Privacy Policy

ReelOnes ("we", "our", "the app") is a movie discovery and social matching application. This policy explains what personal data we collect, why we collect it, and how we handle it.

1. Information We Collect

Information you provide

• Email address and password (required to create an account)
• First name and last name (required)
• Phone number (required, used so friends who have your number can add you; you can turn this off in Privacy Settings)
• Date of birth (required, to confirm you are at least 13)
• Profile image (optional, uploaded by you to help friends recognise you)

Information generated by your use of the app

• Username (auto-generated from your name)
• Movie and TV show swipe history (like or dislike decisions, along with the content metadata such as title, genre, and release year)
• Watchlist, shortlist, and wishlist contents
• Playlist sharing activity (which friends you share with, which movies are shared, and match results)
• Friend connections and blocked user records
• Notification preferences and notification history
• Game activity: your XP total, tier, current and longest streak, Boost balance, daily-challenge completion, per-game best scores, and head-to-head game records against friends
• Taste Test activity: challenges you send or receive, the titles chosen for them, your answers, and the resulting scores and tier

Information collected automatically

• Push notification token (an Expo Push Token used to deliver notifications to your device)
• Device platform (Android or iOS) for interface adaptation
• IP address at signup, used for rate limiting and stored on your account for security and administration purposes
• Approximate location (country and city) derived from your IP address at the time of signup. If the address gives no country, your phone's region setting (country only) is used instead. It is used for security and to show release dates for your country
• Device model and operating system at the time of signup (e.g. "iPhone 12 (iOS)")
• A timestamp of your most recent app session, updated each time you open the app
• Login activity data: each time you sign in, we record your device name, device model, operating system version, app version, and the date and time of the login. We store up to 20 recent login events per account.

Information we do not collect

We do not collect your precise location, device advertising identifiers, or browsing history. We do not collect your contacts. When you choose a contact to add or invite, the app only uses the one person you pick: their phone numbers are sent to our servers once to check whether they already have a ReelOnes account, and are not stored. Their name, numbers and email address are otherwise used only on your device, to fill in an invite that you send yourself from your own messaging app. ReelOnes never contacts the people you invite. We do not use any advertising or analytics tracking SDKs. The approximate location mentioned above is a one-time lookup from your IP address at signup only and is not tracked or updated thereafter. If you choose to upload a profile image, it is resized and compressed before upload, and any embedded metadata (including GPS location data) is automatically stripped.

2. How We Use Your Information

• Authenticate your account and keep it secure
• Let friends add you by your exact username, or by picking you from their phone’s contacts if they have your number
• Power the movie swiping and matching experience between friends
• Maintain your watchlist, shortlist, and wishlist
• Deliver push notifications about friend requests, playlist shares, movie matches, and watchlist updates
• Generate your personal taste analytics (genre preferences, era preferences, director affinity) calculated from your own swipe history and shown only to you
• Prevent abuse through IP-based signup rate limiting
• Administer the service and understand our user base across regions
• Identify suspicious or fraudulent account creation
• Show you recent login activity so you can identify any unrecognised access to your account

3. Information Visible to Other Users

When you use the app's social features, certain information is visible to others:

• Your display name, username and profile image are shown to someone who enters your exact username, or who picks you from their phone’s contacts (unless you turn that off in Privacy Settings)
• Your email address and phone number are never shown to other users, and you cannot be found by searching your name or email
• Friends you are connected with can see your display name, username, profile image (if set), and any movie match results from playlists you share with each other
• Your profile image, if uploaded, is visible to all authenticated app users
• Friends can see your display name, profile image, tier and XP total on the games leaderboard, your head-to-head game record against them, and your Taste Test tier
• No other personal data (such as your full swipe history, watchlist, or date of birth) is visible to other users

4. Third-Party Services

ReelOnes relies on the following third-party services. No personal data beyond what is described below is shared with any third party.

Firebase by Google

We use Firebase Authentication to manage sign-in and Cloud Firestore to store your account data, movie preferences, friend connections, and playlists. Firebase processes your data under Google's privacy policy.

