Get Kino

Privacy

What we keep, and what we do not.

Written to reflect how Kino actually works.

Last updated: 17 October 2026

This page describes how Kino works today. The date above reflects the last substantive change.

1. Who is responsible for your data

Kino is run by Gijs Addas, a sole trader (eenmanszaak) established in the Netherlands and trading under the name Kino.

  • Address: Marnixstraat 69a, 1015 VC Amsterdam, Netherlands
  • Registered in the Dutch Commercial Register (Handelsregister), held by the Chamber of Commerce (KVK), under number 91722063
  • VAT identification number: NL004910829B80
  • Contact: privacy@kinoapp.eu

Under the General Data Protection Regulation we are the controller of the personal data described here. For anything about your data, including a question, a request or a complaint, write to privacy@kinoapp.eu. A person reads it.

Kino is small enough that the law does not require us to appoint a data protection officer, and we have not appointed one. Privacy questions go to us at privacy@kinoapp.eu. We are established inside the European Union, so we do not need a representative under Article 27 of the GDPR, and we have not appointed one.

2. What this policy covers

The Kino apps for iPhone and Android, the website at kinoapp.eu including the share pages that open a preview of a film, list or review, the staff dashboard, and the emails and push notifications we send.

It does not cover other people's services. Sign in with Apple, Sign in with Google, the App Store, Google Play, and The Movie Database each have their own policies, and section 9 explains where the lines are.

3. The short version

  • We collect what the app needs to work, and not much else.
  • No advertising, no ad identifiers, no third-party trackers. None on the website, none in the apps.
  • The website counts visits, and sets no cookie to do it. It records which pages are opened and which links lead to a store, and never who you are. The apps measure how they are used, and you can turn that off in Settings. Both use PostHog. Sections 4.13 and 4.16 explain exactly what is sent.
  • We do not sell your data or your writing, and we do not hand it to data brokers.
  • We do not train generative AI models on your reviews, ratings or viewing history, and we do not let anyone else do it either.
  • Your diary, reviews and lists are visible to the audience you choose, and every item has its own private setting.
  • Your address book never leaves your phone. Only scrambled email addresses do, and we do not keep those. Phone numbers are never sent.
  • Location is off unless you set one, and it is a place you choose, not a trail we follow.
  • You can export everything we hold about you and delete your account from inside the app, without asking us. Section 13 sets out what the export contains.

The rest of this page is the detail behind those lines.

4. What we collect, and why

4.1 Your account

To sign up you need an email address, a username, and a password. We store your password only as a bcrypt hash, so we never hold the password itself and cannot recover it, not for you and not for anyone who asks. Use a password you do not reuse elsewhere. If you only ever sign in with Apple or Google, we hold no password for you at all.

While Kino is in invite-only access, you also need an invitation link we email to your address before you can register. The invitation is single-use and tied to that one address.

You can also add a name, a bio, a profile photo (section 4.14), and up to six films on your shelf shown on your profile. Those are optional and public in the same way the rest of your profile is. Without a photo, your profile shows the first letter of your display name.

We keep a flag for whether your email has been verified, and the verification codes and password-reset tokens we send you. We never store a code or a token in the clear: we keep only a bcrypt hash of each, at the same strength as your password. An email verification code lasts 15 minutes and a password-reset link lasts 24 hours; both are single use, both stop working after five wrong attempts, and asking for a new one cancels the old one. If you change your email address, we keep a record of that change.

There is no field for your date of birth, your phone number, or your home address. We do not ask, so we do not have them.

Do you have to give us any of this? No law requires it. An email address, a username and a password are what an account is made of, so without those we cannot open one for you. Everything else on this page is optional: your name, your bio, your photo, your shelf, contacts access, a saved location, push notifications. If you leave those alone, the rest of Kino works exactly as it does now, only without the feature they belong to.

4.2 Signing in with Apple or Google

If you sign in with Apple or Google, we store the stable account identifier that provider gives us, the email address it passes along, whether that address is verified, and when the link was last used. We also keep the rest of the sign-in token as the provider sends it, in a single field on the same record, which for Google usually includes your name and the web address of your Google profile picture, and for Apple includes whether the address is a private relay.

Two specifics worth knowing:

  • If you use Hide My Email, what we get is Apple's private relay address. That is the address we will use to reach you, and the one in our database.
  • Apple sends your first and last name once only, on the first authorisation, and never again, so we save it then. If that sign-in created your account, the name also becomes the name shown on your profile, and you can clear it there at any time. Clearing it does not remove the copy Apple sent, which stays on the record of your Apple link until you delete your account.

We never receive your password for either provider.

4.3 Your film record

Most of what we store relates to your activity in Kino:

  • watches: the films and episodes you have logged, when you watched them, whether it was a rewatch;
  • ratings and reviews, including whether you flagged one as a spoiler, and the edit history of a review;
  • lists you make, and lists other people invited you to work on;
  • your watchlist and favourites;
  • comments and likes, on your own content and other people's;
  • who you follow, who follows you, and any pending follow requests;
  • watch-together sessions, whether you started one or were invited, including who was invited and whether each person accepted, declined or has not yet replied;
  • who you have muted, and which feed items or suggestions you have hidden;
  • unfinished drafts, so a half-written review survives closing the app;
  • the answers you gave while setting up: your taste, how you heard about Kino, what you mainly want to use it for, and who invited you, if someone did;
  • quiet signals that shape what you are shown: how you swiped each For You card, kept even if you undo it, when you last opened your feed, and which suggestions you hid.

