Privacy policy
This policy explains what personal data the TV Tracker app and website ("TV Tracker", "we", "us") collect, why, and what your rights are under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
The data controller is Martin Miles, an individual based in the United Kingdom who runs TV Tracker as a free personal project. You can contact us via our contact form.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account email address | You, when you create an account |
| Name and profile picture | Google, only if you choose "Sign in with Google" |
| Display name | You |
| Watchlists, watched status, ratings and notes | You, as you use the app |
| Household/group memberships and invites, including the email address of anyone you invite | You, when you create or join a group or invite someone |
| Streaming services and TV channels you select | You |
| Push notification token | Your device, if you allow notifications |
| Email digest preferences | You |
| Basic technical logs (for example request times, IP address and error details) | Generated automatically by our hosting providers when the app talks to our servers |
We don't collect your location, contacts, payment details or advertising identifiers.
3. Why we use it and our lawful bases
- Providing the service: creating and running your account, storing your lists, and showing where titles are available. Lawful basis: contract (it's needed to provide the app you've signed up for).
- Alerts: sending push notifications and email digests about new series on the services and channels you've chosen. Lawful basis: contract. You can turn alerts off in the app or your phone settings.
- Invites: sending an invite email to someone you choose to add to your household or group. Lawful basis: legitimate interests (letting you share lists with people you choose). We only use an invitee's email to send that invite and to link them to the group if they accept.
- Keeping the service secure and working: technical logs used to fix problems and prevent abuse. Lawful basis: legitimate interests.
4. No adverts, no selling of data
TV Tracker has no adverts. We don't sell your personal data, and we don't share it with anyone for advertising or marketing.
5. Who processes data for us
We use the following providers to run TV Tracker. They process data only to provide their service to us.
- Supabase: database, sign-in and server functions. Our project is hosted in London, UK (AWS eu-west-2).
- Expo: delivering push notifications to your device (using your push token and the notification text).
- Resend: sending emails such as invites and digests (using the recipient's email address and the message content).
- Google: optional "Sign in with Google". If you use it, Google shares your email address, name and profile picture with us. Google's own privacy policy applies to your Google account.
- TMDB (The Movie Database), including JustWatch data provided through TMDB: show and film information and where-to-watch details. The app requests show data from TMDB (for example a search term or title ID). We don't send TMDB your account details.
TV schedule information comes from TVmaze and broadcaster listings. Our server requests schedules for channels; no personal data is sent to them.
6. International transfers
Our main database is in the UK. Some providers (for example Expo, Resend and Google) are based in or may process data in the United States or elsewhere. Where personal data is transferred outside the UK, we rely on safeguards recognised under UK law, such as UK adequacy regulations (including the UK–US Data Bridge where the provider participates) or the International Data Transfer Addendum to standard contractual clauses offered by the provider.
7. How long we keep it
- Account data, lists, groups, preferences and push tokens: until you delete your account.
- Pending invites: until they're accepted, declined or the group is deleted.
- Technical logs: kept for a short period (typically days to a few weeks, depending on the provider) and then deleted automatically.
- Backups: may hold deleted data for up to 30 days before being overwritten.
8. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data deleted (erasure). See Delete your account;
- receive your data in a portable format (portability);
- object to processing based on legitimate interests;
- ask us to restrict processing in some circumstances.
To use any of these rights, contact us via our contact form (choose the topic "Privacy/data request"). We'll reply within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to sort things out first.
9. Children
TV Tracker isn't directed at children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we'll delete it.
10. Security
Data is sent over encrypted connections (HTTPS). Access to your data in the database is restricted by account-level access rules so that you can only see your own data and that of groups you belong to. Passwords are handled by Supabase's sign-in service and are stored hashed, never in plain text. No system is perfectly secure, but we take reasonable steps to protect your data.
11. Changes to this policy
We may update this policy as the app changes. We'll change the effective date above and, for significant changes, let you know in the app or by email.
12. Contact
Martin Miles, United Kingdom. Contact us via our contact form.