Privacy Policy

Introduction

Welcome to Cued It, a movie discovery, watchlist management, and social viewing platform operated by CUED IT PTY LTD ("we," "us," or "our"), based in Brisbane, Queensland, Australia.

This Privacy Policy explains how we collect, use, store, and share your personal information when you use our mobile applications (iOS and Android) and web platform (collectively, the "Services"). We are committed to protecting your privacy and handling your data responsibly.

By using Cued It, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Services.

For App Store Connect Guideline 4.1, our app displays third-party movie metadata via licensed data providers.

We have attached documentary evidence of our provider rights/terms and subscription status in App Review Information. Here: https://raw.githubusercontent.com/movieofthenight/streaming-availability-api/main/TERMS.md

Cued It Pty Ltd gives attribution to The API Provider, by stating that the streaming availability information and movie information metadata is provided by Streaming Availability API by Movie of the Night; here is a link to the website: https://www.movieofthenight.com/about/api.

We do not claim affiliation with studios or streaming services.

Dispute Resolution Reference

Questions or disputes relating to privacy, data protection, or personal information handling are subject to the dispute resolution provisions set out in our Terms and Conditions, including any applicable arbitration agreements, unless prohibited by applicable law.

Important: Cued It is intended for users aged 15 and older. Our Services feature movies with various content ratings, including mature content rated M, MA, and R. While we provide content classification information, we are not responsible for your reaction to movie content. Parental guidance is recommended for users under 18.

Information We Collect

We collect several types of information to provide and improve our Services:

2.1 Account Information

When you create a Cued It account, we collect:

• Email address - for authentication, account recovery, and communications
• Username - your public identifier (3-20 characters, alphanumeric with underscores)
• Password - encrypted and never stored in plain text
• Display name (optional) - how you appear to other users
• Avatar URL (optional) - your profile picture
• Account creation timestamp
• Marketing preferences - whether you agree to receive marketing communications

2.2 Authentication Information

We support multiple authentication methods:

• Email/password authentication via Supabase Auth
• Apple Sign-In - when using Apple authentication, we may receive limited user data as per Apple's privacy features, including your name and email address (or Apple's private relay email)

2.3 Location Data

We collect geographic location information to provide localised content:

• Device location - collected on app startup with your permission (via GPS or device location services)
• IP address-based location - approximate location derived from your IP address, even when location services are disabled
• Purpose: To determine which streaming services are available in your country/region and provide relevant content recommendations

You can control location permissions through your device settings, but this may limit certain features.

2.4 Movie Interaction Data

We collect information about your interactions with movies and content:

• Watchlist - movies you save to watch later
• Watched movies - movies you've marked as watched, with your ratings (1-5 stars)
• Disliked movies - movies you don't want recommended
• Movie preferences - preferences collected during onboarding and throughout app usage
• Viewing behavior - what content you view, search for, and interact with
• Search filters - criteria you use when searching for movies

2.5 User-Generated Content

Content you create on our platform includes:

• Movie reviews - text reviews (50-500 characters) with ratings
• Review reactions - likes and dislikes on other users' reviews
• Public profile information - your username, display name, and avatar are publicly visible

Note: Reviews are public and associated with your username. Other users can view, search, and interact with your reviews.

2.6 Social Features Data

When you participate in social features:

• Watch party participation - party codes, host information, participant lists, and shared watchlists
• Watch party data retention - parties automatically expire after 2 hours
• Public profile views - other users can view your public profile, watchlist, and reviews

2.7 Technical and Device Information

We automatically collect technical data when you use our Services:

• Device information - device type (iOS, Android, web), model, operating system version
• App version - which version of Cued It you're using
• Session tokens - stored locally on your device via AsyncStorage for authentication
• Query cache data - temporary data cached via TanStack Query to improve performance
• IP address - for security, fraud prevention, and approximate location
• Usage analytics - how you interact with features, navigation patterns, and app performance data

2.8 Information We Do NOT Collect

• We do not use cookies in our mobile applications
• We do not track you across third-party websites (no cross-site tracking)
• We do not collect sensitive personal information such as financial data, health information, or biometric data
• We do not access your device's contacts, photos, or other media without explicit permission

How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Improve Our Services

• Create and maintain your account
• Authenticate your identity and secure your account
• Personalise movie recommendations based on your preferences, watchlist, ratings, and interactions
• Display streaming availability based on your location
• Enable social features like watch parties, reviews, and public profiles
• Improve app performance, fix bugs, and develop new features
• Analyse usage patterns to understand how users interact with our Services

3.2 To Communicate with You

• Send account-related emails (verification, password reset, security alerts)
• Respond to your support inquiries
• Send marketing communications if you've opted in (you can opt out anytime)
• Notify you of important changes to our Services or policies

