EN
Privacy Policy
Last updated: 7 September 2026
This policy explains what CineFR collects, why, and what you can do about it. It is written to satisfy both the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK, No. 6698). Wherever the two differ, we apply the stronger protection to everyone.
DATA CONTROLLER
Egemen Benli — Türkiye
support@cinefr.com (reachable without an account)
WHAT WE COLLECT
Account: your name, email address and the identifier from the provider you signed in with (Google, Apple or email/password). If you register with an email address, whether it has been confirmed.
What you create: titles you mark as watched or save to lists, ratings, reviews, private notes, friends, one-to-one chat messages, shared lists and their messages, badge progress, and the reports and blocks you submit.
Preferences: theme, interface language, region and currency, and whether push notifications are on.
Push tokens: if you enable notifications, the device token needed to deliver them. Turning notifications off removes it.
Country: your country — and only your country, never a precise location — determined at the network edge by Cloudflare when you sign in. It is stored separately from your profile and is readable only by the administrator. It is used for aggregate statistics.
Activity days: the calendar days on which you used the app, and page-view counts. Used for usage statistics and to decide when to ask you to rate the app.
Feedback: if you send us feedback from inside the app, we store your message together with your name and your account identifier, so that we can understand it and follow it up. It is read only by the administrator.
Analytics: Firebase Analytics (Google) records which screens you open, which actions you take, the terms you search for, your device and operating system, and an approximate country-level location. Analytics is disabled entirely in development builds.
Crash reports: if the app closes unexpectedly, Firebase Crashlytics (Google) records the technical details of the failure — the error and the point in the code it came from, your device model, your operating system and app version, and the identifier of your account if you were signed in. Nothing you wrote or saved is included. Crash reporting follows the same choice as analytics: where consent is required it does not start until you give it, and it is disabled entirely in development builds.
WHY, AND ON WHAT LEGAL BASIS
- Creating your account, signing you in, and providing the core features — performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)
- Security, abuse prevention, moderation and enforcing our Terms — legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)
- Usage statistics, diagnosing crashes and improving the product — legitimate interests; you may object at any time (GDPR Art. 21)
- Push notifications — your consent, given through the permission prompt on your device, withdrawable at any time in Settings
- Translation — performed only when you ask for it (see below)
TRANSLATION
Reviews and biographies can be translated on demand. Translation never happens automatically: it runs only when you tap the Translate button. When you do, that text is sent to Google Cloud Translation through our own server and the result is cached so the same text is not sent twice. Nothing else about you is sent with it.
SEARCH AND TRAILERS
Search terms and title requests go to TMDB. Trailers play in an embedded YouTube player, which is operated by Google and sets its own cookies. These services process that data under their own privacy policies.
WHERE YOUR DATA IS
Firebase Authentication and Firestore run on Google LLC infrastructure and your data may be processed on servers in the United States. Cloudflare processes requests to cinefr.com at edge locations worldwide. Google applies Standard Contractual Clauses to safeguard these transfers. Under KVKK Art. 9 the transfer relies on the explicit consent you give by using the app together with those safeguards.
HOW LONG WE KEEP IT
- Account and usage data: while your account exists.
- Backups: the database is backed up weekly and each backup is kept for 14 days. Data you delete can therefore still exist in a backup for up to 14 days.
- Moderation records: reports are kept after they are resolved, so that repeated abuse can be recognised.
WHEN YOU DELETE YOUR ACCOUNT
You can delete your account yourself, from Settings, at any time. This immediately removes:
- your profile and everything in it — watched titles, lists, ratings, notes, friends, badges, preferences
- your reviews
- your one-to-one chats, including for the person you were talking to
- your friend requests and notifications
- shared lists you own; lists owned by others are left, and you are removed from them
- your block list and your stored country
What remains, and why:
- Backups, for up to 14 days (see above).
- Messages you posted in shared lists owned by other people — deleting them would tear holes in a conversation those people still rely on.
- Moderation records about reports involving your account.
- Analytics, which is aggregated and no longer identifies you.
- Crash reports, which Firebase keeps for a limited period.
YOUR RIGHTS
You can ask us to: confirm whether we process your data; give you a copy; correct it; delete it; restrict or object to processing; and provide it in a portable form. You may withdraw consent at any time. You can exercise all of these by writing to support@cinefr.com, and we answer within 30 days.
You may also complain to a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK), and in the EU/EEA the authority in your country of residence.
DATA BREACHES
If a breach occurs that is likely to put your rights at risk, we will notify the competent authority and affected users without undue delay — within 72 hours under GDPR, and as required by KVKK.
SECURITY
- All traffic is encrypted over HTTPS.
- Firestore security rules restrict every user to their own data; administrator access is separate and limited.
- Google Firebase infrastructure is SOC 2 and ISO 27001 certified.
- API keys for translation are held on the server and never reach your device.
CHILDREN
CineFR is not intended for children under 13, or under the higher age required in your country. We do not knowingly collect data from them; if we learn we have, we delete it.
COOKIES AND SIMILAR TECHNOLOGY
If you connect from the European Economic Area, the United Kingdom or Switzerland, we ask for your consent **before** analytics, crash reporting or the embedded YouTube player run at all; without it they never start. Elsewhere they are on by default and you can switch them off. You can change your decision at any time under Settings → Cookie preferences.
Firebase Authentication stores a session token so you stay signed in. Firebase Analytics may use local storage identifiers for usage statistics. Theme and language preferences are stored on your device.
ADVERTISING
CineFR shows no advertising today and no advertising identifiers are used. If that changes, this policy will be updated and you will be informed in the app before any advertising appears.
THIRD PARTIES
- Google / Firebase — authentication, database, analytics, messaging and crash reporting: policies.google.com/privacy
- Google Cloud Translation — on-demand translation
- Cloudflare — hosting and request delivery: cloudflare.com/privacypolicy
- TMDB — film and series data: themoviedb.org/privacy-policy
- YouTube — trailers: youtube.com/t/terms
- Apple — Sign in with Apple, if you use it: apple.com/legal/privacy
CHANGES
This policy may be updated. Significant changes are announced in the app, and the date at the top always shows the last update.
LANGUAGE
This policy is published in English, Turkish, Spanish and French. In any other interface language the English version is shown and applies.
CONTACT
Egemen Benli — Türkiye
support@cinefr.com