Privacy policy
Last updated: 30 September 2026
This policy explains what personal data the Spoily mobile app (“Spoily”, “we”) collects, why we collect it, who helps us process it, and the choices you have. In short: we only collect what the app needs to work, we don’t show ads, we don’t sell your data, and you can delete your account and everything in it from inside the app at any time.
Who is responsible for your data: Spoily is operated by Tom Paul Bouchard, entrepreneur individuel (micro-entreprise) based in France. For any privacy question or request, email [email protected].
1. What we collect
Information you give us
- Account details: username, email address and password. Your password is never stored in readable form; we store only a salted, one-way hash of it.
- Profile: optional display name, bio and profile photo.
- Your activity: shows in your watchlist and their status, episodes you mark as watched, ratings, reviews, comments, likes, lists, and the people you follow.
- Safety actions: the users you block, and the reports you send about content or users (what you reported, the reason you picked and your user ID).
Information collected automatically
- Server logs: when the app talks to our servers we log technical information such as your IP address, the time and the endpoint requested. We use it to keep the service running, to prevent abuse (for example rate-limiting repeated login attempts) and to fix errors. We never log your password or your sign-in token.
Information stored only on your device
- Your sign-in token, kept in your phone’s secure storage (iOS Keychain / Android Keystore).
- Your region and language preferences.
What we don’t collect
No advertising identifiers, no location, no contacts, no analytics or tracking SDKs, and no payment data. To choose a profile photo, the app opens your phone’s system photo picker: Spoily never gets access to your photo library, only to the single picture you pick, which it resizes and uploads.
2. Why we use it
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and securing your account | Account details | Performance of our contract with you |
| Providing the app’s features (tracking, reviews, lists, following, feed) | Profile, your activity | Performance of our contract with you |
| Keeping the service secure and working, preventing abuse | Server logs | Our legitimate interest in running a safe service |
| Moderating the community: reviewing reports, removing content that breaks our terms, applying blocks | Reports, blocks, the reported content | Performance of our contract with you / our legitimate interest in a safe community |
| Answering your requests | Email and what you send us | Performance of our contract / legal obligation |
We do not use your data for advertising, we do not sell or rent it, and we do not make automated decisions about you that have legal or similarly significant effects.
3. What other people can see
Spoily is a social app. The following are public to other users: your username, display name, bio and profile photo; your reviews, ratings in reviews, comments and likes; your public lists; who you follow and who follows you; and summary counts on your profile (such as shows watched). People who follow you also see your recent activity in their feed (shows you add or update, reviews you post, episodes you watch).
Your email address is never shown to other users. Lists you mark as private are only visible to you. Reports are seen only by the Spoily team: the person you report is never told who reported them, and the people you block are not notified.
4. Who processes your data
We use a small number of service providers who process data on our behalf, under contracts that require them to protect it:
- Supabase — database and file storage (account, activity and profile photos).
- Railway — hosting of the Spoily API servers (and their logs).
- Resend — sending emails: password-reset codes to you, and new-report notifications to the Spoily team.
The app also loads content directly from third parties, which will see your device’s IP address when it does so:
- The Movie Database (TMDB) — show information and images (posters, backdrops, cast photos). Our servers request show data on your behalf; images are downloaded by your device from TMDB’s image servers.
- News publishers — the Articles section shows headlines from publisher feeds (currently TVLine, Collider and Screen Rant). Article images load from the publishers’ servers, and “Read full article” opens their website, which has its own privacy policy.
These providers may store data outside your country, including in the United States. Where data leaves the European Economic Area, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
We may disclose information if required by law, or to protect the rights and safety of our users and of Spoily.
5. How long we keep it
- Account, profile and activity: for as long as you have an account. When you delete your account, they are deleted immediately from our live database, together with your profile photo.
- Server logs: kept for a short period for security and debugging, then deleted by our hosting provider’s log retention.
- Backups: our database provider keeps rolling backups for disaster recovery; deleted data disappears from them as they expire.
6. Your rights and choices
You can view and edit your profile, reviews and lists in the app at any time, and delete your account from inside the app. Depending on where you live (including under the GDPR in the EU/EEA and UK), you also have the right to:
- access the personal data we hold about you and get a copy of it in a portable format;
- have inaccurate data corrected;
- have your data erased;
- object to or restrict certain processing;
- lodge a complaint with your data protection authority (in France, the CNIL).
To exercise these rights, email [email protected] from the address linked to your account. We answer within one month.
7. Security
Data is encrypted in transit (HTTPS). Passwords are hashed, sign-in tokens expire, sign-in attempts are rate-limited, and access to the database is restricted to our servers. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach where the law requires it.
8. Children
Spoily is not intended for children under 15, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
9. Changes to this policy
If we change this policy, we will update the date at the top of this page. If the changes are significant, we will also let you know in the app before they take effect.
10. Contact
Questions about this policy or your data: [email protected].