Privacy policy

This is a full English translation. If the two versions differ, the Polish version prevails.

In short

This summary is for easier reading and does not replace the full policy below.

• The controller of your data is VODster sp. z o.o. You can write to us at support@vodster.app.
• We collect what is needed for your account, lists, ratings, chat and recommendations, plus basic technical logs.
• AI model providers (currently DeepInfra and OpenAI) process your AI chat messages. Before you send your first message we show an information screen; the chat works once you confirm it. They may not train their models on them.
• Analytics that store anything on your device run only after your consent. Refusing is as easy as accepting.
• We do not sell personal data. Today VODster has no ads and no advertising SDKs.
• We name every recipient of data on the Subprocessors page.
• We give concrete retention periods. You delete your account in the app; you have 30 days to undo it.
• You have the right to access, rectification, erasure, portability and objection, and to complain to the President of the Polish data protection authority (UODO).

Who we are

The controller of your personal data is VODster sp. z o.o. Company details:

• For questions about your data, GDPR rights, account deletion and help, write to support@vodster.app.
• For formal matters and official correspondence, use company@vodster.app.
• We have not appointed a data protection officer because the law does not require it.

This policy covers the VODster mobile app, the web app at app.vodster.app, the marketing site vodster.app and the Matchmaker feature for guests without an account. It does not cover sites VODster links to: their owners' rules apply there.

Data, purposes and legal bases

The table below says why we process data, what data it is, on what basis and for how long. The exact periods are in Retention periods.

Where we rely on legitimate interest, our interest is a secure, stable and improving service, and defending against claims. We describe how we weighed it against your rights on the Audience measurement page, and for the other cases we send it on request.

Do you have to provide data

To create an account you must give an e-mail address (or sign in with Apple or Google). Without it we cannot conclude the contract. Year of birth, consents, notifications and AI chat are voluntary; declining does not close your account but switches off the feature concerned.

Where we get data

You give us most data yourself, or it arises as you use VODster. From Apple or Google we receive an identifier and e-mail address (and your name if you share it) when you sign in with their account. From app stores and from the browser payment provider we receive the purchase status, plan and billing period. We do not buy data about you.

Do not enter sensitive information

The chat is for choosing films and series. We do not ask for, and do not need, data about health, beliefs, religion or sex life, and we ask you not to enter them. Query text (without a user identifier) may stay in the query analysis log, which is used to improve the quality and safety of search, for 90 days. If you do write such data, e-mail support@vodster.app and we remove it from the log where we can find it.

Advertising

Today VODster has no ads and no advertising SDKs. In future the service may contain ads, sponsored content or affiliate links; they will always be labelled. Before enabling them we will update this policy and ask for the consents required. Premium will be ad-free.

Consents

We ask for consent only where it is needed, separately for each purpose, and never tie it to using the rest of the service. The AI chat runs on the basis of the contract: before your first message we show an information screen, and you can switch the chat off at any time. Consents cover:

• analytics that store data on your device (app, web app, site),
• promotional and marketing notifications (separately for each category),
• marketing e-mail (an unticked box).

You withdraw consent in the app under Profile, Privacy and data, in the web app under Settings, Privacy, and on the site with the "Privacy settings" link in the footer. You can also write to support@vodster.app. Withdrawal does not affect the lawfulness of processing before it.

Artificial intelligence

The chat in VODster is an artificial intelligence system, not a person. An AI model generates the answers and the opening sentences. It can be wrong. Information about where a title is available comes from external sources and may be out of date: check it with the streaming service before you watch. Answers are film suggestions, not professional advice.

What reaches AI providers

• The text of your chat messages. For follow-up questions the earlier part of the conversation may be added so the model understands the context.
• The voice recording, if you use voice search. We turn it into text. On the VODster side the recording exists only in server memory while the request is handled and we do not store it.
• The query or its English rendering, from which a vector is made to match the catalogue.
• For the taste portrait ("My taste") and Wrapped: titles you liked and favourite genres.

We do not send AI providers your e-mail address, name or account identifier. Remember, though, that the message text itself may contain personal data if you type it.

Who processes it

The AI model providers are currently DeepInfra and OpenAI, both based in the USA. They act as our subprocessors under data processing agreements and process data only on our instructions. The agreements do not allow them to train models on our users' data. They may keep requests for a limited time under their own terms, for example to detect abuse. We keep the current list on the Subprocessors page. When we add or change a provider we update the list and tell you on the website; this is not a change to the Terms.

