In short
SineO does not track you: no ad network, no third-party trackers, no crash reporting, and no record of what you watch beyond the "watched" marks you set yourself. The one thing it counts is a single line per install: which version, which country and, while you are signed in, which account.
An account is needed for the watchlist, "watched" marks and following people and services. Discover, search, title and person pages, "What should I watch?" and its home-screen widget all work without one, and if you never sign in, the only thing SineO writes to a server is that install line. Those three need an account because an account is what keeps them and carries them between your own phones. If you allow notifications, SineO also registers for announcements; see "Notifications".
Data kept on your device
The following is stored in your device's own storage:
- Your watchlist and the last known details of the titles in it
- Your "watched" marks and how you rated them
- The people and streaming services you follow, with the name and picture shown for each
- Your region, additional regions and the streaming services you picked
- Appearance preference and recent searches
- The notification setting and which services a title was last seen on
- For the people and services you follow: when each was last checked, which new titles this phone has already told you about, and the newest titles it has already seen on each service
- Your "what should I watch" filters and the backdrop theme you chose
None of this is sent anywhere, with three exceptions described below: what your account carries (see "Account"), the region and services that TMDB needs in order to answer a request, and the region in the install line.
A few more things stay inside your device, but deserve to be named:
- So that system search can find them: while you are signed in, the names and artwork paths of the titles on your watchlist are written to your iPhone's own search index (Spotlight). That index is Apple's on-device index; it does not come to us or to anyone else. Removing a title from your list removes it from the index too, and signing out removes them all.
- For the watchlist widget: while you are signed in, a small summary of your list (titles and their artwork) is written to a shared container inside your device, so that the widget on your home screen knows what to show. That container lives on the phone, is shared between the app and its widgets, and never leaves. When you sign out, the summary is emptied and the widget only asks you to sign in.
- For the "What should I watch?" widget: about twenty suggestions are prepared on the phone and kept in the same container: their names, years and artwork, and which of your services each one is on, together with the settings they were made from (languages, regions, your services and your "What should I watch?" filter). While you are signed in, your own "watched" marks shape their order and, as in "What should I watch?", can leave out what you have watched; the container then also holds a one-way code made from your account's id, never the id itself, so that suggestions shaped by one account are not kept for another. Signed out, marks are not used. Signing out does not empty this widget: its suggestions are made again without your marks as soon as SineO is open and online. Nothing about these suggestions is sent to SineO or to Firebase.
- On a phone used by more than one account: when someone else signs in, whatever of yours had not yet reached your account (titles you saved or removed, your "watched" marks, and the people and services you followed or stopped following, as TMDB identifiers with their times) is kept on the phone for you. It is hidden from the other account, never sent to it, and goes to your own account the next time you sign in on that phone. It stays until then, and never longer than 90 days; it goes sooner if your account is deleted from this phone, if SineO learns from Firebase Authentication that the account no longer exists, or if the app is deleted. To know what has already reached your account, the phone also keeps a one-way code of your list and one of your follows as they were last confirmed there, not a copy of either.
The share card ("share my watchlist") renders the image on your device; you decide where it goes in the share sheet, and the app never sends it anywhere on its own.
There is no ad network, no crash reporting, no third-party tracking software and no event stream inside SineO: which screen you opened, what you searched for, what you watched — none of it is tracked.
An install counter (since 0.52.15). At launch the app writes a single line: platform, OS version, app version, the content region you picked, the interface language, and when the install was first and last seen. Beside it sits an identifier the app generates itself — not the device's, a UUID that disappears when you delete the app; IDFV and IDFA are never touched. If you are signed in, your account's id is added to that line; SineO first asks Firebase Authentication whether the account still exists and leaves the id out if it does not. When you sign out or delete your account, SineO writes the line again straight away without that id, or at the next launch if the phone was offline. Each install has a line of its own, and SineO can write only this install's: once your account is deleted, another phone that was signed in to it removes the id from its own line the next time SineO is opened there online, but if SineO was deleted from a phone while signed in, the app can no longer reach that install's line, and the id stays on it. You can ask for such ids to be removed at mustafa@mustafaevleksiz.com.