4.4 Your settings

Theme, language, how you like runtimes and ratings displayed, how your library is arranged, how lists are sorted, which notifications you want, your privacy switches, and your saved place. We store these so your preferences stay the same across devices.

4.5 Location, only when you set one

Kino does not track your location. There is no background location, no geofencing, and the app never asks for "always" access. On Android it only ever asks for your approximate location, never your precise one.

You can set a location in Settings, then Location, or from the where-to-watch sheet, and the iPhone app also offers it while you set up. We use it to show cinema showtimes near you and to pick the right region for streaming availability. You can search for a city, or tap to use your current location. Either way, turning a place name or a coordinate into a city and country is done by a service your phone provides, not by us:

  • on iPhone, by Apple, on Apple's servers, using the system geocoder, and city search uses Apple Maps;
  • on Android, by the geocoder built into Android, which on most phones is provided by Google through Google Play services.

So the text you type and the coordinate you use go to Apple or Google under their privacy policies, not to us.

What we then store is the resulting place: latitude, longitude, the label, the ISO country code, and a search radius. If you use your current location on Android, the coordinate we store is your phone's approximate position rather than the middle of the city. The place sits in your settings until you change or clear it. When you look at showtimes, the app sends that coordinate with the request so our servers can find the cinemas near it, and like every request it then appears in our request traces, which are deleted after 7 days (section 4.11). If the where-to-watch sheet needs a country your saved place does not have, the app looks it up from your saved coordinate with the same geocoder and saves it.

4.6 Finding people you know

If you tap to check your contacts, in Find Friends or while setting up, and only then, the app asks your phone for access to them. This is how contact matching works:

  • the app reads the email addresses on each card, and the name and phone number, which it shows you so you can pick who to invite. Not birthdays, not photos, not addresses, not anything else;
  • each address is lowercased and hashed with SHA-256 on your device. Phone numbers are not hashed and are not sent: they exist only so you can send an invite yourself, from your own phone, in your own messaging app (Messages on iPhone; your SMS app, WhatsApp or Telegram on Android);
  • only the address hashes are sent to us, in batches of up to 2,000. Your address book never leaves your phone, and neither does anybody's name or number;
  • we compare them against the hashes we hold for people already on Kino, return the matches, and discard the ones you sent. We never write those to a database or a cache. In normal running they are never logged either; the one exception is a server error, where our error log can capture the request body, and that record is deleted with the rest of our application logs after 7 days;
  • what we compare against is a hash of the address each account signed up with, and nothing else. That is a real limit and worth stating plainly: we can only find somebody whose email address you have saved and who signed up with that same address, which is often nobody. We would rather find fewer people than hold more about you;
  • someone only appears in your results if they have "Suggest my account to others" switched on. Having somebody's email address is not their consent to be found by it.

One important point: a hash is not anonymous data. Anyone holding the hash of a value they can already guess can confirm the match. So a hashed address is a scrambled address, not an anonymous one. We treat these as personal data, which is why we discard the ones you send us rather than keeping them to improve later matches.

4.7 Push notifications and devices

If you turn on push notifications in the iPhone app, we store the APNs device token, the platform, the device name iOS gives us, the app version, which features that version of the app supports, and the time that device last checked in, which the app refreshes on launch. Since iOS 16 the device name we receive is the model, for example "iPhone", rather than a name you chose, but the record is tied to your account, so we treat it as personal data and it lets you tell one device from another. We delete the record when you sign out. If Apple tells us the token no longer works, we mark the record revoked and stop sending to it, and keep the row so the same device can register again cleanly.

The Android app does not receive push notifications yet, so nothing about an Android phone is registered with us. The notification switches you set there are saved to your account, like the rest of your settings.

Release-day reminders you set for a film in the iPhone app are scheduled on your device and never reach us.

4.8 Purchases

In the iPhone app, whether you subscribe to Kino Plus or make a one-off contribution, the purchase happens in Apple's App Store, and we never see your card, your billing address, or your Apple ID. When you start a purchase, the app attaches your Kino account identifier to it so that a later message about that purchase can be matched to your account; Apple receives that identifier but nothing else about you.

In the Android app, if you support Kino with a one-off or a monthly contribution, the purchase happens in Google Play, and we never see your card, your billing address, or your Google account. Kino Plus itself is sold only in the iPhone app for now.

We use RevenueCat to keep track of purchases from both stores, because working out from the stores' raw messages whether a subscription is currently running is the kind of thing that is easy to get subtly wrong. RevenueCat is a company in the United States, it acts only on our instructions under a written agreement, and what it holds about you is your Kino account identifier and your purchase history: the product, the price and currency, the dates, the store's transaction identifiers, and whether a subscription is active, in a trial, in a billing retry, cancelled or refunded. It never receives your email address, your name, or anything you have written in Kino.

For an App Store purchase, what comes back to us is a signed record of the transaction, which we keep as it was signed. From it we read and store the product, the amount and currency, the purchase date, Apple's transaction identifiers, the environment, and, for subscriptions, the status, renewal date and whether auto-renew is on. This does not arrive only once: for as long as a subscription runs, we are notified whenever it renews, lapses, is cancelled, is refunded, or you switch auto-renew on or off.

