Privacy Policy

1. What stays on your iPhone

All of this is stored in a single SQLite database on your device. It is never uploaded by us.

• Your TV library — the shows you follow, every episode, whether you watched it, when you watched it, how many times, your star rating for that episode, and whether you archived the show. Ratings are per episode.
• Your movies and documentaries watchlist — title, year, artwork and metadata, when you added it, when you watched it and your rating. Movies are local-only. They are never mirrored to our server and never appear in the feed or in comments.
• Your settings — whether episode notifications are on, and the optional TMDB key you chose to paste in. That key is stored in the app's local database as plain text (not the iOS Keychain), and is only ever sent to TMDB itself.
• Your home-screen widget snapshot — a tiny piece of text (show name, episode code, "aired N days ago", backlog count) shared with the widget through a private iOS app group. It stays on the device.
• Your episode alerts — "new episode is out" notifications are scheduled by iOS on your phone, from your local library. No server is involved in them at all.
• Your sign-in session — if you sign in, the login tokens are stored on the device so you stay signed in.
• Older leftover fields — the database and the backup file still contain a couple of unused columns left behind by features that were removed from the app. Nothing writes to them, they stay empty, and nothing in them is ever sent anywhere.

Backups. When you export a backup, the app writes a JSON file of your library into its own temporary folder and hands it to the normal iOS share sheet. Where it goes next — Files, iCloud Drive, Mail, another app — is your choice. We never upload it and never see it.

If you delete the app, everything above goes with it. That is also why moving to a new phone means exporting a backup yourself; we have no cloud restore.

2. What we store on our server, and only when you are signed in

If you sign in with Apple, the following is stored in our backend (hosted by Supabase). If you never sign in, none of it exists, and the app makes no request to our backend at all.

Two more things are sent to our server but not stored anywhere:

• Contact hashes, when you use "Find friends from contacts" (section 4).
• A list of up to 100 show IDs you follow, used to work out "other people who watch this also watch…" recommendations. The server answers with anonymous watcher counts and keeps nothing. This lookup only runs when you are signed in; signed out, the app checks first and never sends it.

GIF searches. When you use the GIF picker, the text you type goes to our server, which asks GIPHY for the results and passes them back. Our server keeps that text and the results in a shared cache table, so the same search does not have to be fetched again — six hours for a search, one hour for the default feed you see before you type anything. A cache row is keyed by the search text alone. No user id, no device id and no IP address is stored alongside it, so we do not build a record of who searched for what. Once the window is up, the next person who types that text refreshes the row.

IP addresses. Any request to our backend, like any request on the internet, reveals your device's IP address to the server handling it. We do not log it into a database or use it to profile you, but we cannot claim our hosting provider keeps no record of it.

3. Sign in with Apple

Sign in with Apple is the only way to create an account. There is no password, no Google login and no email sign-up. Before you sign in, the app shows a line under the Apple button confirming that signing in means you accept the Terms of Use and this Privacy Policy. Both are also linked from Settings → Legal at any time.

When you sign in, we ask Apple for your name and email. Apple gives us a signed token containing your Apple user identifier and your email address. If you chose Hide My Email, the address we receive is an Apple relay alias, not your real one — that is fine, and it is all we ever see.

Your name is handled slightly differently. Apple only releases it on the very first authorisation, and only if you agree to share it. If it comes through, the app saves it as your public display name. If you decline, or if that one moment fails (say you were offline), we simply never have your name — Apple will not send it again.

We never receive your Apple password, and we cannot use your Apple ID for anything other than identifying your account here.

4. Finding friends through your contacts

This is optional and only happens when you tap "From contacts" on the Find friends screen. iOS will ask your permission first.

Here is exactly what happens:

1. The app reads only the email addresses in your address book. It does not read phone numbers, names, photos or notes. Phone numbers are not touched at all.
2. Each address is tidied up and turned into a SHA-256 hash on your phone.
3. Only the hashes are sent to us. The raw addresses are never written to disk, never stored and never transmitted.
4. Our server compares those hashes against the hashes of our own users' emails and returns the matches. That lookup only reads — it does not save what you sent into any of our tables.

Two honest caveats:

• A hash is not the same as anonymity. An unsalted hash of an email address is a fixed fingerprint. Whoever runs a backend can, in principle, test a guessed address against a hash and confirm a match. We do not do this, and we do not save your submitted hashes in our database — but we cannot rule out that the hosting platform's own request logs briefly record them, so we will not claim they vanish completely.
• If you used Apple's Hide My Email, we hold the hash of your relay alias, not your real address — so a friend who has your real email in their contacts will not find you. Pick a username and share that instead, or use the invite link or QR code.

