Introduction

Your privacy is important to us. This Privacy Policy describes how PopcornCrew collects, uses, and protects your personal information when you use our platform, from the website or apps.

Data Controller

The data controller is Davide Bortoloni, located at via Belfiore, 20, 10042, Nichelino (TO), VAT 13496410963.

Website: davidebortoloni.com

Data We Collect

Data provided directly

First and last name
Email address
Username
Password (encrypted)
Profile photo and cover image, if you choose to upload them
Country, language, and streaming services you declare to use
Notification preferences
Lists of movies and series, titles and episodes marked as watched, ratings, reviews, comments, and photos attached to comments
Searches you make on the platform and the title you open from the results
Reason for account deletion, if you choose to indicate it (optional)

Data collected automatically

IP Address: used for technical and security purposes (abuse detection, session management). For statistical purposes, the IP is never stored in clear text: it is converted into a non-reversible code (hash) using a server secret key.
Country of origin: derived from the IP address at the time of the visit (only the two-letter country code, no precise geolocation).
Device and browser information: user agent, type of device (mobile, tablet, desktop), referrer of the previous page.
Navigation data: URLs of visited pages, name of the internal route, session identifier (hashed), date and time of the visit, server response time.
Push notifications: if you use the app and enable notifications, a device identifier necessary to deliver them.
Essential technical cookies (see dedicated section).

How We Use Your Data

Provide and improve our services
Personalize your experience, including recommendations on what to watch
Send notifications and important communications
Moderate user-published content and translate it into the reader's language
Analyze platform usage in an aggregated and pseudonymous form
Prevent fraud and ensure security
Comply with legal obligations
Understand why people leave the platform, to improve the service

Legal Basis for Processing

The processing of your personal data is based on the following legal bases provided by the General Data Protection Regulation (GDPR):

Performance of the contract

The processing of data for account management, provision, and improvement of our services is necessary for the performance of the service contract you accepted by using the platform.

Consent

Processing for sending promotional and marketing communications and for push notifications is based on your consent, which can be revoked at any time from your account or device settings.

Legitimate interest

Processing to personalize your experience, analyze platform usage in an aggregated and pseudonymous form (through our internal analytics tools), moderate published content, prevent fraud and ensure security, and understand why people decide to leave the platform is based on our legitimate interest to improve services and protect the platform and its users. Usage analysis is conducted exclusively with our own tools, without profiling cookies and without involving third-party companies.

Legal obligation

Processing to comply with legal, fiscal, or administrative obligations is necessary to fulfill obligations provided by law.

Data Sharing

We do not sell your personal data. Your data is processed or may be shared only in the following circumstances:

Technical service providers

Your data is processed by technical service providers necessary for the operation of the platform, who act as data processors on our behalf and process the data only to provide us with their service.

The providers we use include:

netcup GmbH (Germany): server hosting the platform, database, and title search engine. The server is located in the European Union (Vienna, Austria).
Cloudflare: network that protects the site from attacks and speeds up loading. All traffic to the platform, including your IP address, passes through its network. We also store backup copies of the database on Cloudflare R2, in a storage located in the European Union.
Hostinger: service for domain and email management. Data is processed within the EU.
OpenAI: analyzes the texts you publish (reviews, comments, usernames) for automatic moderation and to flag spoilers, and translates them into the reader's language. Only the text is received, not your account data.
Google Firebase Cloud Messaging: delivers push notifications on the app, if you have enabled them.

Third-party services you use from the platform

Sign in with Google or Apple: if you choose to sign in with your Google or Apple account, we receive your name and email address from them.
GIPHY: when you search for or view a GIF in comments, your device loads it directly from GIPHY's servers, which receive your IP address.
Telegram: if you link your account to our bot or group, Telegram communicates your Telegram ID to us.

APIs and external services for content

We use the API of The Movie Database (TMDB) to provide information on movies and multimedia content. The use of TMDB's API is in accordance with their terms of service and does not involve sharing users' personal data with TMDB. Movie data is retrieved only when necessary to provide the service.

To derive the country of origin from the IP address, we use a local database provided by MaxMind (GeoLite2): the lookup is entirely performed on our servers, the IP address is never transmitted to MaxMind.

Transfers outside the European Union

Some of the providers listed above (Cloudflare, OpenAI, Google, GIPHY) are based in the United States or may process data outside the European Union. In these cases, the transfer is based on the guarantees provided by the GDPR: the EU-US Data Privacy Framework adequacy decision for companies that adhere to it and, in other cases, the standard contractual clauses approved by the European Commission.