For a Google Play purchase, the same kinds of message reach us through RevenueCat, and we keep a copy of each as it arrived; unlike Apple's, they are not signed. Right after a purchase the Android app also sends us the price it showed you and Google's order number, so the purchase shows on your account at once. From these we store the product, the amount and currency you paid, the purchase date, Google's order number, the environment, and, for a monthly contribution, its status, renewal date and whether auto-renew is on.

We keep all of this so we can unlock Kino Plus for your account, show your supporter badge, avoid double-counting a transaction, and keep our accounts straight. Deleting your account deletes your purchase history and your RevenueCat record. The messages Apple and RevenueCat send us about each transaction are kept for seven years, because Dutch bookkeeping law requires us to keep the records behind our income for that long (section 11).

4.9 Importing from Letterboxd

If you import a Letterboxd export, you are uploading a ZIP that we parse into your watched films, diary, ratings, reviews, watchlist, likes and lists. We keep the parsed content as your Kino data, plus a job record with counts, timing and anything we could not match to a film so you can fix it. Everything an import creates arrives private, so nobody else sees it while the import runs. When it finishes we ask whether you want to make it public, and your answer is applied to the reviews and the watches it created. Lists an import creates are always private, and you can change a list yourself at any time. Re-importing overwrites an existing review of the same film, including one you wrote by hand.

4.10 Reports and support

When you report a review, comment, list or profile, we record who reported what, the reason, and anything you wrote, so a person can look at it. When you email us, we have your email and whatever you tell us.

If you use the form on the contact page, we store the name and email address you enter, the topic you pick, and your message, and we email a copy to the inbox for that topic so someone can answer you. We do not store the IP address the form was sent from; it is used only to count requests against a rate limit, as described in 4.11. You can ask us to delete a message you sent at any time: see section 13.

If you send feedback from the app, we store your message, the kind of feedback you picked, your app version and build, your phone's operating system and version, and its make and model, which the app shows you before you send. If you attach a screenshot, we re-encode it on our servers first, which removes the location and anything else stored in the file, and keep it in private storage that only our staff can open, through a short-lived link. Feedback and its screenshot are deleted with your account.

4.11 Security and audit records

We keep three kinds of operational record, plus service metrics.

  • Application logs. Our per-request log line records only the method, path, status, duration and a per-request identifier, and never your IP address or your user agent. A small number of other log lines do record your IP address: when a request is refused for hitting a rate limit, and when a password reset is requested or completed or a password is changed. Credentials that ride in a query string are stripped before anything is written, though a value that sits in the path itself, such as the push token used when a device signs out, is not.
  • Request traces. For each request, our servers record how long each step took, together with the address that was asked for, including the part after the question mark. Credentials are stripped from that part, but for a showtime search it holds the coordinate the search was for. Traces are deleted after 7 days.
  • The audit trail. Changes to accounts and content are recorded together with the actor, the action, the affected record, and a full snapshot of what that record contained, which for a review or a list includes the text you wrote. These records also include your IP address and user agent, so we can investigate abuse, account takeover and our own mistakes. A password-reset request records the address it came from.

Authorisation decisions are logged separately: we record every refusal and everything done by an administrator, and sample ordinary approvals, and these records do not carry an IP address. Service metrics (request rates, errors, latency) are not tied to you.

Rate limiting. To stop one person or one machine hammering sign-in, registration and password reset, we count requests against the IP address they come from. The count lives in memory for the length of the window and then disappears.

4.12 The waitlist

If you enter your email address on the website to ask for a place, it is stored in our waitlist. We keep the address, where the sign-up came from (for the website, simply that it was the landing page), and where you are in the queue: waiting, invited, or declined. If we send you an invitation, we record that it was sent and when.

We use it for one thing, which is to offer you a place when one opens. We do not add you to a newsletter, we do not use it to market anything else to you, and we do not pass it to anyone else. It is kept until you are invited or until you ask us to remove it.

You can ask us to remove you at any time by writing to privacy@kinoapp.eu, and we delete the entry.

Hearing when Kino launches. If you ask on the website to be told when Kino comes out on your phone, we store your email address, which platform you asked about, whether you confirmed the address and when, when we told you, where you signed up, your language, and the IP address and browser details from when you signed up, as a record of your consent. We send you a confirmation email, then one email when Kino is out on your platform, and nothing else. An address that is never confirmed is deleted after 14 days, an entry is deleted 90 days after we have emailed you, and if you ask to be taken off the list, the entry is gone for good within 30 days.

4.13 How the apps are used

The apps measure how they are used, so we can tell which parts work and which do not. There is exactly one tool for this, PostHog, and we use its European service, so the data stays in the EU. The apps send it through a hostname of ours, e.kinoapp.eu, which PostHog runs for us as a proxy in front of that service, on Cloudflare's network. That is there so the measurement is not silently blocked on some networks and not on others, which would leave us with a picture skewed towards people with less protective settings. The website uses the same service, and section 4.16 covers it.

