WLSync

This Privacy Policy explains what information WLSync collects, why, and how it's used, when you use the WLSync mobile app and web app (together, the "Service"). It's part of our Terms of Service.

1. Information we collect

Account information

When you sign up, we collect your email address and display name, and store an account record linked to your Firebase identity. If you sign in with Google or Apple, we receive the basic profile info those providers share (name, email, profile photo). We never see or store your password — authentication is handled by Firebase.

Netflix viewing history

If you enable Netflix sync, the app signs in to Netflix inside an in-app browser using your credentials, and stores the resulting session on your device only, in encrypted secure storage — we never see or store your Netflix password. The app periodically uses that session to request your viewing history directly from Netflix and sends the parsed list of titles and watch dates to our backend so it can build your watchlist. See Terms of Service, Section 4 for the risks of using this feature.

Content and social activity

We store the watchlist entries, custom lists, comments, likes, and follows you create, along with metadata we enrich from third-party catalog sources (OMDb, the Netflix GraphQL API, TVMaze, and YouTube) to show posters, cast, ratings, and trailers. This catalog metadata describes public content, not you.

Device and usage information

To keep sync reliable and support push notifications, we may collect a device push token, basic app diagnostics (crash and error logs, via Sentry), and coarse usage data such as which screens are used. On the web app, that usage data is collected via PostHog and Google Analytics, and only after you've allowed them — see Cookie Policy for what each does and how to change your choice. We use this only to operate and improve the Service.

2. How we use your information

To create and maintain your account and authenticate you.
To sync, store, and display your watch history and lists.
To power social features — feeds, follows, comments, and likes.
To enrich content with metadata from third-party sources.
To send you notifications you've opted into (e.g. sync completed).
To detect abuse, secure the Service, and fix bugs.

We don't sell your personal information, and we don't use it for third-party advertising.

3. Who we share information with

We share information only as needed to run the Service:

Firebase / Google Cloud — authentication and, where used, push notification delivery.
Netflix — only in the sense that, when you enable sync, your device talks directly to Netflix using your own session to retrieve your viewing history.
OMDb, TVMaze, YouTube — queried to fetch public catalog metadata (titles, cast, trailers); we don't send them your personal information.
Other users — your display name, profile, public lists, and activity are visible to people who follow you or view shared list links, based on your privacy settings.
Legal reasons — if required by law, or to protect the rights, safety, or property of WLSync or others.

4. Data retention

We keep your account data for as long as your account is active. If you delete your account (see Delete My Account), we delete your personal data within 30 days, except where we need to retain limited records for legal, security, or fraud-prevention purposes.

5. Data security

We use industry-standard measures to protect your data: encrypted connections (TLS) between the app and our backend, encrypted on-device storage (Expo SecureStore) for sensitive data like your Netflix session, and access controls on our database. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security.

6. Your rights and choices

Access & correction — update your profile and account info directly in the app.
Disconnect Netflix sync — turn off sync and clear your stored session from the app at any time.
Delete your data — request full account deletion any time, see Delete My Account.
Notifications — manage what you're notified about in Settings.
Cookie preferences (web, signed out) — allow or revoke PostHog and Google Analytics any time from Cookie Policy. Signed-in accounts have this on for everything, covered by accepting our Terms of Service at sign-up.

Depending on where you live, you may have additional rights under laws like the GDPR or CCPA, including the right to export your data or object to certain processing. Contact us to exercise these rights.

7. Children's privacy

WLSync is not directed at children under 16, and we don't knowingly collect information from them. If you believe a child has created an account, contact us and we'll remove it.

8. International data transfers

Our infrastructure providers may process data in countries other than your own. Where required, we rely on appropriate safeguards for these transfers.

9. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above and, for material changes, notify you in the app.

10. Contact

Questions, requests, or concerns about your data? Email us at [email protected].