Couch Club Privacy Policy
Last updated: 28 October 2026
Couch Club ("the app", "we") helps friend groups organize movie nights. This policy explains what we collect, why, who sees it, and how you can delete it.
Who is responsible: Aleksandar Bakalov, Bulgaria. Contact: abakalov99@gmail.com
What we collect
Account. When you sign in with Google or Apple we receive your account identifier and email address from that provider. We do not receive your password. We do not collect your Google or Apple contacts, photos or calendar.
Profile. The display name you choose (up to 40 characters) and your region (a two-letter country code, suggested from your device settings and changeable by you). The region is used to show which streaming services carry a movie in your country.
Club activity. Clubs you create or join, your membership status, the movies you pick, the order of turns, spin results, the rankings you submit, round scores and the log of turn-order changes made by a club admin.
Push notifications. If you allow notifications, your device's push token and platform (iOS or Android), so we can tell you when a spin starts, it is your turn, a movie is picked, a ranking room opens, and similar club events. You can turn notifications off in your device settings at any time.
Technical data. Short-lived records used to protect the service: how often you called movie search and how many invite-code attempts you made recently (to stop abuse), and whether you are currently in a live ranking room (presence, not stored after you leave).
We do not use advertising, analytics or tracking SDKs, and we do not sell or share your data for advertising.
Who can see what
- Other members of your clubs see your display name, the movies you picked, your place in the turn order, spin results, final ranking totals and the club history. Only active members of a club can read its data.
- Rankings are anonymous. Other members never see how you ranked; you see only your own ranking and the final totals. Rankings are stored on our server because the scores are computed from them.
- Club admins can see the member list and can remove members.
- Your email address is never shown to other members.
Service providers
We use these providers to run the app. They process data on our behalf.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, sign-in, realtime, server functions. Hosted in the EU (Frankfurt, Germany). | All data above |
| Google / Apple | Sign-in | Account identifier, email |
| Expo (Expo Push Service) | Delivering push notifications via Apple and Google | Push token, notification text |
| Expo (EAS Update) | Delivering app updates: the app checks for a newer version when it starts | IP address, device platform, app version. No account data. |
| The Movie Database (TMDB) | Movie search, details and streaming availability | Your search text, sent through our server. Your identity is not sent to TMDB. |
This product uses the TMDB API but is not endorsed or certified by TMDB. Streaming availability data is provided by JustWatch via TMDB.
How long we keep data
- While your account exists, we keep the data above.
- Delete your account in the app (Profile, Delete Account) or as described on the account deletion page. We then delete your sign-in, email, region and push tokens. A club you ran alone is deleted. In other clubs your past picks and any submitted ranking stay in the club history, shown as "Former member", with no link back to you.
- If you leave a club, your pending turn is removed. Your past picks and any submitted ranking stay.
- If a club admin deletes the club, its whole history is deleted for everyone.
- Backups may hold deleted data for up to 7 days.
Your rights
Depending on where you live (for example under the GDPR), you may ask to access, correct, export or delete your data, object to processing, or complain to your data protection authority. You can edit your name and region and delete your account in the app. For anything else, email abakalov99@gmail.com.
Legal bases (GDPR): providing the service you asked for (contract), sending notifications (your consent, which you can withdraw in device settings), and preventing abuse (legitimate interest).
Children
Couch Club is not directed to children under 16. We do not knowingly collect data from them. If you believe a child has an account, contact us and we will delete it.
International transfers
Our providers may process data outside your country. Where required, transfers rely on standard contractual clauses or equivalent safeguards.
Security
Data is encrypted in transit, access is restricted by row-level security so only active members read a club's data, and server-side secrets (such as the TMDB key) never ship in the app.
Changes
If we change this policy in a meaningful way we will update the date above and tell you in the app.