What it records. The screen you are on, and an event for each thing you do: opening a title, logging a watch, finishing setup, swiping a card, starting a purchase. Each event carries a few properties describing the shape of what happened, such as which tab you came from, how many items were on screen, or how long a card was visible. It also records app launches (and on Android, installs, updates and the app going to the background), whether you support Kino and on which plan, whether you have finished setup, whether push is on, and crashes and errors together with the technical detail of where the code failed. Every event carries your app version and the basics of your phone: its make and model, operating system and version, language, time zone and screen size, and, depending on the phone, whether you are on Wi-Fi or mobile data and the name of your mobile network.

What it does not record. Nothing you write. Not a review, a comment, a list name, a bio, a search query, a message or a caption. This is enforced rather than intended: in both apps, a property whose name looks like free text or a personal identifier is stripped and replaced with a marker before anything leaves the device, and in the iPhone app the build fails if somebody adds one. There is no advertising identifier, and session replay, which would record your screen, is switched off in the code.

Where you are. The apps never send your location. Every request on the internet shows the IP address it comes from, and PostHog uses that to work out a city and a country, keeps those two with the event, and discards the address. Since October 2026 it keeps nothing finer. Until then it also kept a postal code and approximate coordinates worked out the same way, and events recorded before the change still carry them.

Who it is about. Events are attached to the same opaque account identifier used elsewhere in this policy, never to your email address or your name. The app also holds a random identifier for the installation itself, so we can tell one device from another; it is not linked to anything Apple or Google gives us and it survives signing out. On Android, if your phone backs up app data to your Google account, restoring that backup brings the same identifier back.

Turning it off. Settings, then Privacy, then Share usage data, in either app. It is on by default. Turning it off stops the app sending anything from that moment. It also stops our servers sending what they send about you: a handful of events about your activity, such as logging a watch or writing a review, and two of your answers from setup, how you heard about Kino and what you mainly want to use it for. If the setting on the device and the setting on the account ever disagree, off wins. Deleting your account deletes your PostHog record and the events belonging to it.

Being shown different versions. We sometimes show different versions of a screen to different accounts, to learn which is clearer, and section 13 of the terms covers the ones that change a price or a trial. Which version you get is worked out by our server from your account identifier, at random, never from anything you have logged, and it is fixed for you once decided so the app does not change under you. Because that decision governs what the app shows, it is made whether or not you have turned usage data off: a privacy switch that quietly changed which version of Kino you were using would be the wrong kind of switch. Making it sends PostHog your account identifier, whether yours is an administrator account, and the organisation it belongs to if it belongs to one, and nothing else. If you have turned usage data off, we do not then record what you did with the version you were shown, so you are shown the change but never measured.

Diagnostics. Settings, then Privacy, also has a switch called Link diagnostics to your account. It belongs to technical diagnostics, how long screens take and which errors occur, that the apps are built to send to our own servers. We do not collect them today, so the switch changes nothing yet. Before we start, this section will say exactly what diagnostics contain.

4.14 Your profile photo

You can add a profile photo, by taking one or choosing one you already have. Either way the app only receives the one photo you pick: choosing uses your phone's own photo picker, which runs outside the app, so Kino never sees the rest of your library. On iPhone the app asks for camera access the first time you tap Take photo. On Android it hands over to your camera app, and never asks for camera access itself.

The app crops the photo to a square and shrinks it before uploading. On our servers we then re-encode it from scratch, which removes the location and anything else stored in the file, and keep it in two sizes. Every photo is checked by an automated system that runs on our own servers, and one it is unsure about is looked at by a person before it appears.

Your profile photo is public. It appears wherever your name does, and anyone who has its web address can open it, whatever your account's privacy setting. You can replace or remove it at any time. For each photo you upload we keep a record of that check: the scores, the decision, who reviewed it and any note they made, and a fingerprint of the image. Those records are deleted with your account, and so are your photos. A photo held back for review and not approved is deleted 48 hours after the decision.

4.15 Keeping the app up to date

When you open the app, it fetches a small file from updates.fijagi.com that says which is the oldest version of Kino that still works, so it can ask you to update when yours has fallen behind. The request carries nothing about you or your account. Like any request on the internet, it shows your IP address to the server that answers it, which is Cloudflare's (section 9).

4.16 How the website is used

The public website counts visits, through the same PostHog service as the apps and the same hostname of ours, e.kinoapp.eu (section 4.13). It does this without a cookie and without storing anything in your browser.

What it records. Which pages are opened, in which order and for how long, and where a visit came from: the site that linked here, and the campaign labels a link carries if it has any. It records seven more things when they happen: a link to the App Store or Google Play being followed, the Get Kino window being opened, the waitlist form, the form for hearing when Kino launches or the contact form being accepted, a page that passes a link on to the app being opened, and a page trying to open the app. Each carries the basics of your browser: its name and version, your operating system and its version, whether it runs on a phone, a tablet or a computer, the size of your screen and of the browser window, your language and your time zone.

When a phone goes straight to its store. A phone that opens kinoapp.eu/download in its own browser, or follows one of our links to the App Store or Google Play, goes on to the store before any page loads. A phone that opens the page inside another app's browser is sent on by the page itself. Our server counts each of these itself, because the page never gets the chance to: which store, whether it was the app or a beta, the campaign labels on the link, and which app's browser you were in, if you were in one. It sends nothing about your phone or your connection, and gives each count a new code that points to nobody.

