Legal

This Privacy Policy explains what personal data One Film ("we," "our," or "us") collects, why we collect it, and the choices and rights you have. It applies to the One Film website (onefilm.io and its subdomains) and the One Film iOS app (together, the "Service").

In short: we collect the minimum we need to run the Service. We do not sell your personal data, we do not use advertising networks, and we never use your data to train third-party AI models. By using the Service you agree to this Privacy Policy and our Terms & Conditions.

Who Is Responsible for Your Data

The data controller responsible for your personal data is:

• One Film, MB
• Giedraičių g. 39, R53, 09302, Vilnius, Lithuania
• Contact for any privacy question or request: info@onefilm.io

Definitions

To keep this policy clear, these terms mean:

• Personal Data: any information that identifies you or could be used to identify you, such as your email address.
• Service: the One Film website and iOS app.
• Subprocessor: a third-party company we use to help operate the Service (for example, hosting or email delivery).
• You: a person who visits our website or uses the One Film app.

What Information We Collect

We collect some data directly from you, and some automatically from your device when you use the Service. We only collect what we need:

• Account data: your email address, an optional display name, and which sign-in method you used (Apple, Google, or email). Authentication is handled by Google Firebase.
• Taste and activity data: the films you rate, mark as watched, save to watch later or to custom lists, and your in-app preferences. This is what lets us pick a film for you.
• Waitlist / beta requests: if you submit the form on our website, your email address and (for beta requests) the short note you choose to write.
• Usage analytics: we use Google/Firebase Analytics to understand how features are used. Some events are linked to your account via an internal user ID so we can improve the app and diagnose problems. We also use aggregate, cookieless web analytics (Vercel) that is not tied to your identity.
• Technical and log data: when you use the Service, our hosting and infrastructure providers (Vercel, Cloudflare, Firebase) automatically receive standard technical data such as your IP address, device and browser type, and an approximate location derived from your IP. We use this to operate the Service, keep it secure, and diagnose problems.

What We Do Not Collect

We do not collect sensitive personal data, such as information about your health, race or ethnicity, religion, or sexual orientation. We do not ask for it and the Service has no place to enter it.

Why We Use Your Information (Legal Bases)

Under the GDPR, we rely on the following legal bases:

• To provide the Service: create your account, generate your daily pick and recommendations, sync your lists across devices (performance of our contract with you).
• To improve the Service and keep it secure: measure aggregate usage, prevent abuse (our legitimate interests).
• To send you emails you asked for: waitlist and beta updates, and product news where you opted in (your consent, which you can withdraw at any time).
• To meet legal obligations, for example responding to lawful requests.
• To create aggregated, anonymized statistics and insights about film tastes and trends (our legitimate interests). Once anonymized, this information no longer identifies you.

Who We Share Data With (Subprocessors)

We do not sell your personal data and we do not share it with advertisers. We use a small number of trusted service providers ("subprocessors") strictly to operate the Service:

• Apple (App Store): processes all subscriptions and payments. See "Payments" below.
• Google Firebase: account authentication and database storage of your account and taste data.
• RevenueCat: manages your subscription status and purchase history (Apple processes the actual payment).
• Vercel: website and API hosting, plus aggregate cookieless analytics.
• Cloudflare: delivers film images quickly and securely.
• Sentry: collects crash reports and error diagnostics — stack traces, device model and OS version, app version, and in-app navigation breadcrumbs — so we can find and fix bugs. We do not attach your email, account ID, or name to these reports, and the data is processed in the EU.
• Google (Gemini AI API): film candidates are ranked by our own system based on your taste, and we use Google's Gemini API to make the final selection for diversity. We send your film preferences (and, for a shared pick, the display names involved). We never send your email, account ID, or payment data, and Google does not use it to train its models.
• Resend: delivers our emails (waitlist, beta, and product updates).
• TMDB: provides film metadata (we send no personal data to TMDB).

Aggregated and Anonymized Insights

We may combine information across our users to produce aggregated and anonymized insights about film tastes and trends, for example which genres, films, or eras are popular. These insights are statistical only: they do not name you and cannot reasonably be used to identify you. Because anonymized information like this is no longer personal data, we may use, publish, or share it, including with partners and for commercial purposes. We never sell your personal data, and we never share anything that could identify you.

Payments

All purchases and subscriptions are processed by Apple through the App Store. We never see, receive, or store your card or payment details.

We use RevenueCat to manage your subscription status and entitlements (for example, whether your Pro subscription is active). RevenueCat receives your purchase history from Apple, but not your card or payment details. Please see our Refund Policy for how subscriptions, cancellations, and refunds work.

International Transfers

Some of our subprocessors (such as Apple, Google, Vercel, and Cloudflare) operate globally, so your data may be processed outside the European Economic Area. Where that happens, the transfer is covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.

How Long We Keep Your Information

We keep your account and taste data for as long as your account is active. If you delete your account, we delete or anonymize your personal data, except where we must keep something to comply with a legal obligation. Waitlist and beta emails are kept until you unsubscribe. Aggregate analytics are not linked to you and are retained in summarized form.

How We Protect Your Information

We use industry-standard safeguards, including encryption in transit (HTTPS) and access controls so that only authorized personnel can reach the systems that hold your data. Our internal/admin access is protected with multi-factor authentication. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond quickly if something goes wrong.

Your Rights

If you are in the EEA (and in many other regions with similar laws), you have the right to:

• Access the personal data we hold about you and request a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data ("right to be forgotten").
• Restrict or object to certain processing.
• Port your data to another service.
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaint with your local data protection authority (in Lithuania, the State Data Protection Inspectorate).

How to Exercise Your Rights

You can manage or delete your account directly in the app. For any privacy request (access, correction, deletion, or a copy of your data), email us at info@onefilm.io and we will respond within the timeframe required by law. We may need to verify your identity before acting on a request.

Email and Communications

We only email people who asked to hear from us. Every marketing email includes an unsubscribe link, and you can opt out at any time. If you opt out of marketing emails, we will still send you non-promotional messages about your account, such as security or subscription notices. We do not send unsolicited commercial email, and we do not share your email address with advertisers.

Children

One Film is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us at info@onefilm.io and we will delete it.

Third-Party Services

The Service relies on third-party services that have their own privacy policies governing how they handle data:

• Apple: apple.com/legal/privacy
• Google Analytics for Firebase: firebase.google.com/support/privacy
• RevenueCat: revenuecat.com/privacy
• Resend: resend.com/legal/privacy-policy
• TMDB: themoviedb.org/privacy-policy

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service or the law. If we make a material change, we will notify you (for example, in the app or by email) before it takes effect. If you continue to use the Service after an update, you are bound by the revised policy; if you disagree, you can delete your account.

Contact Us

If you have any questions about this Privacy Policy or your data, get in touch.

• Email: info@onefilm.io
• Website: onefilm.io