Information screen

The basis for processing the content of the chat is performance of the contract (Art. 6(1)(b) GDPR): the chat cannot work unless your messages reach the AI providers. Before you send your first message we show an information screen explaining that AI providers process it; the chat starts working once you confirm it. Without that confirmation the chat does not work; the rest of the app does. You can switch the AI chat off under Profile, Privacy and data, and we then stop processing further messages.

What stays with us

• Chat history in your account: the 50 most recent conversations, until you clear them or delete the account.
• The query analysis log (90 days) is used to evaluate and improve search quality. It contains the query text and the result of the analysis but no user identifier, so we cannot tell which entries are yours. We do not use it to train other companies' models.
• A short-lived cache (up to 7 days) of query analysis results and vectors, tied to the query text and not to a user.

An answer or recommendation looks wrong? Write to us from the app (feedback) or at support@vodster.app.

Recommendations and profiling

We personalise recommendations from what you give us: your lists, ratings, likes, hidden titles, chosen VOD platforms, mood history and chat content. Ratings and likes produce a preference vector that we compare with title descriptions. This is profiling under the GDPR.

We make no decisions about you that produce legal effects or similarly significantly affect you (Art. 22 GDPR). A film recommendation is a suggestion and the choice is yours. We do not use the profile for advertising or to set a price. You influence recommendations by changing ratings, lists and platforms.

Analytics, cookies and SDKs

We follow three rules:

• Events on our own server (signed-in users and guests, never query text) are recorded on the basis of legitimate interest: we want to know which features work. We keep them for 90 days.
• Anything that stores an identifier on your device (PostHog in the app, the web app and the site, Google Analytics, cookies) is switched on only after your consent under Art. 399 of the Polish Electronic Communications Law. Refusing is as easy as accepting and does not limit your use of VODster.
• Cloudflare Web Analytics on vodster.app stores nothing on your device and assigns no identifier, so it runs without consent on the basis of legitimate interest. We explain the reasoning on the Audience measurement page.

The table below lists everything in VODster that stores or reads data on your device or connects to third parties.

PostHog records events with technical data (for example screens opened and query length), not the text of your queries or ratings. Google Analytics 4 uses cookies (including _ga) only after consent.

After your consent, PostHog derives an approximate location from your IP address and attaches it to events. We do not use your device's GPS location.

The web app

The web app at app.vodster.app is the same service in the browser, so the same policy applies. The technical differences:

• instead of cookies it uses the browser's local storage (localStorage) for the sign-in session, language, theme and interface settings; this is necessary for it to work;
• PostHog in the web app stores its identifiers in local storage and starts only after your consent;
• trailers are played by YouTube (in the web app from youtube-nocookie.com); YouTube may store data on your device when you play a trailer. We load posters directly from TMDB image servers, so your IP address reaches those companies;
• data export (JSON and CSV for Letterboxd) is being rolled out gradually; see Your rights.

Notifications and marketing messages

We split push notifications into categories. We send service notifications on the basis of the contract (Art. 6(1)(b) GDPR), without a marketing consent; promotional and marketing categories only with your consent, given separately for each. The operating system also asks for permission to send notifications.

• Service — about what you follow: a new episode, a series finale and season premiere, continuing a series, a "Watch later" title becoming available or leaving a platform, news about an actor or director, a Matchmaker match, a change in a platform you chose. We send them to perform the service you switched on.
• Summaries and reminders — a weekly summary of your viewing (Wrapped) and a reminder to finish setting up.
• Usage promotions — for example a suggestion for tonight, weekend preparation, a nudge after a long break. We send them only with your consent.
• Marketing offers — possible Premium or partner offers, only with your consent.

You can switch off each category in the app's notification settings or in the system. A notification may contain the title of a film or series from your lists; it passes through Expo and Apple or Google (see Who receives data).

We send marketing e-mail and push only with a separate consent (Art. 398 of the Polish Electronic Communications Law and Art. 6(1)(a) GDPR) whose box is not ticked by default. Every such message tells you how to opt out. Transactional messages (account confirmation, password reset, purchase confirmation, notice of a change to the Terms, account deletion) are not marketing.

Waitlist

On the site you can leave an e-mail address to be told when the app is available. When you first start using the form (touch or click it, move into it with the keyboard, or type), Cloudflare Turnstile checks that a person is filling it in (Cloudflare receives your IP address, TLS fingerprint, User-Agent, and our site key and address, and performs the check on our behalf as a processor; the basis is our legitimate interest in protecting the form from abuse, Art. 6(1)(f) GDPR). Cloudflare uses the same signals as an independent controller only to improve bot detection in Turnstile, see Who receives data and the Cloudflare Turnstile privacy addendum. After you submit the form, we send a message with a one-time link, valid for 7 days, to the address you gave. The sign-up takes effect and we record your consent only after you click the link; until then we send you nothing except messages with the link. To an unconfirmed address we send at most 3 links in total in 24 hours, at least 10 minutes apart; a new link invalidates the previous one. To an already confirmed address we send no further link.

