Privacy policy

Information used to provide whist

• Account: your username, a protected password hash, account timestamps and sign-in credentials used to keep you signed in. If you provide a recovery email, we store the address and verification status.
• Saved content: the actors, films and shows you save, and your lists, descriptions, ordering and list membership.
• Feedback: the report text, any screenshot you choose to attach, and app/device diagnostics if you opt to include them. Reports are not linked to your account, but anything you type or attach may identify you.
• Support: your email address and the content of messages you send us, used to respond and handle your request.
• Account email: when verification or password-reset delivery is enabled, outgoing messages temporarily include your email address and a verification or reset link. Our service stores the queued message encrypted until it is processed or removed.
• Service operation: network requests and technical logs needed to serve requests, diagnose failures and limit abuse. Hosting infrastructure receives connection information such as your IP address.

Search terms are sent to our service and to The Movie Database (TMDB) to retrieve results. whist does not synchronize your recent-search list to your account on the server.

Information on your device

The app keeps recent destinations and layout preferences locally, caches catalog information and artwork, and stores a sign-in credential in the iOS Keychain. These support navigation, performance and sign-in. Removing the app can clear local history; saved account content remains until you remove it or delete the account.

Browser sign-in uses cookies for your session and request security. These pages do not include advertising or analytics scripts.

Services involved

Render hosts whist's API and database in the United States. TMDB supplies catalog information; artwork is downloaded directly from its image service, which receives the device's network request. Apple provides TestFlight distribution and its beta-testing diagnostics and feedback facilities.

Google Gmail handles messages you send to our support address and our replies, including their attachments. Contacting support does not subscribe you to marketing messages.

Optional diagnostics attached through whist's feedback form are separate from information handled by Apple's TestFlight service.

whist does not include advertising or cross-app tracking SDKs.

Gmail authorization for account email

whist recovery sender is our account-email service. The operator authorizes it to send email from the support mailbox using Google's Gmail API. It requests send-only permission, not permission to read or search the inbox. People using whist do not connect their Gmail accounts to this service.

When account email is enabled, Google receives the recipient address and message contents to deliver verification, password-reset and password-change messages. These messages are for account access and security, not marketing. Copies held by Google and recipients follow their respective retention settings.

We retain the operator's authorization credential in protected storage so the service can send these messages without repeated sign-in. The operator can revoke that access in their Google Account; sending then stops until authorization is restored. We remove stored sender credentials when the connection is retired. Credentials are not included in the iPhone app.

We use this Google authorization only for the account-email functions described here. We do not sell Google user data or use it for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Retention

Account and saved content: We keep your account and saved content while your account exists. Deleting your account removes that information from the active database and invalidates sign-in credentials. Deleted information may remain in historical backups until those backups expire.

Support email: Our retention policy is to keep conversations while handling your request, then for 90 days after closure. Removal is managed by the operator during weekly cleanup, within seven additional days, including retained attachments and copies in Sent and Trash. Reopened requests remain active. This policy does not control Google's internal backup retention.

Feedback: Our retention policy is 90 days after a report is marked Closed or Resolved, including its text, screenshot, diagnostics and triage notes. Closing a report does not itself erase it; removal depends on maintenance. Open reports remain while needed to handle the issue. We review unresolved support and feedback monthly to decide what is still needed.

Sign-in and account email: Expired credentials stop granting access, but some stored session records remain until maintenance removes them. When account email is enabled, queued messages and links are encrypted. Processing removes completed, invalid, expired or exhausted queued messages; account deletion also removes that account's queued mail. An outage can delay processing and removal. Copies already delivered to Google or a recipient follow that service's retention settings.

Hosting records and backups: Render's current Hobby plan retains service logs for seven days and provides a three-day recovery window for our paid database. Logical backup exports, if created, are retained by Render for seven days. These periods do not cover every provider-internal security record or copies separately downloaded by the operator. Deleting an account does not immediately erase historical backups.

Device data: Recent searches and layout preferences stay on your device. You can clear recent searches in the app. Catalog and artwork caches expire independently of your account; removing the app can clear local history. Deleting the app does not delete your account.

Your choices and deletion

You can browse without an account, remove saved content, clear recent searches, and choose whether to attach screenshots or diagnostics to feedback.

To delete your account, open Account → Delete account in the app and confirm with your current password. Account deletion removes your account, saved content, lists and recovery records from the active database and invalidates sign-in credentials. Other devices may retain local information until they reconnect and detect that the account is unavailable.

Feedback reports are stored separately and cannot automatically be identified from your account. Contact us to request removal of identifiable report content; include its receipt if available. Historical backups and operational records follow the retention periods above rather than immediate backup erasure.

For access, correction or deletion requests, or if you cannot sign in, email us. We may ask for information to verify your request. Never send passwords or reset links. See Support for help.