What we do and don’t collect.

What we don’t collect

We don’t collect accounts, email addresses (unless you write to us), analytics, crash reports, advertising identifiers, location, contacts, photos, microphone or camera data, or a behavioural profile. If you enable remote sync to a server we operate, we collect only the sync records needed to provide that feature, described below.

What stays on your device

Your diary entries, watchlist, ratings, notes, standout episodes, and cached TMDB metadata are stored in an on-device SQLite database. With sync off, they don’t back up to us and they don’t leave the device unless you explicitly export or share them yourself.

If you delete cinefill or reset your phone before syncing or exporting, the data goes with it. We can’t recover data we never received.

Optional remote sync

Sync is off until you turn it on. When enabled, cinefill sends diary entries, watchlist items, TV episode standouts, deletion markers, sync timestamps, and a random app-generated device ID to the server URL you configure. Diary records may include titles, TMDB IDs, watched dates, ratings, notes, year, poster path, and TV season details. Diary and watchlist records also include whether you explicitly marked that item public.

Your personal token is stored on-device using the platform secure store and is sent only as an authorization header when talking to your configured sync server. cinefill does not sync the local media cache, raw TMDB responses, contacts, photos, location, or analytics data.

If you use your own server, that server’s operator controls how synced data is stored. If you use a server operated by us, synced data is used only for app functionality: keeping your diary, watchlist, and standout episodes mirrored between your devices. We do not sell it, use it for advertising, or share it with data brokers.

Synced diary and watchlist items are private by default. They are not meant to appear on a public website unless you turn on the Make public control for that item. TV episode standouts sync for your devices but are not public-facing in this version.

Third parties

Depending on the features you use, cinefill may talk to these external services:

• TMDB (themoviedb.org). When you search, browse trending, or open a film/TV detail page, cinefill sends a query to TMDB’s API to fetch metadata. cinefill doesn’t add user identifiers to those requests. TMDB sees only the query text and the IP address of the request. TMDB’s privacy policy is at themoviedb.org/privacy-policy.
• Your sync server. If you enable sync, cinefill sends the limited sync data described above to the compatible server URL you enter. Sync is not required to use the app.
• Apple TestFlight (during the beta). If you’re running the TestFlight build, Apple collects standard TestFlight crash and usage telemetry under their own privacy policy at apple.com/legal/privacy. This stops applying once cinefill is on the App Store.

cinefill doesn’t talk to any analytics, advertising, attribution, or tracking service.

Letterboxd import

The Letterboxd import feature reads the .zip export file you pick from your device storage. cinefill parses it entirely on-device and matches each film to TMDB. The zip itself isn’t uploaded anywhere. Only the per-film search queries needed for TMDB matching leave your device, the same way regular search does.

Export data

The export feature creates a local zip file with JSON and CSV copies of your diary entries, watchlist items, and TV episode standouts. It does not include the derived TMDB cache. cinefill then hands that zip to the system share sheet so you choose where it goes, such as Files, AirDrop, Mail, or another app.

Exporting does not send data to us. If you share the zip with a third-party app or cloud service, that destination handles it under its own privacy policy.

Cookies + the website

This website doesn’t set any cookies and doesn’t run analytics. The app itself doesn’t use cookies at all — it’s a native iOS app.

Children

cinefill isn’t directed at children under 13 and doesn’t knowingly collect data from them. Please don’t enable sync for a child’s data or send us child data in a support request.

Changes

If this policy changes, the updated version lives at this URL. The “last updated” date at the top will reflect the change. Material changes like adding analytics, changing sync behavior, or adding a new third-party service will also be called out in the app’s release notes.

Contact

Questions about privacy? Email nerdbrainmatter@gmail.com. If you used a sync server operated by us and want synced data deleted, include that in the email.