Privacy policy

What this policy covers

This policy describes information handled by Cinema Scout, developed by Akshob Ram Kumar. Features can differ by platform and build. Cinema Scout does not include advertising, an app analytics SDK or cross-app advertising tracking. Apple’s TestFlight diagnostics are separate, as explained below.

Accounts and private community profiles

Supabase provides authentication. Email sign-in sends a one-time code through Brevo; the recipient address, sign-in message and delivery information are processed for that request. Requesting a code does not subscribe you to marketing or give Cinema Scout access to your inbox.

Where Sign in with Apple is available, Apple supplies a provider identifier and the email or relay address you choose to share. The app does not receive your Apple password. An Apple relay address and a different email address do not automatically merge separate accounts.

If you save a community profile, its display name, handle, bio, colour and optional profile photo are stored with your account. Saving a profile is private and does not publish a contribution. A selected profile photo is resized and re-encoded as a small JPEG, removing embedded image metadata. Selecting or previewing it alone does not upload it; choosing Save stores it privately with your profile, independently of booking sync. To remove it from that private profile, choose Remove photo and save. Saving a profile does not turn on booking sync. Do not place admission codes or passwords in profile text.

Public community and moderation

In builds with connected public Community, approved posts and replies can be read without an account. Posting requires your Cinema Scout account, a saved profile and explicit acceptance of the community rules. Earlier beta builds may still show a local preview.

Submitting uploads the contribution and a snapshot of your display name, handle and optional profile photo after you separately choose to share them. A contribution may include its cinema or film, country, title, text, rating, tags and one chosen post photo. Its author identifier, content identifier, status, revision and submission times are also stored. Your profile bio, sign-in email, bookings and private notes are not copied into the public author snapshot.

New and edited contributions wait for review. Approved content, its chosen photo and public author details are visible to anyone, including readers without an account. Pending or rejected contributions are available to their author and authorised moderators. Moderators can review submitted text and photos, approve or reject them, and remove reported content. Publication does not verify the author’s claims or cinema details.

A post photo is resized and re-encoded before upload, with embedded image metadata removed. A local draft and its photo stay on the device until you submit. Do not include admission codes, booking references or information about someone else without permission. Updating your private profile or removing its photo does not automatically replace snapshots attached to existing contributions; edit or delete those contributions separately.

Reports store the reporting account, target contribution, reason, optional details and review outcome. They are not public or shown to the reported author. Block choices are stored with your account and used to hide content; they are not a guarantee that public material cannot be read by someone using guest browsing. Usage counters, accepted rules version, submission retry records, restrictions and moderation decisions help operate the service and prevent abuse.

You can edit or delete your own contributions. Edits return to review; deleting a post removes its live photo and reply thread. Account deletion removes your authored contributions and associated account records from the live database. These actions cannot erase screenshots or other copies already saved by readers. Provider backups, operational logs and support messages follow the separate retention explanation below.

Private sync is a separate choice

Choosing Enable private sync uploads saved booking details, watchlist and personal theatre ratings/notes, then retrieves them on other signed-in devices where sync is enabled. Booking metadata can include film, cinema, hall, format, seats, showtime, time zone, expiry, venue address/map coordinates and artwork or item references.

The defined original barcode/QR-code fields, booking-reference field, selected images and pass archives are excluded. Free-text notes contain what you type, so information copied into a note will be synced with that note.

Normal client access is restricted to the signed-in account. This is private cloud storage, not end-to-end encryption: the hosting service and authorised operator administration can process stored account data. Requests use HTTPS.

Pausing sync or signing out stops that device’s syncing and keeps its local library. It does not delete existing cloud data or another device’s copies. Removing a synced item sends a deletion change when sync runs; some conflicting changes require your choice.

Booking files, mail and calendar imports

Selected images, files, copied text, email files, calendar files and PDFs are read locally to suggest booking fields or detect an original ticket code. Parsing does not upload the original content, load remote email images or follow email links. Review the details and confirm the showtime/time zone before saving. Saved fields can later enter private sync if you enable it.

Optional iCloud Mail connection

This is separate from Cinema Scout account sign-in. An Apple app-specific password is saved in this device’s non-synchronising Keychain, available while unlocked, and used directly with Apple’s iCloud IMAP service over system-validated TLS. It is not sent to Cinema Scout’s backend, Supabase or Brevo.

Each foreground search covers a received-date range of at most 90 days and lists up to 40 matching Inbox headers. Only the email you select is downloaded for local booking review, within size/time limits. Results stay in memory; only details you review and save become bookings.

