Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data when using our website watchup.app and our mobile application watchUp (together, „our service"). Personal data is any information relating to an identified or identifiable natural person.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Legal bases for processing

We process personal data on the following legal bases under the GDPR:

• Art. 6(1)(a) GDPR – consent (e.g. optionally connecting your Trakt account).
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. providing your account and app features).
• Art. 6(1)(c) GDPR – compliance with legal obligations.
• Art. 6(1)(f) GDPR – legitimate interests (e.g. technical operation, security and stability of the service).

3. Your rights as a data subject

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).

4. Processing on the website

4.1 Hosting and server log files

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centres in Germany/EU). When you access the website, the server automatically collects and stores information in server log files: IP address, date and time of access, page/file requested, volume of data transferred, HTTP status code, referrer URL, as well as browser type and operating system. The purpose is the technical operation, security and stability of the website. The legal basis is Art. 6(1)(f) GDPR. A data processing agreement (Art. 28 GDPR) is in place with Hetzner.

4.2 No cookies, no tracking

We do not use cookies on our website and we do not use any analytics, tracking or advertising services. No usage profiles are created.

4.3 Contact

If you contact us by email, we process the information you provide (email address, content of your message) in order to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted once it is no longer required and no statutory retention obligations apply.

5. Processing in the watchUp app

5.1 Account and authentication (Supabase)

For registration and sign-in as well as for storing your usage data (e.g. watchlist, viewing progress, settings) we use Supabase (Supabase Inc.). Hosting takes place in the EU (Frankfurt am Main) region. We process, among other things, your email address, authentication data and the content you create in the app. The purpose is to provide your account and the app features. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement is in place.

5.2 Series and movie data (TMDb)

Metadata about series and movies (titles, descriptions, posters, cast, etc.) is sourced from The Movie Database (TMDb) (US). When retrieving this content, your IP address may be transmitted to TMDb for technical reasons. The legal basis is Art. 6(1)(b) and (f) GDPR (provision of content).

5.3 Streaming availability

Information about which streaming services offer a title is retrieved via the Streaming Availability API (Movie of the Night). Title queries are transmitted to the service for this purpose. The legal basis is Art. 6(1)(b) and (f) GDPR.

5.4 AI mood search (Anthropic Claude)

For the AI-assisted mood search, we process your input text (your search description) via the API of Anthropic (Anthropic PBC, USA) to generate suitable suggestions. The input text is transmitted to and processed by Anthropic to answer your request. Please do not enter sensitive personal data in the AI search. The legal basis is Art. 6(1)(b) GDPR. According to Anthropic, content submitted via the API is not used to train the models.

5.5 Transactional emails (Brevo)

To send necessary emails (e.g. confirmation and security emails) we use Brevo. Your email address is processed for this purpose. The legal basis is Art. 6(1)(b) and (f) GDPR. A data processing agreement is in place.

5.6 Trakt import (optional)

You can optionally connect your Trakt account to import your history from there. The connection is made via OAuth only after your explicit authorisation; the data you release (e.g. watched titles) is then retrieved from Trakt. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

5.7 Purchases and subscriptions (planned)

Where paid features are offered, they are processed via the app store systems of Apple (App Store) and Google (Google Play), and via RevenueCat (RevenueCat, Inc., USA) to manage purchase entitlements. Payment processing itself is handled by Apple or Google; we do not receive full payment data. The legal basis is Art. 6(1)(b) GDPR.

5.8 Local storage on the device

Some of your data (e.g. settings and cache) is stored locally on your device. This data generally remains on your device and is removed when you uninstall the app.

5.9 Push notifications and calendar

At your request, we send push notifications (e.g. reminders for new episodes) and – after you grant the relevant system permission – can add events to your device calendar. The legal basis is Art. 6(1)(a) and (b) GDPR. You can revoke the permissions at any time in your device settings.

6. Recipients and processing on our behalf

Recipients of your data are the service providers named above that we use to deliver our service. Where they act as processors on our behalf, we have concluded agreements with them pursuant to Art. 28 GDPR. Any further disclosure of your data to third parties only takes place where there is a legal basis or you have consented.

7. Transfers to third countries

Some of the services used (including TMDb, Anthropic, RevenueCat, Apple, Google) are based in the USA or process data outside the EU/EEA. Where personal data is transferred to a third country, this is done on the basis of appropriate safeguards, in particular the European Commission's standard contractual clauses (Art. 46 GDPR) or – where applicable – a certification under the EU-US Data Privacy Framework.

8. Retention period

We only process and store personal data for as long as necessary for the respective purposes or as required by statutory retention periods. Account data is stored for the duration of your account use and removed after its deletion, unless statutory retention obligations apply. Server log files are deleted regularly and shortly after collection.

9. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Transmission is encrypted (TLS/HTTPS).

10. Changes to this privacy policy

We update this privacy policy whenever changes to our service or the legal situation require it. The current version published on this page always applies.