3.3 To Ensure Safety and Security

• Detect and prevent unauthorised access, fraud, and abuse
• Enforce our Terms of Service
• Comply with legal obligations
• Protect the rights and safety of our users and the public

3.4 To Generate Movie Recommendations

• Process your search filters through AI-powered recommendation systems
• Analyse your movie interactions (watchlist, ratings, reviews) to suggest relevant content
• Improve recommendation algorithms based on aggregated user behavior

How We Share Your Information

We do not sell your personal information to third parties. We share your information only in the following circumstances:

4.1 Public Information

The following information is publicly visible to other Cued It users and potentially searchable:

• Username
• Display name
• Avatar
• Movie reviews and ratings
• Review reactions (likes/dislikes)
• Watchlist (visible to watch party participants and when viewing your profile)

4.2 Within Watch Parties

When you join or host a watch party:

• Your username and display name are visible to all participants
• Your shared watchlist is visible to party members
• Party information is automatically deleted 2 hours after creation

4.3 With Service Providers

We share information with trusted third-party service providers who help us operate our Services:

• Supabase - backend infrastructure, authentication, and database services (data stored in Australian data centers)
• RapidAPI (Streaming Availability API) - we share your movie interactions (ratings, preferences) to provide personalised streaming availability information
• OpenAI - we share your search filters to power our AI-driven movie recommendation taxonomy engine (we do NOT share your personal information, watchlist, or ratings with OpenAI)

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.4 For Legal Reasons

We may disclose your information if required by law or in good faith belief that such action is necessary to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service
• Protect the rights, property, or safety of Cued It, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues

4.5 Business Transfers

If Cued It is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice in the app before your information is transferred and becomes subject to a different privacy policy.

Third-Party Services

Our Services integrate with third-party platforms that have their own privacy policies:

5.1 Supabase

• Purpose: Backend infrastructure, authentication, user data storage, and real-time features
• Data Shared: All account and user-generated data
• Privacy Policy: https://supabase.com/privacy
• Data Location: Australian data centers

5.2 RapidAPI (Streaming Availability API)

• Purpose: Movie metadata, streaming availability, and popularity data
• Data Shared: Your movie interaction data (ratings, preferences, watchlist activity) to personalise streaming recommendations
• Why Necessary: To show you which streaming services have the movies you're interested in, available in your region
• Privacy Policy: https://rapidapi.com/privacy

5.3 OpenAI

• Purpose: AI-powered movie recommendation taxonomy engine
• Data Shared: Only the search filters you select when looking for movies (e.g., genre, mood, year, rating)
• Data NOT Shared: We do not share your personal information, email, username, watchlist, ratings, or reviews with OpenAI
• How It Works: OpenAI processes your search criteria to help categorise and filter movies. We then store your subsequent interactions with recommended movies in our own database.
• Privacy Policy: https://openai.com/privacy

5.4 Apple Services (for iOS users)

• Purpose: Apple Sign-In authentication
• Data Shared: As controlled by Apple's privacy features (typically name and email)
• Privacy Policy: https://www.apple.com/legal/privacy/

5.5 Expo Application Services (EAS)

• Purpose: App deployment, updates, and distribution
• Data Shared: Technical app information for deployment purposes
• Note: We have disabled Expo telemetry and analytics

We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before using our Services.

Data Storage and Security

6.1 Where We Store Your Data

Your data is stored in Australian data centers operated by Supabase. This helps us comply with Australian privacy laws and ensures your data is subject to Australian legal protections.

6.2 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Password security: Passwords are hashed using industry-standard encryption via Supabase Auth and never stored in plain text
• Row Level Security (RLS): Database-level security ensures users can only access their own data (except for public content like reviews)
• Session management: Secure session tokens are stored locally on your device
• Access controls: Strict internal access controls limit who can access user data

6.3 Your Responsibility

While we implement strong security measures, you are responsible for:

• Keeping your password confidential
• Using a strong, unique password (following the required criteria)
• Notifying us immediately of any unauthorised account access
• Securing your device and email account

Your Rights and Choices

You have the following rights regarding your personal information:

7.1 Access and Update

You can access and update your account information at any time through the app settings:

• View and edit your profile (display name, avatar)
• Change your password (requires email verification)
• Update your email address
• Manage marketing preferences

7.2 Data Portability

You have the right to request a copy of your personal data in a structured, machine-readable format. Contact us at founder@cuedit.app to request a data export.

7.3 Account Deletion

You can delete your Cued It account at any time through the app settings. When you delete your account:

• Your account is immediately quarantined and inaccessible
• Your data is permanently deleted after 6 months
• During the quarantine period, your data is not processed or visible to other users
• After deletion, you will not be able to recover your account, watchlist, reviews, or any other data

Important: Some data may be retained for legal or security purposes as described in the "Data Retention" section.