Telling the stores where you came from. If the link you followed carried campaign labels, the site adds them to its link to the App Store or Google Play, so Apple and Google can tell us how many people installed Kino from that campaign. They tell us totals, never who.

What it does not record. Nothing you type: not an email address, not a message, not a search. Not the secret part of a link. An invite, a join link and a password-reset link each carry one, and the site removes it from the page address before anything is sent, along with every other part of the address except the page itself and the campaign labels. Not which film, list or person a shared page is about, only that it was a shared page. Not what you click or how far you scroll, and no recording of your screen. No advertising identifier of any kind, including the ones ad networks add to links.

Who it is about. Nobody we can name. There is no account behind a visit, and no identifier is kept in your browser. To count visitors at all, PostHog turns your IP address, your browser's description of itself and the day's date into a code that cannot be turned back, uses a different one the next day, and discards the address. So a visit today and a visit tomorrow are two visitors to us, and a visit is never linked to an account in the apps. Unlike in the apps, PostHog works out no city and no country for a visit to the website. It discards the IP address before that step.

Saying no. If your browser sends Do Not Track or Global Privacy Control, the website sends nothing at all, our server counts nothing, and the links to the stores carry no campaign labels.

5. What we do not do

Stated plainly, because the absence is the point:

  • No advertising, no ad networks, no ad identifier. The iPhone app cannot even ask for tracking permission, because the code to do it is not there, and the Android app removes the advertising-ID permission that Google's libraries would otherwise add.
  • No advertising or marketing analytics on the website. No Google Analytics, no Firebase, no Amplitude, no Mixpanel, no Segment, no Hotjar. The site counts visits through PostHog, without a cookie, as section 4.16 sets out, and uses nothing else.
  • No attribution or fingerprinting SDKs, anywhere.
  • In the apps there is one measurement SDK, PostHog, and we would rather name it than claim an absence that is not true. It records which screens you open and which actions you take, never what you write, and it also catches crashes and errors so we can fix them. It is described in full in section 4.13, and Settings, then Privacy, then Share usage data turns it off. There is no Sentry, no Crashlytics, no Firebase service and no advertising SDK.
  • We do not sell, rent or share your data with data brokers.
  • No training generative AI models on your reviews, ratings or viewing history, and no supplying them to anyone else for that. Ranking inside Kino is a different thing, described in section 12.
  • No reading your content except to run the service, which means moderation when something is reported and debugging when something breaks.
  • No microphone, health data or calendar access, and no access to your photo library. A photo you choose for your profile or attach to feedback comes through your phone's own picker, which hands the app only that one photo. The camera is used only when you tap Take photo for your profile picture (section 4.14). The other permissions the apps ask for are contacts, location and notifications, each only when you tap to use it, and sections 4.5 to 4.7 set out what each one does.

If any of this changes, we will update this page.

6. Sensitive information

We do not ask for special-category data (health, beliefs, politics, sexual orientation, ethnicity) and we do not infer it.

But a film diary can reveal a great deal about a person, and a review is a place where people often write personal things. Where you publish something of that kind yourself, we handle it on the basis that you have made it public, which is what Article 9(2)(e) of the GDPR covers. Where you keep it private, that basis does not apply, so we rely on your explicit request instead: by writing personal material into a private review, watch or list you are asking us to store it for you, and you can withdraw that at any time by deleting the item or your account. Either way we do not analyse it or infer anything from it.

7. Why we are allowed to do this

Under Article 6 of the GDPR, each purpose needs a lawful basis. Ours:

Performance of our contract with you, Art. 6(1)(b). Creating and running your account; signing you in; storing your profile, including your photo, and your watches, reviews, lists and follows, and showing them to the audience you choose; the social features; imports; building your data export; recording your supporter status.

Your consent, Art. 6(1)(a). Access to your contacts, setting a location, push notifications, optional emails, and the list for hearing when Kino launches. Each is a separate switch, off until you turn it on. Turning one on does not turn on any other, none of them is a condition of having an account, and turning one off later is exactly as easy. We keep a record of what you turned on and when. You can withdraw any of them at any time in the app or in your phone's settings, which stops the processing from then on without unpicking what was lawful before.

Our legitimate interests, Art. 6(1)(f). Keeping Kino secure and available; preventing abuse, spam and account takeover; rate limiting; the audit trail; diagnosing faults; moderating reported content and checking profile photos; answering feedback you send. Three operations run on this basis and deserve naming: personalised recommendations, worked out from what you have logged, rated, skipped and hidden, which you can object to at any time by writing to privacy@kinoapp.eu; the internal analytics copy described in section 10, kept so we can understand how Kino is used without querying the live system, with your email address and password hash excluded from it; and the usage data described in section 4.13, kept so we can tell which parts of the app work. That last one you can stop without writing to anybody, with the Share usage data switch in Settings, which is an objection under Article 21 built into the app. We have weighed these against your interests: the usage data never includes what you write, the analytics copy never leaves our own infrastructure and follows your corrections and deletions within 10 days, and none of it is used to profile you commercially or shared outside Kino.

Deciding which version of a screen to show you sits on the same basis, and is deliberately not tied to the switch above, because a privacy setting that changed which version of the app you were using would not be a privacy setting. It uses your account identifier and nothing you have logged. Section 4.13 explains what that means in practice.