We store, among other things, the address, the site language, the sign-up page address, the time of the last request and, once confirmed, the time of consent. The basis for sending news about the app is your consent (a ticked box and the confirmation by link). Until confirmation we keep the address and send the message with the link on the basis of our legitimate interest in verifying that the address belongs to the person signing up and in limiting abuse (Art. 6(1)(f) GDPR). We delete unconfirmed sign-ups automatically 30 days after the last request. We keep a confirmed entry until you withdraw consent, and at most 12 months after the app launches in the stores. You withdraw consent by e-mail to support@vodster.app.

Premium and payments

The rules for buying Premium (price, trial, renewal, withdrawal) are in the Terms. Here we describe the data. Payment is taken through the channel you see in the app or at checkout: the App Store, Google Play or payment in the browser.

• Purchase in the App Store or Google Play: Apple or Google handles payment, refunds and subscription management as a separate controller of that data. We receive, through RevenueCat, the subscription status, plan, period, purchase identifier and your account identifier. We never receive a card number.
• Payment in the browser: the operator is Stripe. You enter payment and billing details (card, BLIK, name, address, a tax number for the invoice if you give one) with Stripe. We receive the status, plan, period and transaction identifier.
• We also record that you accepted the price and terms and, where you agreed to an immediate start of the service, that you confirmed that statement, so we can show the contract was properly concluded and handle a possible withdrawal.
• Trial: once per account. We record that it has been used.

The basis is contract (Art. 6(1)(b) GDPR), and for invoices and accounting books a legal obligation (point (c)). We keep accounting records for 5 years (counted from the end of the tax or financial year they relate to); longer if a provision requires it. Deleting your account does not cancel a subscription bought in the App Store or Google Play (cancel it in the store first). A subscription bought on our website is cancelled when the customer is deleted in Stripe, no earlier than 30 days after you request deletion; until then it continues and renews, so cancel it earlier in the Stripe customer portal.

Who receives data

You will find the full list with names, country, purpose and type of data on the Subprocessors page. The categories of recipients:

• AI model providers (DeepInfra, OpenAI),
• database, sign-in and hosting (Supabase, Railway, Cloudflare),
• push notifications (Expo, Apple, Google) and e-mail delivery (Resend),
• analytics and error reports (PostHog, Google Analytics after consent, GlitchTip),
• payments and stores (Stripe, RevenueCat, Apple, Google),
• a tool for internal team notices (Slack),
• our legal advisers, accountants and auditors, bound by confidentiality,
• public authorities, when the law requires it.

We fetch film and series data from TMDB, Movie of the Night (Streaming Availability), OMDb, Wikipedia, TVmaze and Wikidata; we send them catalogue queries only, never your data. Details and the required credits are on the Sources and licences page.

We do not sell personal data

We do not sell personal data and we do not use data brokers. We may create and share aggregated or anonymised data from which you cannot be identified, including in market reports.

Change of ownership

If VODster merges with another company, is acquired, or we sell our business, data may pass to a successor bound by this policy. We will tell you in advance. If the successor wanted to use the data for a new purpose we will inform you and, where the law requires, ask for separate consent.

New purposes

We will not use data for a purpose other than those described here without informing you and, where the law requires, obtaining separate consent.

Transfers outside the EEA

Some providers are based in, or process data in, the USA. We transfer data to them under the European Commission's adequacy decision (the EU-US Data Privacy Framework) where the provider is certified, and otherwise under the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). If the Data Privacy Framework stopped applying, we rely on the clauses. You can obtain a copy of the safeguards by writing to support@vodster.app. We state the mechanism for each provider on the Subprocessors page.

Retention periods

Providers that have their own retention periods (analytics, error reports, e-mail, notifications, AI models) apply them in addition; we describe them in the account deletion section.

Account deletion

You delete your account yourself. In the app: Profile, Privacy and data, Delete account, then confirm. In the web app: Settings, Privacy, Delete account and type the confirmation word. The details and steps are on the Delete account page. You can also ask for deletion by e-mail to support@vodster.app.

• After your request you are signed out of all devices and receive a confirmation e-mail.
• For 30 days you can sign in again and choose "Cancel deletion". Signing in alone does not undo the deletion.
• After 30 days we delete the account and the data linked to it: profile, lists, ratings, history, chat, taste portraits, push tokens and notification settings, and the request log and analytics events tied to the account.
• Before we delete the account we erase the data about you at three providers: the person and their events in PostHog (if you consented to analytics), the customer in Stripe (which cancels a subscription bought on our website) and the subscriber in RevenueCat. If one of them does not respond, the account stays and we retry the next day, so deletion can take longer than 30 days.

