Privacy Policy

Last updated: 2026-03-13

Who We Are

Movey is operated by Fettsoft, Stockholm, Sweden. For privacy inquiries, contact us at [email protected].

Data We Collect

Account data

When you sign up, we collect your email address. If you sign in with Google, we also receive your email address from Google for account matching.

Usage data

Search queries, watchlist and rating activity, page views, and interactions within the app. This helps us improve recommendations and the product experience.

Technical data

IP address, browser type, operating system, device type, and session identifiers. Collected automatically when you use the service.

An email address is required to create an account. Without it, you cannot use the service. All other data is collected as part of normal service operation.

How We Use Your Data

  • Provide and maintain your account and the core service (search, recommendations, library)
  • Improve the product through aggregated usage analytics
  • Monitor and fix errors and performance issues
  • Send transactional emails (magic link sign-in)

Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6):

  • Contract (Art. 6(1)(b)) — account creation, authentication, and core features you use the service for
  • Legitimate interest (Art. 6(1)(f)) — error monitoring, performance analytics, and service improvement. You have the right to object to this processing at any time by contacting [email protected]. We will cease processing unless we can demonstrate compelling legitimate grounds.

Third-Party Services

We share personal data with the following third parties:

Independent controllers

These services process your data under their own privacy policies:

  • Google (US) — identity provider for Google sign-in

Data processors

These services process data on our behalf, under our instructions:

  • Supabase (EU) — authentication, database, and user data storage
  • Cloudflare (US) — content delivery, DDoS protection, and DNS (all traffic is routed through Cloudflare)
  • Railway (US) — application hosting and infrastructure
  • PostHog (EU) — product analytics (IP address, user ID, usage events)
  • Langfuse (EU) — AI quality monitoring (IP address, user ID)
  • Sentry (US) — error monitoring (IP address, user ID, device info)
  • TMDb (US) — movie and TV metadata provider (search queries, region preference)
  • Google Vertex AI (US) — AI language model for search and recommendations (search queries and an anonymous user identifier for caching)
  • OpenAI (US) — AI language model for search and recommendations (search queries and an anonymous user identifier for caching)

International Data Transfers

Most of our data processors are based in the EU. For US-based services (Google, Cloudflare, Railway, Sentry, TMDb, Google Vertex AI, OpenAI), transfers are protected by the EU-U.S. Data Privacy Framework and, where applicable, standard EU-approved data transfer agreements (Standard Contractual Clauses).

Data Retention

Account data is retained while your account is active. If you delete your account, your personal data is removed from our systems within 30 days. Analytics and error monitoring data is retained for up to 12 months, after which it is automatically purged.

Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your data in a portable format
  • Restrict the processing of your data in certain circumstances
  • Object to processing based on legitimate interest
  • Lodge a complaint with a supervisory authority

To exercise any of these rights, email [email protected].

Account Deletion

To delete your account, email [email protected]. Deletion removes your profile, watchlist, ratings, and reviews. Data held by third-party processors (analytics, error logs) is purged according to their retention schedules. If you signed in with Google, all Google-sourced data is deleted. You can also revoke Movey’s access at myaccount.google.com/permissions.

Children's Privacy

Movey is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

AI & Automated Processing

Movey uses AI language models to power search and recommendations. Your search queries are sent to third-party AI providers for processing. An anonymous user identifier is included for caching purposes — this cannot be used to identify you personally.

Cookies & Local Storage

The web app (app.movey.tv) uses browser local storage for authentication and session management — no cookies. The landing page (movey.tv) uses analytics cookies from PostHog to understand how visitors interact with the site. You can block non-essential cookies through your browser settings without affecting core functionality.

No Advertising, No Data Sales

We do not serve ads. We do not sell, rent, or share your personal data with advertisers, data brokers, or any third parties for marketing purposes.

Google API Services

Movey's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request your email address for authentication. Google data is stored in our authentication database (Supabase, hosted in the EU) and retained for the duration of your account. Specifically, Movey’s use of Google user data is limited to the following practices:

  • We only use Google user data to provide or improve user-facing features that are prominent in Movey’s interface
  • We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, for security purposes, or to comply with applicable law
  • We do not use or transfer Google user data for serving advertisements, retargeting, interest-based advertising, or determining credit-worthiness
  • We do not allow humans to read Google user data unless you have given affirmative consent, it is necessary for security purposes, it is required by law, or the data has been aggregated and anonymized for internal operations

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app or by email. The "Last updated" date at the top reflects the most recent revision.

Contact & Complaints

For privacy questions or to exercise your rights, contact [email protected].

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY): imy.se, Box 8114, 104 20 Stockholm.