Privacy Policy

Who we are

Sofa Time is operated by Javier Aznar, trading as The Clash Soft, in Spain. We are responsible for the personal data processed through our apps, website and related services. For privacy questions, email [email protected].

The data involved depends on the features you use, your permissions and the accounts you connect. Using Sofa Time or reading this policy does not, on its own, give consent to optional processing.

On the website

When you visit sofatime.app, our hosting service processes requests and technical information such as your IP address and browser details. Server logs help us operate the website and investigate faults or abuse. Public profile and list pages also display the information their owners share.

If you sign up for the Android beta, we collect your email, registration and export status, timestamps, a hash of your IP address and browser information. Your email is used to manage beta access and is provided to Google Play to authorize testing.

The website may use necessary cookies or functional storage for features such as authenticated administrative sessions. Following an external link or downloading images from another service can also involve that provider's processing of technical data.

In the app: the information we use

• Account and profile: account identifier, email address, authentication information, username, display name, and profile details you provide, such as an avatar, background image, biography or social links. Supported Apple or Google sign-in can provide an identifier, email, name and profile image, depending on the provider and permissions. Apple may provide a private relay email address.
• Your library and preferences: films and shows you track, watchlists, watched episodes and dates, ratings, personal notes, lists, favorites, statistics, achievements, language, selected streaming country and providers, and app settings. Information may stay on your device or be synchronized when you use cloud or connected-service features.
• Community activity: comments, replies, attached images and other uploaded contributions, reactions, follows, shared lists and activity. Moderation information can include reports, the content reported, account identifiers, reasons and timestamps, moderation strikes, publishing restrictions, decisions and review correspondence. See What others can see and Reports and moderation records.
• Connected services: account identifiers, authorization tokens and the library or profile information made available by a service you connect. Imported files may contain viewing history, ratings, lists or other information included in the file you select.
• Technical and usage information: IP address, device and operating-system information, app version, installation or session identifiers, feature interactions, performance information, errors and crash reports. Where enabled, analytics may also include installation-source and campaign information. These data are not necessarily anonymous.
• Notifications: device and installation identifiers, notification tokens linked to your account, notification permission status and preferences, language, app and operating-system version, and the content and delivery information needed for push notifications.
• Support: your email, name if provided, messages, attachments and technical details needed to help with your request.

Do not include payment credentials, sensitive personal information or information about others that is unnecessary in public contributions, imported files or support messages.

Cloud storage and push notifications

Google Cloud and Firebase provide Sofa Time's backend infrastructure. We use their database, file storage and backend services to store and process account and profile information, profile and background images, synchronized libraries and lists, comments, replies and attached images, other community activity and moderation records, purchase verification records, and notification settings. These services let us save your information, synchronize it between devices and provide the cloud and community features you use.

For push notifications, our backend stores device registration information linked to your account, including notification tokens, permission status and preferences. Firebase Cloud Messaging processes the device identifiers, tokens, message content and delivery information needed to send notifications; on iOS, delivery also uses Apple's push notification service. You can manage notification preferences in the app and notification permissions in your device settings. Disabling notification display does not, by itself, delete your account or all device registration records.

Google processes the personal data we store in these cloud services on our behalf under the applicable data processing terms. We remain responsible for that processing. Storing information in Google Cloud does not itself make it public; visibility depends on the feature and the settings described under What others can see. The retention and international-transfer information below also applies to this backend processing.

Finding friends and optional permissions

Some features request permission to access notifications, contacts, selected photos or the calendar. You can decline or revoke a device permission in system settings; the associated feature may then be unavailable.

If you choose to find friends through contacts, Sofa Time reads contact names and email addresses made available by your device permission. Names help display matches on your device; email addresses are submitted to our account-matching service to find existing Sofa Time users. This feature is optional. Granting contact access does not authorize us to send invitations to your contacts.

If you add a reminder to a calendar or share information through another app, the information you choose to share is also processed by that app or calendar provider under its own policy.

What others can see

Public profiles and lists can be viewed by other people, including visitors to public links on the web. Depending on what you publish and the feature's settings, this can include your username, display name, profile images, biography, social links, favorites, viewing information, lists, statistics, achievements and Premium badge. Public comments, replies and their attached images are visible to people who can access the discussion and may identify your profile, as may your reactions. Images can reveal faces, documents, locations or other personal information; check the image before uploading it.