What remains afterwards

Deletion covers our own systems. We state honestly what may remain:

• Invoices and accounting records — for 5 years (counted from the end of the tax or financial year they relate to); longer if a provision requires it.
• The query analysis log — up to 90 days, with no identifier, so we cannot link it to you.
• Backups — until their retention period at the database provider ends.
• Proof of acceptance of documents — for 3 years after the account is deleted we keep the kind, version and date of acceptance, under a one-way hash of the account identifier, without e-mail or name. It serves to demonstrate consent and to defend claims (Art. 7(1) and Art. 17(3)(e) GDPR). We can find it only when we already know the account identifier, for example from your complaint.
• Proof of consent given at checkout and consent history — for 6 years after the account is deleted we keep a minimal record of the consent given at Stripe checkout (checkout session id, source of the record, acceptance of the Terms, consent version, chosen plan, language, payment status and the request for immediate start of the service) and the history of your consents (marketing, analytics, AI notice) with where they were given, under a one-way hash of the account identifier, without e-mail or name. The checkout session id does let Stripe link the record to you. It serves to demonstrate consent and to defend claims (Art. 7(1) and Art. 17(3)(e) GDPR).
• Invoices in Stripe — deleting the customer in Stripe does not delete the invoices, which Stripe keeps under tax law.
• Providers with their own retention periods — the error reporting tool, Slack (internal notices; new account notices carry no e-mail address, older messages may), Resend (delivery logs), the sign-in provider (logs), notification services and AI providers, and PostHog events, whose deletion PostHog carries out with a delay. The rest disappears when their periods end.
• Store purchases — deleting the account removes our subscription record in RevenueCat but does not cancel an App Store or Google Play subscription. Cancel it in the store first. If you sign in with Apple, we do not revoke VODster's access in your Apple ID; you can remove it in your Apple ID settings.

We do not promise "zero trace". We promise to delete what we can delete and to tell you what remains.

Your rights

We answer requests without undue delay and at the latest within one month (Art. 12(3) GDPR). We may ask you to confirm your identity. Write to support@vodster.app or use the settings in the app.

• Access (Art. 15): a copy of your data and information about how it is processed.
• Rectification (Art. 16): you change data in the account settings or ask by e-mail.
• Erasure (Art. 17): you delete the account yourself, see Account deletion. You clear chat and search history under Profile, Privacy and data (this removes your assistant conversations, their sessions, mood history and search history; watched titles, ratings, the "Watch later" list and preferences stay).
• Restriction of processing (Art. 18).
• Portability (Art. 20): in the web app we are rolling out a data download (JSON and CSV for Letterboxd) gradually. Until you see it in your settings, and in the mobile app always, we send you a file with your data on request by e-mail. The export file does not include technical logs; you get a full copy under the right of access.
• Withdrawing consent (Art. 7(3)): at any time, see Consents.
• Complaint to the supervisory authority (Art. 77): the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

Objection

Age and children

VODster is for people aged 16 or over. We do not require a date of birth. When you create an account you confirm that you are at least 16. You may give your year of birth voluntarily, only to adapt the content filter to your age. We do not knowingly collect data of people under 16. If we learn that an account belongs to such a person we will delete it. A parent who believes their child created an account can write to support@vodster.app.

Security

We protect data with encrypted connections, access control at database level (each user sees only their own rows), limiting team access to the minimum needed, and monitoring. Our sign-in provider stores passwords as a hash. If a personal data breach creates a risk to your rights, we will notify you and the President of UODO as the GDPR requires (Art. 33 and 34).

Your ratings are private and other users cannot see them. Lists are private by default; you share them only if you decide to.

Content reports (DSA)

When someone reports content to us (for example a shared list) or appeals against our decision, we process the data of the person reporting and of the person the content concerns: contact details, the content of the report and of the decision. We do it to meet our duties under the Digital Services Act (Art. 6(1)(c) GDPR) and to defend claims (point (f)), for the period needed to handle the matter and any appeals. The reporting rules are on the Report content page. If we have a reasonable suspicion of a criminal offence threatening life or safety we pass the information to the competent authorities.

Changes to this policy

Every version has a number and a date. We tell you about a change on the website and, for significant changes, by e-mail; we do not require you to accept the policy again. If a change introduces a new purpose of processing, we will ask for consent where the law requires it. Previous versions and the change log are at the top of the page. We do not change the policy retroactively.

Questions about data: support@vodster.app.