Why: there was nowhere to answer "how many people are stuck on which version", and a version floor cannot be set responsibly without knowing how many people it would shut out. The line is one per install and is overwritten on each launch; it accumulates no history.
That line goes out as one HTTPS request; the Firebase package is not started for it. While you are signed in, the request also carries your sign-in token, which is how Firestore checks that the id on the line is yours. The sign-in package (Google Firebase Authentication) is still never started until you press a sign-in button: for somebody using the app without an account it sits dormant. The one exception is push: once you allow notifications, Firebase starts so that SineO can register for announcements (see "Notifications").
Deleting the app deletes all of it. It may appear in your device backups, which are under your own Apple account's control.
Account (for the watchlist, marks and follows)
The watchlist, "watched" marks and following people and services need an account; browsing, search, title and person pages and "What should I watch?" do not. The account keeps those three and carries them between your own phones.
If you do choose to sign in:
- What is stored: a user id and — unless you signed in with Apple and chose to hide it — your email address. SineO also keeps an account record for managing the account and deleting it: that address, how you signed in (Apple, Google or the emailed link), when the account was created and when SineO was last opened with it; before writing it at launch, SineO asks Firebase Authentication whether the account still exists. And what the account carries: the TMDB identifiers of the titles on your watchlist and of the titles you marked, with how you rated them and when you saved, removed, marked or unmarked each one; and the TMDB identifiers of the people and streaming services you follow, with when you followed them or stopped following them. No names, artwork or scores are sent; a new phone fetches those from TMDB itself. No phone number, no contacts, no location: none of it is asked for and none of it is taken. One caveat, and it is Google's alone: Google's sign-in scopes are fixed, so its token hands Firebase Authentication the display name and avatar link on that account. SineO never asks for them, never shows them and never uses them; they sit in the Firebase account record and go when you delete the account. Sign in with Apple, or with the emailed link, and there is no name at all — of Apple, SineO asks for an e-mail address and nothing else. SineO's owner can see the list of these account records, addresses included, in order to manage the accounts and answer requests about them. The counts kept beside that list — how many accounts exist, how many were opened in a period, how many were seen recently — are made only from the account ids and from the dates on the account records and install lines; the address is never used for them. When a new account is opened, the owner's own phone can say so with a local notification: it is made on that phone from the same reading, there is no push service and no notification token, and its text is a number, never an address.
- Who processes it: authentication is run by Google's Firebase Authentication; we do not operate a server of our own. Apple verifies your password if you sign in with Apple, Google if you sign in with Google — your password never reaches SineO.
- Signing in with the emailed link: SineO sends Firebase Authentication your address and the language SineO is shown in (a code such as "tr"), so that the e-mail and its link are written in that language. If the link opens in a browser rather than in SineO, it lands on a small SineO page that only says what to do; that page stores nothing, sets no cookies and loads nothing from anyone else.
- Sign in with Apple lets you hide your address; we then hold an Apple private relay address rather than your real one.
- When it starts: the sign-in software is never run until you press a sign-in button. So for anybody using the app without an account, this whole section does not apply.
- Signing out: Settings → Account → Sign out. SineO first sends your latest changes to your account, waiting at most three seconds. Your recent searches are then removed from the phone. Your watchlist, marks and follows stay on the phone but are hidden: until you sign in again, they are not shown, not checked for news and not sent anywhere. If a different account signs in on this phone, they are removed from it; whatever had not reached your account yet is kept for you, as described under "Data kept on your device". This phone's install line is written again without your account's id.