If you are in someone's address book and you do not use TV App. When one of our users runs this search, hashes derived from other people's email addresses — possibly including yours — pass through our server for the length of one query. Our lawful basis for this is our legitimate interest in letting people find friends they already know, balanced against the narrowness of what happens: the address is hashed on your contact's device, we never see it in readable form, we never store it, and no record of you is created. You can object to this at any time by writing to info@montyinc.net and we will act on it.

5. Who can see what

The rules differ by feature, and it is easy to assume they are the same. They are not.

• Public to any signed-in user: your username, your display name, who you follow and who follows you, your comments, and your comment upvotes. Usernames can also be found by searching, including partial matches.
• Visible only to you and people who follow you: your watch history, your episode ratings, your activity feed events, your character votes.
• Anonymous to everyone: community episode ratings, "also watched" recommendation counts and the character-vote leaderboard are computed as totals. Nobody sees whose rows produced them.
• Public to the entire internet: photos you attach to comments. They are stored in a public bucket, so anyone who has the link can open the image without an account, and the link itself contains your account identifier. Please do not attach anything you would not put on a public web page. GIFs you attach are not hosted by us at all — they stay on GIPHY's servers and we only store the link.
• Never shared with anyone: everything in section 1 that stays on your phone.

There are no uploaded profile photos or avatar images — you cannot add one, and there is nowhere to put one. Where the app shows a person, it draws a coloured circle with the first letter of their name in it, generated on the spot from that name. There are no direct messages.

6. Comment filtering and moderation

Comments are screened before they are posted, not only after someone complains.

• On-device screening. Every comment is checked on your phone before it is sent, and exactly four things cause it to be refused: the comment is empty, it is longer than 2,000 characters, it matches the blocked-terms list, or it contains more than two distinct links. Nothing else is rejected — ordinary swearing is fine, sexual language in a TV context ("the sex scene", "full frontal") is fine, and a long run of a repeated character is simply trimmed before the check rather than treated as spam. The check tolerates the usual ways people disguise a word (leetspeak, spacing, homoglyphs). A refused comment never leaves your device, so we never receive it and never log it.
• What is on the blocked-terms list. Three groups, and nothing more: unambiguous hate slurs, child-exploitation terms, and porn-spam phrases (things like "free porn", "sex cam", "gang bang" or the name of a porn site). We are listing the third group because it is easy to trip it without meaning to, and the refusal message does not say which rule you hit.
• Length limit. Comments are capped at 2,000 characters.
• Rate limit. You can post at most 5 comments per minute. This exists to stop flooding, not to watch you; the counter lives on your device and is thrown away when you sign out.
• Report and block. Any comment or user can be reported, and any user can be blocked, from inside the app. Blocking hides that person's content from you and severs the follow in both directions.
• What we do about reports. We review reports within 24 hours, remove content that breaks the rules, and remove users who post it. If we act on something you posted, you can appeal by writing to info@montyinc.net.

The screening is a fixed rule check on the text of one comment. It does not profile you, it does not score you, and it does not feed anything else. See section 10 on automated decisions.

7. Other services the app talks to

TV App is not a closed box. To show artwork and air dates it has to fetch them from somewhere. Each of these services sees your device's IP address, as any website you visit would. GIF search is the one exception: it goes through our server, so GIPHY sees us and not you — see the GIPHY row below.

Artwork is fetched again every time it is shown. Posters, backdrops and episode stills are never copied into your library — only their web addresses are. So each time a poster or still appears on screen, your device asks TVmaze's or Apple's image servers for it again (the app keeps a local image cache, which cuts down but does not remove these requests). That happens for shows and movies you added long ago, and it happens whether or not you are signed in.

We are not paid by any of these services, and none of them is an advertising or analytics provider. Each has its own privacy policy governing what it does with the requests it receives.

8. Notifications

There are two completely different kinds, and one thing about them may surprise you.

Episode alerts (local). When you turn on "Episode notifications" in Settings, the app schedules alerts directly on your iPhone from your own library — roughly the next 60 upcoming episodes, rebuilt each time the app opens or refreshes in the background. No server sees these and no data leaves your phone.

Social pushes (from our server). New follower, someone liked your comment, someone replied on an episode you commented on. These go through Apple and the Expo push service and contain the other person's name and the show name.

The thing to know: the app never asks separately for permission to send social pushes. If you have already allowed notifications for episode alerts, and you are signed in, it quietly registers for social pushes on the strength of that same permission. If you do not want them, turn TV App's notifications off in iOS Settings, or sign out. We are telling you this because the app's own wording does not make it obvious.