Legal obligation, Art. 6(1)(c). Keeping records we are required to keep, and responding to lawful requests from authorities.

8. Who can see what you post

Kino has two controls, and the more restrictive setting always applies:

  • your account is public or private;
  • each item, a review, a logged watch, a list, is public or private.

A private item is visible only to you, whatever your account says, with two exceptions you create yourself: if you invite someone to work on a private list, they can open it, and if you tag companions on a watch, they are told which film you tagged them on. Everything else marked private stays with you. A public item follows your account: visible to anyone on Kino if your account is public, and only to followers you have approved if it is private. New items default to your account's setting, decided on our servers rather than trusted from the app.

Lists carry their own switch, separate from your account. The create-list form starts a new list public, so unless you change it before saving it is public straight away; you can make it private at any time, and on a private account a public list still only reaches followers you have approved. Comments and likes inherit whatever they are attached to. Your watchlist, favourites and follows follow your account setting. Drafts are only ever yours.

Switching your account to private narrows the audience for everything already public, without changing a single item. Switching it back to public widens it again, and you will be asked to confirm first.

Two things stay visible either way: your account can still be found by name, so people can ask to follow you (turn off "Suggest my account to others" if you would rather not appear in search and suggestions), and anything you already published may have been seen, saved or screenshotted. We can change what our servers will serve. We cannot retrieve what someone already read.

Your profile photo is outside both controls. It shows wherever your account does, and anyone who has its web address can open it, whatever your settings (section 4.14).

One more control, and it points the other way. Muting someone removes their activity from your feed. It hides nothing of yours from them, they are not told, and it is not the same as unfollowing. Kino has no block feature yet. If you need someone kept away from your account, make your account private so only approved followers see anything, remove them as a follower, and report them to us.

Share links. A share link is meant to open a small preview page for a public item, so anyone with the link can see it and the link-preview bots of whatever you shared it into (Messages, Slack, WhatsApp, Discord) can cache a title, description and image. That preview is currently switched off: the share page asks our API for the item without signing in, and the API requires a signed-in caller, so a share link returns nothing whether the item is public or not. When we turn previews on, treat anything you share as public, because those bots keep their own copy. We ask search engines not to index those pages, but that is a request, not a control.

9. Who else your data reaches

We use a small number of outside services, and they fall into two groups.

Working for us. These act only on our instructions, under a written agreement that says what they may do with your data and forbids everything else.

  • Hetzner (Germany). Runs the machines that hold the application, the database and the caches, and the object storage that holds files such as profile photos, feedback screenshots and data exports. Hetzner provides the infrastructure and does not use your data.
  • Our own mail server. Account, security and notification emails are sent from no-reply@kinoapp.eu through a mail server we run ourselves, not a third-party email company.
  • PostHog. Measures how the apps and the website are used, and decides which version of a screen you are shown. We use its European service, so the data is held in the EU, and what the apps and the website send reaches it through a proxy PostHog runs for us on Cloudflare's network. Sections 4.13 and 4.16 set out exactly what reaches it, and how to turn it off.
  • RevenueCat (United States). Keeps track of subscriptions and purchases from the App Store and Google Play. It receives your Kino account identifier and your purchase history, and nothing else. Section 4.8 has the detail.
  • Cloudflare (United States). Runs the name servers for our domains, and serves the small file the apps check to see whether they need updating (section 4.15). It sees your IP address when your phone fetches that file, and nothing about your account.

Acting for themselves. These decide for themselves what they do with what reaches them, and each has its own privacy policy.

  • Apple. Sign in with Apple, if you use it. In the iPhone app also: delivering push notifications; App Store purchases, if you support Kino; and Apple Maps and the system geocoder if you search for a city or use your current location.
  • Google. Sign in with Google, if you use it. In the Android app also: Google Play, for installing and updating the app and for purchases if you support Kino there; and the geocoder built into Android, which on most phones is Google's, if you search for a city or use your current location.
  • The Movie Database (TMDB). Our catalogue comes from TMDB, fetched by our servers with our own key, so we send them nothing about you. But posters and stills load directly from TMDB's image servers in the apps, on our share pages and in the staff dashboard, so your device's IP address and the image request reach TMDB in those places. The public pages of our website show no TMDB imagery, so nothing about them reaches TMDB.

We also share with:

  • Link-preview bots, when share previews are on, as described in section 8.
  • Authorities, where we are legally required, or where we ourselves have reason to suspect a serious threat to someone's safety, in which case we may contact them first. We will tell you unless we are forbidden from doing so.
  • A future owner, if Kino is ever sold or merged. We would tell you before your data moved, and this policy would keep applying until a new one was published.

Other Kino users see whatever your privacy settings allow, which is the point of a social product but worth stating in a list of recipients. Cinema showtimes come from Cineville and geocoding for cinema addresses from PDOK, but that is us fetching data about cinemas; nothing about you goes to either.

If you are not on Kino. Some of what passes through Kino is about people without an account: a hashed email address from someone's contacts, a report that names you, or a public review that mentions you. Where data about you came from someone else, the rights in section 13 are still yours. Write to privacy@kinoapp.eu and say enough for us to find it.

10. Where your data is kept

Kino is hosted within the European Union.

