Privacy Policy

1. Controller and contact

The controller is Kucsma Norbert (WatchNGo), Hungary. For any privacy question, or to exercise your rights, contact support@watchngoapp.com.

2. Scope

This policy covers the WatchNGo app and the pages on watchngoapp.com. It does not cover third-party services that act as their own controllers; those are listed in section 6.

3. What data we process

• Account data — email address, display name, username, Firebase user ID, the sign-in provider you use (Apple, Google, or email and password), and the authentication state needed to keep you signed in.
• Profile and community data — profile image, cover image reference, private-profile setting, follows and follow requests, blocks, comments, replies, likes, reactions, reports you submit, and the notifications generated by these actions.
• Library and activity data — your watchlist, watched and in-progress titles, episode progress, favorites, ratings, custom lists, favorite actors, and activity timestamps. When cloud sync is enabled this is linked to your account.
• Private content — personal notes, actor ratings, and selected actor images, stored only if you use cloud backup. These are never shown to other users.
• Device-local settings — app language, appearance and notification preferences, local cache, and the age and optional gender preference you enter during onboarding. Based on our source review these values stay on your device and are not uploaded.
• Search terms — titles and keywords you search are sent to the media and GIF providers in section 6 only to return the results you ask for.
• Technical and log data — when the app or website contacts our providers, those providers process your IP address, request time, and basic request metadata to deliver and secure the service.

4. Data handled by the embedded Google Sign-In SDK

The app bundles Google’s Sign-In SDK so you can sign in with Google. Its own privacy manifest declares that it may process the following, linked to you, for its functionality and for Google’s analytics, and it declares no cross-app or cross-site tracking:

• phone number
• coarse location
• device identifier
• other usage data and other data types
• user ID (for analytics in addition to functionality)

We do not use this data ourselves, and WatchNGo performs no advertising tracking. Google’s processing is governed by the Google Privacy Policy.

5. Purposes and legal bases

• Creating and operating your account, cloud sync, and the features you use — performance of a contract (GDPR Art. 6(1)(b)).
• Community features such as profiles, follows, comments, and reactions — performance of a contract for features you enable, and our legitimate interest (Art. 6(1)(f)) in running a functioning community.
• Safety, moderation, abuse and fraud prevention, and enforcing our Terms — legitimate interests (Art. 6(1)(f)).
• Optional photo-library access — consent (Art. 6(1)(a)) given through the iOS permission prompt, which you can withdraw in iOS Settings.
• Sending account emails such as verification and password reset — performance of a contract.
• Complying with legal obligations and responding to lawful requests — legal obligation (Art. 6(1)(c)).

6. Recipients and sub-processors

• Google Firebase (Authentication, Cloud Firestore, Cloud Functions) — account management, data storage, and server functions. Firebase Authentication operates from the United States; other Firebase services may use global infrastructure.
• Apple and Google — when you choose Sign in with Apple or Sign in with Google.
• Resend — delivery of transactional account emails (verification and password reset) sent from our Cloud Function.
• TMDB — movie, TV, season, episode, actor, and image data.
• JustWatch, through TMDB — streaming availability information.
• OMDb — selected ratings.
• GIPHY — GIF search results.

Each provider processes the requests it receives under its own privacy terms. We do not sell personal data, and we do not share it for advertising.

7. International transfers

Some providers process data outside your country, including in the United States. Where this happens we rely on the European Commission’s Standard Contractual Clauses or an applicable adequacy decision. Contact us for more information.

8. Retention

Account-linked data is kept while your account exists. After account deletion it is removed from the live database; residual copies in encrypted backups are overwritten on the provider’s normal backup cycle.

Moderation and safety records, such as reports and blocks, may be kept for a limited period where necessary to protect the community or to comply with the law. Device-local data is kept until you clear it in the app or remove the app. Server request logs held by our providers follow those providers’ retention schedules.

9. Your rights

Subject to the conditions in the GDPR, you have the right to access your data, have it corrected or erased, restrict processing, receive it in a portable format, object to processing based on legitimate interests, and withdraw consent at any time without affecting processing already carried out.

To exercise any of these, email support@watchngoapp.com from the address linked to your account; we may ask you to verify your identity. You can delete your entire account in the app under Settings → Account.

You also have the right to lodge a complaint with a data protection supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary (https://naih.hu).

10. Children

WatchNGo is not directed to children under 13, and we do not knowingly process their personal data. If you believe a child under 13 has provided us with personal data, contact us and we will delete it.

11. Security

We use reputable infrastructure providers, encrypted transport (HTTPS/TLS), authentication-scoped database rules, and least-privilege server functions, and we review those rules and dependencies before each release. No method of transmission or storage is completely secure, but we work to protect your data.

12. This website

The watchngoapp.com pages show no advertising, set no advertising cookies, and run no third-party or first-party analytics. Your browser’s local storage is used only to remember your language choice. Our hosting provider, Google Firebase Hosting, processes standard request information such as IP address and user agent to serve the pages securely.

If you use the “suggest a badge” form, we process the text you submit and, if you provide it, your email address, together with your IP address, browser user agent, and a timestamp. We use this to review and act on your suggestion, to reply to you where you asked us to, and to prevent spam and abuse. The legal basis is our legitimate interest in improving WatchNGo and keeping the form usable (Art. 6(1)(f) GDPR); providing an email address for a reply is optional and based on your consent (Art. 6(1)(a)). Submissions are stored with Google Firebase and the notification email is delivered through Resend (both listed in section 6). We keep a submission only as long as it is useful for product planning, then delete it.

13. Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects. Recommendations and statistics in the app are generated from your own library activity to help you, not to evaluate you.

14. Changes

We may update this policy. Material changes will be posted here with a new effective date and, where appropriate, announced in the app. The current version is always available at watchngoapp.com/privacy.