloudflare processes your IP address, the requested address, date and time, browser information and the referrer in order to deliver the page and protect it against attacks (Art. 6(1)(f) GDPR). The website itself sets no cookies, uses no analytics or tracking services and loads no content from third-party servers (not even fonts). To protect against bots, Cloudflare may set a technically necessary security cookie.

If you open an invite link (/d/… or /r/…) in a browser, the code is part of the address and is therefore processed by Cloudflare like any address. The page itself only reads the code in your browser and doesn't send it anywhere.

13. Security

The connection between the app and the server is always encrypted with HTTPS/TLS. We store refresh tokens only as a hash. The server can only be reached from the internet through the encrypted Cloudflare tunnel, and the database not at all. Administrative access to the server is only possible with an SSH key.

14. Children

Viewgether is not directed at children under 16. The app shows information on movies and series of all age ratings.

15. Obligation to provide data, automated decisions

You are not obliged to provide us with any data. Without the anonymous account, duo and group night don't work; without a display name you can't start or join a duo or room. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

16. Changes

If the app or the law changes, we will update this privacy policy. The version published here applies.

Last updated: 17 October 2026