Privacy Policy

Welcome to FlickTrove. Your privacy is critically important to us. This Privacy Policy outlines what data we collect, how it is handled, and your rights regarding your personal information.

1. Information We Collect

FlickTrove is designed as an offline-first personal library. We collect only the minimum amount of data necessary to provide and improve our services:

• Personal Library Data: Movie and TV show tracking lists, custom folders, watch time statistics, personal ratings, and comments. By default, this data is stored locally on your device using a Room database, but can be synced to the cloud.
• Anonymous Global Ratings: When you assign a rating to a movie or a TV show, your rating score is mathematically aggregated (averaged) with ratings from other users to generate a "Global FlickTrove Rating". This global rating is completely anonymous, public to all users, and cannot be traced back to your personal profile or identity.
• Authentication & Cloud Sync: If you choose to enable cloud synchronization, we use Firebase Authentication and Firebase Cloud Storage to securely store and sync your library across your devices.
• Anonymous Diagnostic & Crash Logs: We collect anonymized diagnostic data, stack traces, and crash breadcrumbs via Firebase Crashlytics and Google Analytics to identify software bugs and improve app stability without personally identifying you.
• Content Moderation, Security, & Reporting: Users can flag inappropriate comments or avatars via the in-app reporting feature. We collect the reported content ID, the reporter's user ID, and the reason for the report to review and moderate the community, ensuring a safe environment. We also use your account data (such as user ID) to enforce security measures and platform rules, which may include restricting or suspending (temporarily or permanently) your ability to post comments in case of violations of our Terms of Service.
• Voluntary Donations & Patron Verification ("Executive Producer"): If you choose to support FlickTrove voluntarily via Ko-fi or PayPal, transactional metadata (donor email address, public display name, transaction amount, payment provider, and timestamp) is securely stored in Firebase Firestore to verify your supporter status, unlock and maintain the "Executive Producer" achievement badge on your account, prevent fraudulent voucher reuse across multiple profiles (One-Time Claim Binding), and fulfill minimal accounting obligations. FlickTrove never collects, processes, or has access to your sensitive financial data (credit card numbers, CVV, or bank accounts), which are handled exclusively and securely by PayPal and Ko-fi.

2. Third-Party Services & APIs

FlickTrove integrates with third-party platforms to enrich your cinematic experience:

• Payment Processors (PayPal & Ko-fi): Voluntary contributions to the project are processed externally by PayPal (PayPal Inc.) and Ko-fi (Ko-fi Labs Ltd). These payment gateways operate as independent data controllers for billing and processing your payments in accordance with their respective privacy policies. FlickTrove only receives the transactional confirmation payload necessary to verify supporter badges and does not process financial payment details.
• TMDB, TheTVDB, OMDB, Trakt & SIMKL APIs: Movie, TV show, ratings, and actor details, including promotional images and posters, are dynamically fetched from The Movie Database (TMDB), TheTVDB, Open Movie Database (OMDB), Trakt.tv, and SIMKL.
• Trakt.tv & SIMKL Account Synchronization: If you choose to connect your Trakt or SIMKL account, FlickTrove securely authenticates via industry-standard OAuth 2.0 (including PKCE) to synchronize your watch history, personal ratings, watchlist, and custom lists/folders between your device and their cloud platforms. Please refer to the respective Privacy Policies of Trakt.tv and SIMKL for information on how your external account data is processed and stored.
• Google Firebase: Used for cloud infrastructure, database synchronization, authentication services, and crash diagnostics (Crashlytics & Analytics).
• Supabase: Used for serverless Edge Functions and storing user-uploaded custom avatars and images attached to comments. Images are stored securely and served via public URLs linked to your profile or comment. See the Supabase Privacy Policy for more details.
• Giphy API: Used to allow users to search and attach GIFs within comments. When searching for GIFs, search queries and your device's IP address may be exposed to Giphy's servers. Please review the Giphy Privacy Policy for further details.
• News RSS Providers (Everyeye.it, BadTaste.it, Collider.com & ScreenRant.com): When you open the News tab, the App connects directly to Everyeye.it and BadTaste.it (Italian) or Collider.com and ScreenRant.com (English) to retrieve public RSS feeds. Your device's IP address is exposed to these publishers during this request.
• Google ML Kit (On-Device AI Translation): Movie synopses can be translated locally using Google ML Kit. Translation is performed entirely on your physical device without sending text or reading preferences to cloud translation servers.
• CommsUni (commsuni.tv): The App integrates with CommsUni for federated community discussion, social movie and TV show comments, and public thread interactions. When publishing comments to the CommsUni network, your public profile identifier, nickname, avatar, and comment content are processed by the CommsUni decentralized network in accordance with its privacy standards and community guidelines. Content reported on CommsUni is moderated by the CommsUni network.
• Game-Icons.net (Attribution & Visual Assets): Achievement badge and trophy icons used throughout the App are provided by Game-Icons.net under the Creative Commons Attribution 3.0 (CC BY 3.0) license. These assets are bundled directly within the app and do not collect or transmit personal data.

3. Data Security & Retention

We implement industry-standard security practices to protect your data. All communication between the FlickTrove app and cloud servers (Firebase and TMDB) is encrypted in transit using SSL/TLS. Local database data remains on your physical device and can be wiped at any time by uninstalling the app or clearing app data.

4. Your Rights & Data Deletion

You maintain full ownership and control over your data. At any time, you can:

• Export or delete your local library directly from the app settings.
• Request complete deletion of your synced cloud account and associated data by contacting our support team or using the in-app account deletion option.

5. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be reflected on this page with an updated revision date. Continued use of the application implies acceptance of the revised policy.