- Deletion: Settings → Account → Delete account. First your watchlist, marks and follows are removed from the cloud, then the account record, then your sign-in account; after that they are removed from this phone too, and this phone's install line is written again without your account's id; for your other phones, see "An install counter" above. Your recent searches stay on the phone. Deleting needs a recent sign-in that is still valid on this phone; without one nothing is deleted and SineO asks you to sign out and sign in again. If the deletion cannot finish, nothing is removed from the phone and your watchlist, marks and follows are written back to the same account: for that, SineO copies what your account carries just before deleting, and keeps the copy on the phone until it has been written back or the account is really deleted, and never longer than 90 days. The copy is never shown and never goes to another account. If the account record was already removed by then, SineO writes it again the next time it is opened with that account. If another phone is still signed in to the account, sign out there first: until that phone notices the account is gone, it can write what it holds back to the cloud. When SineO on that phone learns from Firebase Authentication that the account no longer exists, it removes that account's watchlist, marks and follows from that phone straight away, and remembers the account's id there (never more than 16 ids) so that nothing of that account is kept on it again. Those ids do not leave the phone and are never sent anywhere, but they are kept in the app's own settings, so — like the rest of the data the app keeps on the phone — they can appear in that phone's device backups. If you cannot reach your phone, you can ask for the same deletion at mustafa@mustafaevleksiz.com; the detail is at mustafaevleksiz.com/sineo/delete-account.
Services the app talks to
SineO makes requests to four places in order to work, and to one more if you sign in. The first three carry no identity: no account, no device identifier, no advertising identifier. As with any internet request, your IP address and general device information are visible to the receiving service; we neither log this nor operate a server of our own. If you allow notifications, one more: Firebase Cloud Messaging.
- TMDB (api.themoviedb.org, image.tmdb.org) — film and TV metadata, artwork, availability
- OMDb (www.omdbapi.com) — IMDb, Rotten Tomatoes, Metacritic scores
- YouTube (when you play a trailer) — trailer playback
- Google Cloud Firestore — the app's own settings (such as whether a newer version is out) and the install line; if you sign in, also the account record and where your list and follows are carried between your phones
- Google Firebase Authentication (only if you sign in) — verifying who you are, and at launch whether your account still exists
- Google Firebase Cloud Messaging (only if you allow notifications) — delivering SineO's announcements
Some TMDB requests are made without you opening a screen. While you are signed in, follow people or streaming services and allow notifications, SineO asks TMDB now and then for their newest titles: at launch, when you come back to the app and when iOS lets it refresh in the background. And to keep the "What should I watch?" widget ready, even if you never add it, SineO asks TMDB for suggestions on your services, where they can be watched and their artwork, at most every six hours unless your settings change. And if the welcome screen was finished before TMDB's list of countries arrived (for example while offline), SineO asks TMDB for that list at launch and when you come back to the app, until it has checked the countries you picked; a country TMDB does not list is then removed from your regions. These requests carry what browsing does (identifiers, your region, language and services) and no account or device identifier.
Streaming availability is provided by JustWatch through TMDB. Tapping a service logo opens that service's own site or app; from there their privacy policy applies.
Backup file
From Settings → Your data you can create a backup file while you are signed in: your watchlist, your "watched" marks, your recent searches and your preferences, in a single JSON file. The people and services you follow are not in it. You create that file and you decide where it goes; the app never sends it anywhere and never uploads it to a server. The file is plain text, so you can open it and read exactly what is in it. You can restore from it on the same screen, also while signed in.
Notifications
If you turn on "Tell me when it arrives", the availability of titles on your watchlist is checked while you are signed in, and your device itself shows a notification when one of them reaches a service you subscribe to.
People and streaming services you follow work the same way: while you are signed in and notifications are allowed, SineO checks TMDB for their new films and series, and your device shows the notification. While notifications are not allowed, nothing is checked for them.
SineO asks for permission only when you turn on "Tell me when it arrives", when you follow someone or a service and it has never asked on this phone, or when you tap "Allow notifications"; never on its own and never at launch. Alerts about your list and follows are made on the phone itself. Separately, if you allow notifications, SineO registers with Google Firebase Cloud Messaging and subscribes only to groups by language and platform (for example "English" and "Android") so that we can send announcements; we keep no device token, and a message goes to a group, never to one person. Taking notifications away removes the registration, and you can also mute just the announcements.
Children
SineO is not directed at children and does not ask anyone's age.
Changes
If this policy changes, the date above is updated and the new text ships with the next version of the app.
Contact
mustafa@mustafaevleksiz.com