7.4 Marketing Communications

You can opt out of marketing emails at any time by:

• Clicking "unsubscribe" in any marketing email
• Updating your preferences in app settings
• Contacting us at founder@cuedit.app

Note: You will still receive essential account-related emails (verification, security alerts, password resets) even if you opt out of marketing.

7.5 Location Permissions

You can control location access through your device settings:

• iOS: Settings > Privacy & Security > Location Services > Cued It
• Android: Settings > Apps > Cued It > Permissions > Location

Disabling location services may limit certain features but you will still be able to use the app.

International Data Transfers

8.1 Data Storage Location

Your data is primarily stored in Australian data centers operated by Supabase. However, some third-party services we use may process or store data in other countries:

• OpenAI - United States
• Apple - Various locations globally (for Apple Sign-In users)
• RapidAPI - Various locations as per their infrastructure

8.2 Data Protection for International Transfers

When we transfer data internationally, we ensure adequate protections:

• Standard Contractual Clauses (SCCs) - We use EU-approved SCCs with service providers
• Adequacy decisions - We rely on adequacy decisions from relevant authorities where applicable
• Encryption - All data is encrypted in transit and at rest

8.3 Australian Privacy Principles

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you are an Australian user, you have rights under Australian privacy law.

8.4 GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

8.5 CCPA/CPRA Compliance (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (note: we do not sell your information)
• Right to non-discrimination for exercising your rights

To exercise any of these rights, contact us at founder@cuedit.app.

Children's Privacy

9.1 Age Requirement

Cued It is intended for users aged 15 and older. We do not knowingly collect personal information from children under 15.

9.2 Mature Content Warning

Our Services feature movies with various content classifications, including:

• M (Mature) - Recommended for mature audiences 15+
• MA 15+ (Mature Accompanied) - Not suitable for people under 15
• R 18+ (Restricted) - Restricted to adults 18+

While we provide content rating information through our movie database, we are not responsible for your reaction to movie content. Users under 18 should use Cued It with parental guidance and supervision.

9.3 Parental Consent

If you are under 18, you should only use Cued It with the permission and supervision of a parent or legal guardian.

9.4 If We Discover Underage Users

If we learn that we have collected personal information from a user under 15, we will take immediate steps to delete that account and associated information.

Parents/Guardians: If you believe your child under 15 has created an account, please contact us immediately at founder@cuedit.app so we can delete the account.

Data Retention

10.1 Active Accounts

We retain your personal information for as long as your account is active or as needed to provide you with our Services.

10.2 Account Deletion

When you delete your account:

• Your account is immediately quarantined and becomes inaccessible to you and other users
• All personal data is permanently deleted after 6 months from the deletion request
• During the 6-month quarantine period:
  • Your data is not visible to other users
  • Your data is not used for recommendations or analytics
  • You cannot reactivate your account
• After 6 months, all data is permanently and irreversibly deleted from our systems

During the quarantine period, access to your data is restricted and limited to authorized personnel solely for legal compliance, security, fraud prevention, or dispute resolution purposes.

10.3 Legal and Security Retention

Some information may be retained beyond the standard deletion period for:

• Legal compliance - to comply with legal obligations, court orders, or regulatory requirements
• Dispute resolution - to resolve disputes or enforce our agreements
• Fraud prevention - to prevent fraud, abuse, or security threats
• Safety and security - to protect the safety of our users and the public

Examples of information that may be retained:

• Transaction records (if we add paid features in the future)
• Account security logs for fraud investigation
• Content that violates our Terms of Service
• Information subject to legal hold or government requests

10.4 Aggregated and Anonymised Data

We may retain aggregated or anonymised data that no longer identifies you personally for analytical purposes, product improvement, and research. This data cannot be used to identify you.

10.5 Backup Systems

Deleted data may persist in our backup systems for up to 90 days after deletion from our production systems. Backup data is securely stored and not accessible for normal operations.

Changes to This Policy

11.1 Notification of Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated policy in the app with a new "Last Updated" date
• Sending an email to the address associated with your account
• Displaying a prominent notice in the app

11.2 Your Acceptance

Your continued use of Cued It after we post changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using our Services and delete your account.

11.3 Review Opportunity

For material changes, we will provide you with at least 30 days notice before the new policy takes effect, giving you the opportunity to review the changes and decide whether to continue using our Services.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

12.1 Privacy Inquiries

For privacy-specific inquiries, including:

• Questions about how we handle your data
• Requests to access, update, or delete your information
• Data portability requests
• Complaints about our privacy practices

Please email us at founder@cuedit.app with "Privacy Inquiry" in the subject line.

12.2 Data Protection Officer

For users in the European Economic Area, you may contact our Data Protection Officer at founder@cuedit.app.

12.3 Supervisory Authority

If you are located in the EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

For Australian users, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.