App-specific passwords are not inherently read-only credentials. Cinema Scout uses read-only mail commands: it does not send mail, mark messages as read, move or delete messages, or monitor your Inbox in the background. Disconnect in the app to remove its saved credential; you can also revoke the app-specific password with Apple. Each device connects separately.

Direct Gmail and Outlook inbox connections are not available. Files and pasted booking emails from those providers can still be imported. No forwarding service or automatic background booking detection is connected.

Optional calendar access

Calendar permission is requested only when you choose to load a date range. Apple’s permission includes read/write access; Cinema Scout uses reading APIs only. It can read event titles, locations, notes, calendar names, dates and time zones in that range, showing up to 500 events. Choose one to review. It does not edit calendars or upload the original events.

Wallet, Watch and other services

Wallet pass files are built locally. The signer receives only fixed filenames and hashes, then returns a signature; the signing request does not contain the pass files, film/seat text, booking reference, code or images. Random values vary the hashes for each creation, but this is not an anonymity guarantee. The signing code does not persist manifests or log request payloads; the host may process connection/security metadata.

You confirm adding a pass in Apple’s Wallet flow. Exporting or sharing a ticket/pass can include its original code and booking reference. Wallet copies and their syncing follow Apple’s settings. Keep the cinema’s original confirmation for admission.

If installed, the paired Watch companion receives a local summary through Apple WatchConnectivity: film, cinema, hall, seats, format, showtime, time zone and generated record/source identifiers. It does not receive the original ticket code, booking reference, image or pass archive. Updates and removals depend on paired-device delivery. Widgets and Live Activities may display booking details on your Home/Lock Screen or Dynamic Island according to your device settings.

Optional nearby-cinema search makes a one-time location request, calculates distances locally and uses Apple geocoding to identify the area. It does not keep a location history or track location in the background. Cinema listings, posters, maps and external booking links contact the service you choose; request metadata can reveal the selected film, cinema, country/date or destination.

Retention and account deletion

Live account and profile records remain until you change them or complete account deletion. Synced records remain until the corresponding changes/deletion are applied. Local copies stay until removed on that device or its app data is erased; device, cloud and computer backups follow your settings.

Sync retains deleted-item records and retry/conflict information to keep devices consistent. Retry receipts can contain earlier synced content. They become eligible for cleanup after 30 days and are removed when the account later submits sync changes, rather than by a guaranteed background timer.

Confirmed deletion removes the account’s current database records, private profile, synced items, sync retry receipts and authored public-community contributions. Deleting an authored post also removes its live reply thread. It keeps local bookings/notes and does not cancel cinema tickets, remove Wallet passes, erase other devices’ local copies or delete support emails already sent.

Hosting/security logs, email-delivery records, provider backups and support correspondence have separate retention settings and processes. Deleting a live record does not mean immediate removal from all logs or backups. Support correspondence is used to answer and follow up on the request; contact us about access or removal, or if you have a question about a particular record’s retention.

Your choices and privacy requests

• Browse as a guest, leave booking sync off, or pause it from Account & sync.
• Edit your private profile or delete the Cinema Scout account from its account controls.
• Choose separately whether to submit public content; edit/delete your contributions, report a problem or manage blocked accounts in Community.
• Disconnect iCloud Mail, revoke its app-specific password with Apple, or decline optional Calendar, Photos and location access.
• Contact us to ask about your account information, corrections, access or deletion. We may ask you to verify ownership; never send a password, sign-in code or app-specific password.

Email you choose to send to support includes your sender address, message and selected attachments. App/OS version information is optional; the in-app support flow does not automatically attach tickets, admission codes or a device identifier.

Contact Akshob Ram Kumar, Cinema Scout: akkshobramkumar@outlook.com.

Providers and beta testing

Supabase handles account/database services, Brevo sign-in email delivery, Cloudflare pass signing, and Apple the system features described above. They may process operational metadata such as IP addresses, request times and delivery/security information. Processing and backup locations depend on the providers and their service settings; services may operate in more than one country. Cinema Scout does not sell your information or use it for cross-app advertising tracking.

For a TestFlight build, Apple automatically collects beta crash/usage information and shares it with the developer. Feedback you submit is also shared. Apple says names/emails are not shown to the developer for testers joining only through a public link. See Apple’s TestFlight privacy information.

Further provider information: Supabase, Brevo and Cloudflare. These resources do not replace this explanation of Cinema Scout’s own practices.

We update this policy when the app’s handling of information changes. The date above identifies the latest revision.