TMDB (The Movie Database)

We fetch movie and TV show information (titles, posters, cast, ratings) from TMDB's public API. No personal data is sent to TMDB, only search queries and content identifiers.

This product uses the TMDB API but is not endorsed or certified by TMDB.

Expo Push Notifications

We use Expo's push notification service to deliver notifications to your device. Your Expo Push Token and the notification content (e.g. "You have a new friend request") are sent to Expo's servers for delivery.

Sentry

We use Sentry to collect crash and error reports so we can fix problems. A report includes technical details such as your device model, operating system, app version and your account ID. Your email address and device name are removed before a report is sent.

ipwho.is

When you create an account, or when a signup attempt is blocked by rate limiting, the IP address used is sent to ipwho.is to look up the approximate location (country and city) described in Section 1. This is a one-time lookup and is not repeated.

Resend

We use Resend to send account emails, such as email verification, password reset, account notices and confirmation that an account has been deleted. Your email address and the content of the email are sent to Resend for delivery.

Cloudflare

Our website, and the service that delivers movie information and ready-made watchlists to the app, run on Cloudflare. Cloudflare processes your IP address in order to deliver these requests. No account data is sent to Cloudflare.

Gmail by Google

Feedback you send from the app, and security alerts about blocked signup attempts, are emailed to the ReelOnes team using Google's Gmail.

5. Information Sharing

We do not sell, trade, rent, or share your personal information with third parties for advertising or marketing purposes. We will never monetise your data.

We may disclose information only:

• To the third-party services listed above, solely to operate the app
• To other users through the social features described in Section 3
• If required by law, regulation, or legal process
• To protect the safety, rights, or property of our users or the public

6. Data Storage and Security

Your data is stored in Google Cloud Firestore and Firebase Storage, secured by Firebase's infrastructure, which provides encryption in transit (TLS) and at rest. Authentication is handled through Firebase Auth with secure password hashing.

Profile images are stored on Google Cloud infrastructure (Firebase Storage). Data is processed in Google Cloud data centres, and international data transfers are protected by Standard Contractual Clauses as provided by Google's Data Processing Terms.

The app also caches movie data, your filter preferences, and notification history locally on your device using AsyncStorage. This data never leaves your device and is removed when you uninstall the app.

7. Data Retention and Deletion

We retain your data for as long as your account is active.

When you delete your account through the app, we permanently delete the items below. No longer have the app? See reelones.co.uk/delete-account to request deletion by email.

• Your profile, authentication credentials, and all personal details
• Your entire swipe history, watchlist, shortlist, and wishlist
• All friend connections, friend requests, and blocked user records
• All playlists, movie matches, and sharing history involving you
• Your profile image (if uploaded) from Firebase Storage
• All notifications and metadata associated with your account
• Your login activity history
• Your signup metadata (IP address, approximate location, device information)

Your signup IP address, approximate location, and device information are retained for the lifetime of your account and deleted when you delete your account.

Our database keeps a 7-day recovery history so the service can be restored after a serious fault. Deleted data can remain in that history for up to 7 days. It is never accessed or used for any other purpose, and it is erased automatically when the 7 days are up.

Temporary rate-limiting records (IP address counts used to prevent abuse) are automatically purged after 24 hours.

Locally cached data on your device is removed when you uninstall the app.

8. Your Rights

• Access and edit your profile information at any time through the app
• Export your watchlist data in multiple formats
• Control your notification preferences for each notification type
• Choose in Privacy Settings whether people who have your number can find you
• Remove your profile image at any time from Settings > Account
• Block other users to prevent them from interacting with you
• Request a copy of the personal data we hold about you by contacting us
• Delete your account and all associated data permanently from within the app

9. Children's Privacy

Account creation requires users to be at least 13 years old, and your date of birth is checked at signup. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will delete that data promptly.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact Us

If you have questions about this privacy policy or how your data is handled, please contact us at support@reelones.co.uk.