Other circumstances

When required by law or to protect our rights
In case of merger, acquisition, or sale of assets
With your explicit consent

Data Security

We implement technical and organizational security measures to protect your personal data, including encryption of connections, access controls, firewalls, and continuous monitoring. Passwords are always encrypted using secure algorithms. IP addresses used for statistical purposes are hashed with a secret key, so they cannot be traced back to the original user. Photos you attach to comments are re-encoded and stripped of metadata (such as the location where they were taken).

Retention Period

We retain your personal data only for as long as necessary for the purposes for which they were collected, in compliance with the principles of minimization and storage limitation provided by the GDPR:

Account data: Username, first name, last name, password, lists, and content you have published are retained until your account is deleted, except as indicated in the following point. You can request deletion at any time from your account settings.
Account deletion: When you delete your account, it is first deactivated for 30 days: it disappears from all public parts of the platform, but your data remains intact, and if you return within that period, you will find everything as it was. After 30 days, the account and its contents are permanently deleted. From the time of the request, we retain essential identifying data (name, username, email address), the date, and any reason you chose to indicate, for 90 days for security, abuse prevention, and service improvement purposes. After this period, identifying data is automatically deleted, leaving only the indicated reason, any comment (which we encourage you not to fill with personal data), and statistical information, no longer traceable to you.
Email address: Retained up to 2 years after the last activity on the platform or until account deletion, if earlier.
Notification preferences: Retained until account deletion or until preferences are changed.
Detailed visit data (analytics): Raw data relating to individual visits (URL, route, user agent, hashed IP, country, device, timestamp) is retained for a maximum of 90 days from collection, after which it is automatically deleted.
Searches: The text of searches and the title opened from the results are retained for 90 days to improve search quality, and then automatically deleted.
Anonymous aggregated data: Statistical data aggregated by day and by route (e.g., total number of visits to a page on a given day) does not contain any personal identifiers and may be retained indefinitely for historical analysis purposes.
System and security logs: Technical logs necessary for diagnostics, security, and abuse prevention are retained for a maximum period of 12 months, unless legal obligations require longer retention. Reports of technical errors encountered during platform use are deleted 90 days after the last occurrence.
Backup copies: Backup copies of the database are retained for 7 days and then overwritten. A deleted data from the platform may therefore remain in these copies for up to 7 days.
Cookies: The cookie that maintains access to your account lasts up to 12 months or until you log out; other persistent cookies may remain for up to 12 months or until manually deleted.
Data for legal obligations: Data necessary to fulfill legal, fiscal, or administrative obligations is retained for the period required by applicable law (generally up to 10 years for fiscal obligations).

At the end of the retention period, data is securely and permanently deleted, unless retention is still necessary to comply with legal obligations or for the exercise or defense of legal claims.

Cookies and Similar Technologies

We use only essential technical cookies, necessary for the platform's operation: we do not use profiling cookies or third-party advertising cookies. Therefore, we do not ask for any cookie consent: if we introduce non-essential cookies in the future, we will ask for your consent before installing them and update this notice.

Essential Technical Cookies (No Consent Required)

Session cookies: recognize you during navigation and maintain access to your account.
Security cookies: protect forms from forged requests; Cloudflare may set its own to distinguish visitors from automated attacks.
Preference cookies: store your settings (e.g., dark/light theme).

Fonts

Some fonts on the site are loaded from Bunny Fonts (BunnyWay d.o.o., Slovenia), a European service that declares not to use cookies and not to record visitors' IP addresses.

Usage Analysis (Internal Analytics, No Cookies)

To understand which pages are most visited, we record some visit information on our servers (URL, internal route, user agent, device type, country derived from IP, and a hashed, non-reversible version of the IP). This tracking occurs entirely on our servers, without profiling cookies and without third-party tools, based on legitimate interest: for this specific analysis, consent is not required.

Your Rights (GDPR)

You have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request the deletion of your data
Restriction: Restrict the processing of your data
Portability: Receive your data in a structured format
Objection: Object to the processing of your data, including internal statistical tracking
Complaint: Lodge a complaint with the Data Protection Authority (garanteprivacy.it)

Contact

To exercise your rights or for any privacy-related questions, you can contact us via:

Email: [email protected]

Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy. Significant changes will be communicated via email or notification in the application. We encourage you to periodically review this page to stay informed.