Review the visibility controls before sharing. Making a profile private does not necessarily remove comments or attached images posted in public discussions or content separately shared as public. Usernames may remain available for account lookup. Do not use a public profile or comment to share information you want to keep confidential. Publish other people's personal information or identifiable images only where you have the necessary permission or another lawful basis. Ownership and responsibility for contributions are explained in the Terms of Use.

Copies made by other users, search engines or external services are outside our direct control. If you need help removing a contribution or understanding its visibility, contact us.

Reports and moderation records

We process reports and the relevant text, attached images, account information and moderation history to assess possible violations, protect the community, enforce publishing restrictions, respond to review requests and comply with legal duties. Authorized moderators can access the information needed for those tasks. Automated rules can use reports from different accounts and moderation strikes to hide contributions or restrict the visibility of new contributions. The Terms of Use explain these measures and how to request human review.

We rely on our legitimate interests in preventing abuse and protecting users, and on legal obligations where applicable. Reports and internal moderation records are not published as community content. Relevant information may be included in a decision notice or disclosed where required by law; a reporter's identifying details are disclosed only where necessary and lawful. We may keep limited records of removed content, reports, strikes and restrictions for as long as necessary to handle a report or appeal, prevent repeated abuse or restriction evasion, or meet legal obligations and limitation periods. A moderation record may therefore remain after the original contribution is hidden or deleted. These purposes do not justify indefinite retention of all content.

Your purchases and subscriptions

Apple and Google process in-app payments directly. We receive the information needed to verify your purchase and provide Premium: the store, product and transaction identifiers, purchase tokens or receipts, purchase dates, subscription period, expiry, renewal, refund and entitlement status.

We also use an account identifier to link eligible purchases to your Sofa Time account and restore access. We do not receive your full payment card number. Apple's and Google's own transaction records are covered by their privacy policies.

Analytics, errors and advertising

Sofa Time does not display advertising. Premium purchases pay for app features; they are not purchases to remove ads.

We use Google Analytics for Firebase to understand how features are used and Firebase Crashlytics to investigate errors. Microsoft Clarity may also provide interaction analytics and session replay in iOS versions where it is enabled, as explained under Who helps us run Sofa Time.

Mobile analytics use SDKs and installation or session identifiers, rather than just browser cookies. A browser's cookie settings do not disable this collection in the app. Where consent is required for non-essential tracking or analytics, you can withdraw it or raise an objection by contacting us. Device permissions can also be changed separately in system settings.

Why we use this information

Where the GDPR applies, we rely on the following bases according to the processing involved:

• Performance of our contract with you: operating your account and cloud storage, saving or synchronizing your library, providing community features, requested notifications and support, and verifying purchases, restoring access and maintaining Premium entitlements.
• Consent: optional contact discovery and other optional uses where consent is required, including non-essential tracking or analytics. Device permissions provide additional controls and do not replace any separate consent required by law.
• Legitimate interests: protecting the Services, preventing fraud and abuse, handling moderation reports and reviews, enforcing proportionate publishing restrictions and preventing their evasion, resolving technical faults and understanding service performance where permitted without consent. We balance these interests against your rights and expectations.
• Legal obligations: responding to lawful requests and retaining records where required by tax, accounting, consumer or other applicable law.

Information necessary for an account, purchase or requested feature is needed to provide it. Optional profile details and device permissions are not required for unrelated features. We do not treat acceptance of the Terms of Use as consent to optional analytics.

Who helps us run Sofa Time

We disclose information needed for the functions described in this policy to the following recipients. Some provide processing services for us; others, including app stores and connected platforms, also process data under their own responsibilities and policies.

