Privacy policy

This policy explains what WoolenBlanket collects about you, why, and what you can do about it. It covers the WoolenBlanket app for iPhone and Android, and this website — which sets no cookies, counts no visits and loads nothing from anybody else.

1. Who is responsible

The controller of your personal data is Julian Vene, the individual who develops WoolenBlanket. For anything about your data, write to privacy@woolenblanket.app.

2. What we collect

• Your account: your email address, your handle, your password (stored only as a one-way hash, never in a form anyone can read), a short bio if you write one, a profile picture if you add one, and your country. Every profile picture is re-encoded by us as a 256-pixel image of our own, which discards everything else the file carried — including the location a phone may have stored in it.
• If you sign in with Google or Apple: the identifier that provider gives your account, and the email address it shares with us. We do not store your name; it may be used once, to suggest a handle.
• What you do in the app: your reviews and scores, your answers to the rating questions, the films and shows in your library, the ones you have watched and the ones you want to watch, the people and the actors you follow, your likes, comments and mentions, any report you file, any feedback you send, and the streaming services you tell us you pay for.
• On your phone only: a random identifier for the installation, your answer about usage statistics, and your preferences for the theme and the tips the app shows.

3. Usage statistics, only if you agree

The first time you open the app, it asks whether it may count which screens and features get used. Saying no is one tap, exactly like saying yes, and you can change your mind at any time from the privacy settings in the app. Nothing is counted before you answer.

If you agree, the app records events such as opening the app, viewing a screen, opening a film, saving a review or adding a film to your list — with the film's identifier where there is one, the overall score of a review you save, the platform and the app version, the random installation identifier, and your account when you are signed in. It never records the text of your searches (only how long they were and how many results they found), the text of your reviews, your answers to the individual rating questions, your email, your name, your country, your IP address or your browser or device signature.

The legal basis is your consent. We keep these events for 12 months.

4. Crash reports

When something in the app breaks, it sends us a report of what broke: the kind of error, the first line of its message, where in the code it happened, which kind of screen it was on (never what was on it), the platform and the app version, and your account if you are signed in. A report carries no installation identifier and no IP address.

The legal basis is our legitimate interest in finding and fixing faults. You can object by writing to privacy@woolenblanket.app. We keep a report until 90 days after that error was last seen.

5. Server logs

Our server keeps a line for every request, to keep the service secure and to trace faults: the time, the address requested, the result, how long it took, an identifier for the request, and your account if you are signed in. It does not log your IP address, the text of your searches, the content of any request or response, or any password or token. The legal basis is our legitimate interest in running a service that works and is secure. We keep these lines for no longer than 30 days.

6. What other people can see

Profiles and reviews are public unless you make them private, and each can be made private on its own. A public review stays on the film's page even if your profile is private. Your handle, profile picture, bio, the date you joined and your counts are visible to anyone; your email address and your country are only ever shown to you.

7. Why we use your data, and on what legal basis

• To provide the service you signed up for — your account, your reviews, your lists, your follows and your suggestions: performance of a contract (Article 6(1)(b) GDPR).
• Usage statistics: your consent (Article 6(1)(a)).
• Crash reports and server logs: our legitimate interest in a service that works and is secure (Article 6(1)(f)).

8. How long we keep it

Your account and everything attached to it are kept until you ask us to delete the account (see section 11). Usage statistics, crash reports and server logs are kept for the times given above. When an account is deleted, the usage statistics already collected stay for the rest of their twelve months, detached from the account.

Creating an account with a password starts with a code we email you. Until you enter it there is no account: if you never do, the address and the password you typed (stored only as a one-way hash) are deleted within a day. The same goes for a code to reset a password.

9. Who else handles it

• Cloudflare runs our domain and our email forwarding, and stores and delivers images, including profile pictures.
• Resend sends the emails we send.
• Google and Apple, only if you choose to sign in with them. They act under their own privacy policies.
• The company hosting our database and our server, which will be named here before the app is available.

Some of them are based in the United States. Transfers there rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. We do not sell your data, and there is no advertising in WoolenBlanket.

10. Age

WoolenBlanket is for people aged 14 and over.

11. Your rights

You can ask to see the data we hold about you, to correct it, to delete it, to restrict how it is used, to receive it in a portable format, and to object to its use. You can withdraw your consent to usage statistics at any time, without affecting anything that happened before. Write to privacy@woolenblanket.app; we answer within one month. Until the app can delete an account by itself, this is also how you delete yours.

If you think we have not respected your rights, you can complain to the Garante per la protezione dei dati personali, the Italian data protection authority: garanteprivacy.it.

12. Changes to this policy

When this policy changes, the date at the top changes with it, and we say here what changed.