9. What we do not do

The following is not marketing language — it reflects what is and is not in the app's code:

• No analytics. No Google Analytics, Firebase, Amplitude, Mixpanel, Segment, PostHog or anything like them.
• No advertising. No ad networks, no IDFA, no App Tracking Transparency prompt, because there is nothing to track you with.
• No crash or performance reporting. No Sentry, Crashlytics, Bugsnag or Datadog.
• No tracking across apps or websites. None of your data is combined with data from other companies for advertising or measurement.
• No selling or renting your data. We do not sell personal information and do not share it for cross-context behavioural advertising, in the sense those terms are used under California law or comparable laws elsewhere.
• No location. The app never asks for it and contains no location code.
• No camera and no microphone. The app uses neither, and asks for neither.
• No phone numbers. We never read, hash, send or store a phone number — yours or anyone else's.
• No purchases. No in-app purchases, subscriptions or payment processing, so no payment data of any kind.
• No search history, with one exception. Your searches are passed to TVmaze, iTunes, our profile search or the GIF proxy only to answer that search. Show, movie and profile searches are not stored on your phone or on our server. GIF search text is cached on our server by the text alone, with nothing attached that says who typed it — see section 2.
• No writing to your photo library. The app can read a photo you explicitly pick for a comment. That is all.

10. Why we are allowed to hold this

If you are in the UK or the EEA, our legal bases are simple:

• To provide what you asked for (contract): your account, profile, follows, feed, comments and mirrored watch history exist because you chose to use the social features.
• Your consent: reading your contacts, and sending you notifications. You can withdraw either at any time in iOS Settings.
• Our legitimate interests in keeping the app safe and usable: comment screening, rate limiting, reports and blocks, and the friend-matching lookup described in section 4.

Where your data goes. Our backend is operated by Supabase Inc. as our processor, in the region EU North (Stockholm). Push delivery runs through Expo and Apple. If your data leaves the UK or the EEA, the transfer relies on an adequacy decision where one covers the destination, and otherwise on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, in each case with our processors.

No automated decisions about you. We do not carry out profiling, and we make no automated decision that produces a legal effect for you or similarly significantly affects you. The comment screening in section 6 is a fixed rule check on a single piece of text; if it blocks something you believe is fine, write to info@montyinc.net and a person will look at it.

11. Security, plainly stated

Traffic to our backend and to the services above goes over HTTPS. Server data is protected by row-level rules that stop one user reading another user's private rows, and the key shipped inside the app is a restricted public key, not an administrative one.

Two things we would rather you heard from us:

• Comment photos are deliberately public (section 5).
• The optional TMDB key is stored in the app's local database in plain text, protected by your device's own encryption and passcode rather than the iOS Keychain. It is your own free API key, not a credential to anything sensitive, but treat it accordingly.

No system is perfectly secure, and we will not pretend otherwise.

12. Your choices and your rights

• Use the app without an account. Everything except the social features works signed out.
• Get a copy of your data (and take it elsewhere). Export a backup from Settings at any time — that JSON file is your portability copy, and it is machine-readable and yours to move to another service. For the server-side copy, email info@montyinc.net.
• Correct things you can change yourself. You can edit any watch date, change or clear an episode rating, and delete your own comments.
• Username and display name — read this one carefully. You choose your username once; after you have set it, the editor disappears and you cannot change it in the app. Your display name is written once from the name Apple gives us at first sign-in, and there is no editor for it at all. To change or clear either, email info@montyinc.net and we will do it for you. We are stating this plainly because an earlier version of this page implied you could edit both yourself.
• Remove things one at a time. Un-watching an episode deletes the server record and the matching feed entry. Clearing a rating deletes the "rated" entry. Unfollowing a show wipes every server watch record and feed entry for that show. Deleting a comment deletes its uploaded photo too.
• Turn things off. Revoke contacts or notification access in iOS Settings whenever you like.
• Sign out. This ends the session on your phone only. It does not delete anything from the server.
• Delete your account — see section 14.
• Object, restrict or complain. Depending on where you live you may have further rights, including complaining to your local data protection authority. Write to info@montyinc.net and we will help.

How to ask, and how long we take. Send any of these requests to info@montyinc.net. We answer within 30 days (one month). If a request is unusually complex we may extend that by up to two further months, and we will tell you why within the first month.

How we check it is you. We do not ask for identity documents. Instead, write from the email address linked to your account, or tell us your @username and we will reply to the account email to confirm. If we cannot reasonably verify that a request is yours, we will say so rather than act on it — that protects your account from someone else.

We will not treat you differently for exercising any of these rights.

13. If you are in California

This section is for California residents under the CCPA as amended by the CPRA. It describes the same practices as the rest of this page, in the categories that law uses.