• Google Cloud and Firebase: backend hosting and functions, authentication, cloud databases and file storage, Firebase Cloud Messaging, app-integrity checks and configuration. These services process the account and profile data, uploaded profile images, synchronized libraries, comments, attached images and other community content, moderation records, purchase verification records, and device and notification information described under Cloud storage and push notifications. Google Analytics for Firebase and Firebase Crashlytics also process the usage and diagnostic information described above. See the Google Cloud Data Processing Addendum, Firebase privacy information and the Google Privacy Policy.
• Apple: supported sign-in, App Store purchase and subscription processing and verification, notification services, and iCloud synchronization where enabled. See the Apple Privacy Policy.
• Google Play: purchase and subscription processing and verification, distribution and beta access. Beta-registration emails are provided to Google Play to authorize testing. Google's transaction records are governed by its own policy.
• Microsoft Clarity: where enabled in the iOS app, interaction analytics, heatmaps and session replay to help understand how the interface is used. Clarity may receive device, session and interaction information and a custom user identifier, which can be your Sofa Time username. This means interaction data can be linked to your profile. See the Microsoft Privacy Statement.
• DigitalOcean: website hosting, including processing of visitor requests, server logs and information submitted through hosted features. See DigitalOcean's data processing information.
• TMDB: film and TV metadata, artwork and related availability information. Requests include the title or search information needed for the feature. Direct requests and image downloads may expose technical information such as your IP address. See the TMDB Privacy Policy.
• Trakt, SIMKL, MDBList and WeTrakr: when you connect or use their supported features, the account authorization and tracking, rating, list or profile information needed for those features. See Trakt's Privacy Policy, SIMKL's Privacy Policy, and the policies available from MDBList and WeTrakr.
• Translation services: supported comment translation may process the comment text and language information using Google's translation service or Apple translation features, depending on the app version and feature. Do not place confidential information in public comments.

Authorized support personnel and the communication services used to handle your messages may process the information you send us. We may also disclose relevant information where legally required or necessary to establish, exercise or defend legal claims, with appropriate limits. Public content is shared as described in What others can see.

Where information is processed

Our providers may process information outside your country, including outside the European Economic Area. Where the GDPR applies, transfers must rely on an applicable adequacy decision or appropriate safeguards, such as European Commission Standard Contractual Clauses. A provider's participation in the EU–US Data Privacy Framework may support an eligible transfer covered by that certification. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

How long we keep it

• Account, library and community information: for as long as needed to provide the features you use, until you delete the relevant information or request account deletion, subject to legal retention and the handling of public contributions.
• Reports and moderation records: according to the necessity criteria described under Reports and moderation records, with access limited to the relevant purposes. A publishing ban does not authorize unrestricted or indefinite retention of your personal information.
• Purchase and subscription records: while needed to verify and restore entitlements, manage renewals and refunds, prevent duplicate or fraudulent claims, or meet legal record-keeping requirements. Erasing your viewing library is different from deleting purchase records.
• Support, beta and technical records: while needed to resolve the request, manage testing, investigate faults or protect the Services; the criteria include the status of the request, security needs and any applicable limitation or legal-retention period.
• Provider diagnostics and backups: according to the applicable service configuration and deletion cycle. Restricted backup copies may remain until overwritten. Records retained for legal obligations or claims are limited to that purpose.

Apple and Google may retain transaction information independently under their own policies. We can provide further information about retention for a particular category on request.

Your rights and choices

Where applicable, you can request access, correction, erasure, restriction, portability of data processed by automated means on the basis of consent or a contract, and object to processing based on legitimate interests. You can withdraw consent without affecting the lawfulness of processing before withdrawal.

To exercise your rights, email [email protected]. We may request proportionate information to verify your identity. Under the GDPR, we normally respond within one month; if a lawful extension is necessary because of the complexity or number of requests, we will explain it within that month.

You may complain to your local data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD). You do not need to contact us first to exercise that right.

Deleting your account

Use the account-deletion option available in the app settings or email us if you cannot access it. Account deletion and erasing a local library are different actions. We will remove the personal information associated with your account as required by law, subject to the limited retention described above. Contact us if your request also concerns public contributions.

Disconnecting a tracking service stops the associated connection; it does not necessarily delete information already synchronized to that service. Deleting your Sofa Time account does not delete your Apple, Google, Trakt, SIMKL, MDBList or WeTrakr account. For records held independently by those services, use their own deletion or privacy-request process.

Deleting your account or uninstalling Sofa Time does not cancel an App Store or Google Play subscription. Cancel renewal in the store where you subscribed to prevent future charges. Instructions are provided in our Terms of Use.

Security and age requirements

We use technical and organizational measures intended to protect information, including secure connections and controls appropriate to the processing involved. No online service can guarantee absolute security. Keep your credentials secure and contact us if you suspect a privacy or security problem.

Sofa Time is not intended for children under 13. Higher consent ages or parental-authorization requirements may apply locally; in Spain, processing based on a child's own consent generally requires that they be at least 14. If you believe a child has provided information without the required authorization, contact us so we can investigate and take appropriate action.

Updates and contact

We will update the date on this page when this policy changes and communicate material changes through the Services or another appropriate channel. A new policy does not replace consent where consent is legally required.

For questions or privacy requests, contact [email protected].