The application, the database, the caches, the search index, and our logs, traces and metrics run in a data centre in Falkenstein, Germany. The files we store, such as profile photos, feedback screenshots and the archives we build when you export your data, and our internal analytics store sit in Hetzner's object storage in the same place.

We mirror most of the database into that internal analytics store, so we can understand how Kino is used without querying the live system. Your email address and password hash are excluded from that mirror. The rest is in it, keyed to an account identifier: your username, name, bio and the address of your profile photo, your settings including a saved place, your answers from setup, and your reviews, watches, lists, comments, follows and reports. The stream of changes that feeds it keeps each change for about a week. When something is deleted or corrected in our database, the mirror follows within 10 days.

International transfers. Everything we run ourselves is in the EU, and PostHog holds its data on its European service, so neither leaves the EEA. Some transfers do happen.

Apple, Google and TMDB decide for themselves what they do with what reaches them, so they choose their own safeguards under Chapter V of the GDPR, normally the EU-US Data Privacy Framework where the recipient is certified and standard contractual clauses otherwise, and their privacy policies set out which.

RevenueCat is different, because it works for us rather than for itself: it is in the United States, so the safeguard is ours to provide, and our agreement with them includes the European Commission's standard contractual clauses together with the additional measures those clauses require. What reaches them is limited to your account identifier and your purchase history, as section 4.8 describes.

Cloudflare is in the United States too. It works for us when it runs our name servers and serves the update file, and for PostHog when it carries usage data to PostHog's European service. Cloudflare is certified under the EU-US Data Privacy Framework, and its data processing terms include the European Commission's standard contractual clauses.

We do not rely on your consent for any of these transfers.

11. How long we keep it

  • Your account and everything in it: for as long as your account exists.
  • After you ask us to delete your account: there is a 30-day grace period, during which you can cancel by signing in. Once it ends, we delete your account and content, and any remaining records are permanently erased from our database within a further 30 days, so the full process may take up to 60 days. Our delete your account page sets out the steps.
  • Things you delete yourself: they go from Kino straight away, and are permanently erased from our database within 30 days.
  • Our internal analytics copy (section 10): deleted or corrected data leaves it within 10 days of leaving our database.
  • Backups: we take encrypted backups, kept in the EU for 30 days, so a fault does not cost you your account. Deleted data leaves them as they roll over. We never restore a backup to bring deleted data back.
  • Data-export archives: 7 days, then automatically deleted. Deleting your account destroys any outstanding archive immediately.
  • The contact hashes you send us for matching: not kept at all.
  • Feedback and support records: kept while your account exists and deleted with it, feedback screenshots included.
  • Purchase records: your purchase history, and your record at RevenueCat, are kept while your account exists and deleted with it. The messages Apple and RevenueCat send us about each transaction are kept for seven years, because Dutch bookkeeping law requires us to keep the records behind our income for that long, and then deleted. Apple and Google keep their own records of a purchase under their own rules, which we cannot delete for you.
  • Profile photo checks (section 4.14): kept while your account exists. A photo held back and not approved is deleted 48 hours after the decision.
  • The launch list (section 4.12): unconfirmed addresses 14 days; entries 90 days after we email you; an entry you ask us to remove, 30 days.
  • Usage data (section 4.13): kept while your account exists. Deleting your account deletes your PostHog record and the events attached to it. Which version of a screen you were shown is kept for as long as we are running that comparison, and deleted with your account.
  • Recommendations worked out from your activity: rebuilt every night; earlier versions are deleted after about three weeks.
  • The search index: an entry goes when the record it mirrors leaves our database.
  • Audit records: 90 days with the IP address and user agent, after which those are anonymised; the whole record is deleted at 12 months.
  • Authorisation decision logs: up to 36 months, then deleted.
  • Application logs and request traces: deleted after 7 days. Service metrics: 3 months.
  • Reports you file: kept while the report is being handled and for a reasonable period afterwards, so patterns of abuse can be seen.

12. Recommendations, and automated decisions

What Kino suggests to you (For You, Explore, more-like-this) is computed from your own activity, from what people you follow do, and from the catalogue. Some of it is worked out by a separate recommendation service that we run on our own infrastructure; when it ranks for you, our system sends it your account identifier and reads your activity to do so. It affects which films you are shown and nothing else, and nothing here produces a legal or similarly significant effect on you within the meaning of Article 22.

We do not use your activity to price anything, to score you, or to decide anything about you outside the app. Kino does not currently send recommendation notifications; there is a switch for them in Settings so that if we ever start, you can turn them off first. There is no way to switch off personalised ranking itself, so we will not imply there is; what you can do is log or rate less, and the model then has less to work with.

13. Your rights, and how to use them

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to portability, and to withdraw consent where consent is what we rely on.

Most of it you can exercise yourself, without asking:

  • Access and portability: Settings, then Privacy, then Export your data. We build a ZIP of JSON files covering your profile, settings, reviews, watches, lists, favourites, following, comments, reactions and imports, and give you a download link. It is available for seven days, and you can request up to three a day.
  • Rectification: edit your profile, reviews, lists and settings directly in the app. Write to us about anything you cannot correct yourself.
  • Erasure: Settings, then Account & security, then Delete account, in either app. Our delete your account page has the steps, and a way to ask without the app. You get a reminder email before it happens, your account keeps working during the grace period, and signing in and cancelling stops it. When it completes, your account and content are deleted, not hidden. Some records survive on their own timers, as section 11 sets out, because keeping a security audit trail is a legitimate interest and a legal expectation. When you correct or delete something, we pass that on to the internal analytics copy within 10 days, and to our backups as they roll over.
  • Withdrawing consent: turn off contacts access, location, or notifications in the app or in your phone's settings.