What we collect, where it comes from, and why:

We do not collect: geolocation, biometric information, financial or payment information, commercial or purchase records, professional or education information, or inferences drawn to create a profile. We do not collect or use sensitive personal information, so there is nothing for you to limit.

Who we disclose to. We disclose personal information only to service providers who process it for us under contract, and only for the business purposes above: Supabase (all server-side data), Expo and Apple (push token and notification text), and Apple (sign-in). We do not disclose personal information to anyone for their own purposes.

No sale, no sharing. We have not sold or shared personal information, including the personal information of consumers under 16 years of age, in the preceding 12 months. We have no plans to do so. Because there is nothing to opt out of, we do not operate a "Do Not Sell or Share My Personal Information" link.

Your rights. You have the right to know what we collect and to obtain a copy of it, the right to delete it, the right to correct inaccurate information, the right to opt out of sale or sharing (not applicable, as above), the right to limit the use of sensitive personal information (not applicable, as above), and the right not to be discriminated against for exercising any of them. We honour all of these.

How to exercise them. Email info@montyinc.net. We respond within 30 days and verify you the same way as in section 12. An authorised agent may act for you if they provide your signed written permission; we will still verify your identity directly and confirm you authorised the request.

14. Deleting your account

In the app: Settings → Account → Delete account. You will be asked to confirm twice.

What is deleted immediately, and permanently:

• Your account and login
• Your profile — username, display name
• Your stored email hash
• Every follow, in both directions
• Your entire mirrored watch history and every activity feed entry
• All of your comments, and all comments' upvotes involving you
• Every photo you uploaded to a comment
• Your character votes
• Your push token
• Your blocks, in both directions
• Reports you filed, and reports filed about you

There is no soft delete, no grace period and no archived copy on our side.

What is not deleted:

• Your on-device library stays. Your shows, episodes, watch dates, ratings and movies remain on your phone, exactly as they were. The app tells you this before you confirm. To remove them too, delete the app.
• Any backup file you exported to Files, iCloud Drive, email or elsewhere. That copy is yours to manage.
• GIFs in comments were always hosted by GIPHY, not by us. The comment disappears; GIPHY's copy of the GIF was never ours. Cached GIF search results are not part of your account either — they are keyed by the search text, not by you (section 2).
• Whatever our hosting provider retains in its own operational logs, which we do not control.

One consequence we should state openly: because reports about a user are deleted along with their account, deleting an account also erases the moderation history attached to it.

15. How long we keep things

There is no automatic expiry. We do not run any scheduled job that deletes, ages out or purges data. Whatever you have shared stays until you remove it or delete your account. The one exception is push tokens: if Apple tells us a device no longer accepts notifications, that token is removed automatically.

We would rather say this plainly than invent a retention period we do not actually enforce.

16. Children

TV App is rated 12+ and is not directed at children. It contains user-written comments, user-uploaded photos and GIF search, and it can request access to your contacts.

We do not ask for your date of birth and we have no age verification. We do not knowingly collect data from children under the age required in their country (13 in the US, up to 16 elsewhere). If you believe a child has created an account, email info@montyinc.net and we will delete it.

17. How this maps to Apple's App Privacy labels

These are the same categories declared in the app's privacy manifest.

Data linked to you (only when signed in, all for App Functionality):

Data not linked to you:

Used to track you: nothing. There is no tracking of any kind in this app.

Not collected at all: Location · Phone Number · Health & Fitness · Financial Info · Payment Info · Purchases · Browsing History · Usage Data (product interaction and advertising data) · Diagnostics · Sensitive Info.

18. Changes to this policy

If we change how the app handles your data, we will update this page and change the effective date at the top. For anything significant — a new category of data, a new third party, a real change in who can see what — we will tell you in the app before it takes effect, or as soon as we reasonably can.

19. Who we are, and how to reach us

Monty Inc is the data controller for everything described on this page.

Monty Inc
Rue de Suisse 25, 1060 Saint-Gilles, Brussels, Belgium
Email: info@montyinc.net
Web: https://tvapp.montyinc.net

EU and UK representative. If and where Article 27 of the UK/EU GDPR requires us to appoint a representative in the EEA or the UK, we will name them here with their contact details before offering the app in those markets. Until that appointment is published, write to info@montyinc.net and your request will be handled by us directly on the same terms and within the same 30 days.

Governing law. Belgium. This does not limit any right you have under the law of the country where you live, including your right to complain to your local data protection authority.

Questions, requests, or something here that does not match what you are seeing in the app: we read every message. If you are asking us to access, correct or delete data, please write from the email address linked to your account, or tell us your @username, so we can find the right account.