Privacy Policy

This Privacy Policy explains how Moodflix (“we”, “us”, “our”) collects, uses, and shares information about you when you use moodflix.app and related services (the “Service”).

1. Information We Collect

Account information

When you create an account we collect your email address, display name, and (if you sign in with Google) your Google profile name and avatar URL. Passwords are hashed by our authentication provider and never accessible to us in plain text.

Usage data

We store the movies and series you add to your watchlist, your ratings (like/dislike), watch status, and AI mood prompts you submit. These are tied to your account and used to power the Service.

Technical data

We collect IP address, browser type, device type, approximate location (country, derived from IP via Vercel headers), and request logs needed to operate, secure, and improve the Service.

2. How We Use Information

• Provide and maintain the Service (authentication, watchlist sync, AI recommendations).
• Personalize movie and series recommendations based on your activity.
• Send service-related notifications (push notifications, if you opt in).
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations.

3. Third-Party Services

We use the following processors to operate the Service:

• Supabase — authentication, database, file storage.
• Google — OAuth sign-in (we receive your email, name, profile picture).
• Google Gemini (via Vercel AI SDK) — processes your mood prompts to generate recommendations. Prompts are sent to Google for inference.
• TMDB (The Movie Database) — movie and series metadata, posters, backdrops, watch-provider data.
• Vercel — hosting, edge functions, analytics.
• Sentry — error tracking and performance monitoring.

Each of these services has its own privacy policy governing how they handle data they receive.

4. Data Sharing

We do not sell your personal information. We share data only with the processors listed above, when required by law, or in connection with a merger, acquisition, or asset sale (with notice to you).

5. Data Retention

We retain account data for as long as your account is active. You can delete your account at any time from settings; this removes your profile, watchlist, ratings, and AI history. Backups may retain residual copies for up to 30 days.

6. Your Rights

Depending on your jurisdiction (including GDPR for EU/EEA residents, UU PDP for Indonesian residents, and CCPA for California residents), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent (where processing is based on consent).

To exercise any of these rights, email us at hello@yuliuskevin.com.

7. Security

We use industry-standard measures including TLS encryption in transit, encrypted database storage at rest, hashed passwords, and Row Level Security policies that prevent cross-account data access. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

8. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

9. International Transfers

Our processors operate globally. By using the Service, you consent to your data being transferred to and processed in countries outside your country of residence, including the United States.

10. Changes to This Policy

We may update this policy. Material changes will be announced via email or in-app notice at least 14 days before taking effect. Your continued use of the Service after the effective date constitutes acceptance.

11. Contact

Questions or requests? Email hello@yuliuskevin.com.