Two things are left out of the export file, because they are as much someone else's data as yours: the list of people who follow you, and other people's comments on your content. That is a limit on the export, not on your rights. If you want either, ask us and we will give you what we can under your right of access, redacting only what would tell you more about the other person than you are entitled to know.

Your right to object, stated on its own because the law requires it. Where we rely on legitimate interests, listed in section 7, you can object at any time on grounds relating to your situation. If you do, we stop that processing unless we can show compelling grounds that override your interests, or we need it to establish or defend a legal claim, and we will tell you which.

For restriction, objection, or anything the export does not cover, write to privacy@kinoapp.eu. We will respond within one month, and tell you if we need longer (the GDPR allows up to two further months for complicated requests, and we will explain why). If we decide not to act on a request, we will still answer within that month, tell you why, and tell you that you can complain to the supervisory authority and can go to court. We may ask you to sign in or otherwise confirm who you are, because disclosing an account's data to the wrong person would itself be a serious privacy failure. None of this costs anything, unless a request is repetitive or excessive.

14. Children

Kino is for people aged 16 and over. We do not collect dates of birth and cannot verify anyone's age, so we act on what we learn: if we have good reason to believe an account belongs to someone below the age that applies to them, we close it and delete the data. If you are a parent or guardian and that describes your child's account, write to privacy@kinoapp.eu and we will deal with it quickly. Who may hold an account, including the national-age rules for people aged 13 to 15, is set out in section 3 of the terms of use.

15. Security

What we do: passwords stored as bcrypt hashes, never in plain text. TLS on everything that crosses the public internet. Access tokens that expire and refresh tokens that rotate, with a revocation list. Rate limits on sign-in, registration, password reset and other sensitive routes. An audit trail. Permission checks written once and tested against a matrix of viewer-and-content combinations, because privacy rules implemented twice are privacy rules that drift apart. A small number of people with access, and infrastructure that is not reachable from the public internet unless it needs to be.

What we do not claim: that Kino is unbreakable, that we hold any certification, or that we have been independently audited. We have not. We keep our own register of privacy and security issues and work through it.

If something goes wrong. If we find a personal data breach we assess it at once. Where it is likely to put your rights at risk we report it to the supervisory authority without undue delay and, where we can, within 72 hours, and if we are slower we explain why. Where a breach is likely to put you at high risk we tell you directly and without undue delay, in plain language. We keep a written record of every breach we find, including those that never reach the reporting threshold.

16. Cookies and similar technologies

The website uses no analytics cookies, no advertising cookies, and no third-party cookies of any kind. It counts visits without a cookie, and without storing anything in your browser to do it (section 4.16). There is nothing to consent to, which is why you are not being asked.

The staff dashboard sets two first-party cookies: one remembers whether the sidebar is open, and one is a simple marker that you are signed in, so the site can tell a signed-in visit from a signed-out one before the page loads. Neither tracks you. Your sign-in tokens live in your browser's local storage, alongside the organisation you have selected, your light or dark theme, and, in the video editor, a local copy of your recent edits. Both cookies and that storage are strictly necessary for a signed-in session.

The iPhone app stores your sign-in tokens in the iOS Keychain, marked device-only, so they are not synced to iCloud or restored onto a new phone. It also keeps a few preferences and recently-viewed items in local storage on the device, which never leave it.

The Android app stores your sign-in tokens encrypted, with a key held in the phone's Android Keystore that never leaves it, and keeps them out of Android's backups and phone-to-phone transfers, so they are never restored onto another phone. It also keeps a few things on the phone that never reach us: your recent searches, which are cleared when you sign out, your For You filters, which can include friends you picked, a few preferences, and a cache of the images it has shown. If your phone backs up app data to your Google account, those can be part of that backup, together with the installation identifier described in section 4.13; the sign-in tokens never are.

Neither app contains any tracking technology.

17. Changes to this policy

We will update this page when what we do changes. For material changes we will email registered users at least 30 days beforehand and update the date at the top. Smaller clarifications take effect when published. If a change means we would process your data on a new basis that needs your consent, we will ask for it rather than assume it.

This page is written in English. If you use Kino in another language and English is difficult for you, write to privacy@kinoapp.eu and we will explain any part of it in the language you prefer.

18. If you think we have got it wrong

Tell us first: privacy@kinoapp.eu. We will do our best to resolve the issue directly.

You also have the right to complain to a data protection supervisory authority, whether or not you talk to us first. You can go to the authority in the EU country where you live or work, or where you think the problem happened. Because we are established in the Netherlands, our lead supervisory authority is the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, reachable at autoriteitpersoonsgegevens.nl. Separately from any complaint, you can also take us to court if you believe we have breached your rights under the GDPR.

19. Contact

privacy@kinoapp.eu for anything on this page, or by post to Gijs Addas, Marnixstraat 69a, 1015 VC Amsterdam. Our full details are in section 1.

For everything else, the contact page is faster. The terms of use cover the rest of the relationship.