Privacy Policy

1. Introduction & Application Purpose

Cineby ("we", "our", or "us"), operated under the Google Cloud Project MAARE, is an interactive media indexing, discovery, and personal watch tracking web application accessible at https://cineby.group and https://www.cineby.group.

This Privacy Policy explains in detail our practices regarding the collection, use, disclosure, storage, and protection of personal data when you interact with our website, create a profile, or authenticate using Google Identity Services.

2. Scope of Data We Collect

We only collect the minimal personal information essential to deliver personal profile management, watchlist synchronization, and playback progress tracking:

• Google OAuth & Identity Data: When you choose to authenticate via Google One Tap or Google Sign-In, we request access exclusively to non-sensitive scopes: your public name, primary email address, and profile picture avatar. We do not request access to contacts, files, Gmail, Google Drive, or calendar data.
• Local Authentication Data: For standard accounts, we collect a chosen username, email address, and a salted cryptographic hash (via bcrypt) of your password. We never store plaintext passwords.
• Watch Activity & Profile Preferences: Active profile names, custom PIN codes (encrypted), watch progress timestamps (used to resume media playback where you left off), and titles added to your personal watchlist.
• Technical Diagnostic Data: IP addresses, browser user-agent header information, and transient connection tokens collected strictly for security defense, DDoS mitigation, and rate limiting.

3. How We Use Your Information

Your information is used strictly for the following purposes:

• To authenticate your identity and grant access to your account.
• To synchronize your personal profiles, watchlist items, and playback resume points across devices.
• To maintain session state and remember user appearance, caption, and audio player settings.
• To safeguard against unauthorized access, abusive traffic, or malicious requests.

We do not sell, rent, trade, or monetize your personal information or Google user data. We do not use your information to serve personalized advertisements or build ad profiles.

4. Compliance with Google API Services User Data Policy

Cineby’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only utilize Google user data to provide user-facing features (account creation and identity verification).
• We do not transfer Google user data to third parties unless necessary to provide or improve these features, comply with applicable laws, or as part of a merger/acquisition.
• We never use or transfer Google user data for serving advertisements, retargeting, or data brokerage.
• No humans read your Google user data unless you give explicit permission for technical support, it is required for security investigations, or to comply with law.

5. Data Retention, Account Deletion & User Rights

You maintain total control over your personal data. We retain personal data only as long as your account remains active.

Self-Service Account & Data Deletion: You can permanently delete your entire account, all associated user profiles, watch history, and watchlist entries at any time by navigating to Account Settings and clicking "Delete Account". This action executes an irreversible cascade deletion across all our database tables immediately.

You may also revoke Cineby's access to your Google Account at any time through your Google Security Settings.

6. Third-Party Integrations & Metadata

Cineby acts as an informational interface and media discovery organizer. Media posters, descriptions, and episode information are retrieved dynamically via The Movie Database (TMDB) API. Cineby does not host or transmit unauthorized copyrighted media on its servers.

7. Security Measures

All traffic between your browser and Cineby is encrypted in transit using industry-standard TLS 1.3 / HTTPS. Session tokens are signed using cryptographic signatures and stored in HttpOnly, SameSite cookies to protect against cross-site scripting (XSS) and CSRF attacks.

8. Contact Information & Data Protection Officer

For any questions, data requests, or privacy inquiries regarding Cineby or our Google Cloud Project MAARE, please contact us directly: