Privacy Policy

We collect only what we need to run the service:

• Account data. When you create an account, we store your email address and an authentication credential. If you register with email and password, the password is stored only as a salted hash by our authentication provider — we never see it. If you sign in with Google, we receive your email address and basic Google profile information.
• Watchlist & preferences. The titles, actors, and platforms you save, along with your notification and display settings.
• Notifications. If you enable browser push notifications, we store the push subscription your browser generates so we can deliver alerts. You can revoke it at any time.
• Newsletter. If you subscribe, we store your email address to send the digest. Every email includes a one-click unsubscribe link.
• Region.If you accept the cookie banner, we determine your country by sending your IP address to a third-party geolocation provider (ipapi.co), so we can show accurate “where to watch” availability. We store only the resulting country code — not your IP address. You can also add travel countries yourself.
• Profile and social features. If you use the social features, we store your chosen username, display name, and avatar image, your friend connections, the titles you mark as watched, and any title suggestions you send to friends.
• Comments. Comments you post, together with the display name shown next to them.
• Messages you send us. If you use the contact or suggestion form, we store the name, email address, and message you provide so we can respond.
• Calendar feed.If you subscribe to your personal calendar feed, we generate a secret token embedded in the feed URL that authenticates your calendar app’s requests. Treat that URL as private.
• Analytics & technical data. We use Umami (Umami Cloud), a privacy-friendly, cookieless analytics service, to understand aggregate usage. It does not track you across other websites. For signed-in users, we attach your account identifier to your analytics session only after you accept the cookie banner. We also keep standard server logs needed to operate and secure the site.

Under the EU General Data Protection Regulation (GDPR), we rely on these legal bases:

• Performance of a contract — to create and operate your account, store your watchlist, and provide the features you ask for.
• Consent — for push notifications, the newsletter, region detection, and any non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — to keep the service secure, prevent abuse, and understand aggregate usage so we can improve StreamCal, balanced against your rights.

We use a small number of cookies and local-storage entries:

• Essential — authentication session cookies that keep you signed in, and a record of your cookie choice.
• Region — a cookie that remembers your detected country (only set if you accept the banner).
• Analytics — Umami, a cookieless, privacy-friendly analytics service that does not track you across other websites.

You can clear cookies and local storage in your browser at any time. Declining the cookie banner means we fall back to a default region and do not attach your identity to analytics.

We share data only with service providers (sub-processors) that help us run StreamCal, under agreements that require them to protect it:

• Supabase — database and authentication.
• Netlify — website hosting and delivery.
• Resend — transactional and newsletter email.
• Umami (Umami Cloud) — cookieless usage analytics.
• Google — if you choose to sign in with Google.
• Push delivery services — the push service operated by your browser/device vendor (e.g. Google, Mozilla, Apple) delivers the notifications you opt into.
• ipapi.co — receives your IP address to perform the one-time country lookup when you accept region detection.

We may also disclose data if required by law. We do not sell your personal data or share it for advertising.

Some data you create is intentionally not private, so others can use the social features:

• Public — your profile (username, display name, avatar) and the comments you post are visible to anyone who can view the relevant page.
• Friends — people you accept as friends can see your watchlist and the titles you have marked as watched.

Avoid putting sensitive information in your username, display name, or comments. You can delete your comments and end friend connections at any time.

StreamCal aggregates release dates, availability, ratings, and industry news from third-party sources (including TMDB, OMDB, streaming-availability providers, and box-office data). This is information about titles, not about you, and is used to populate the calendar. See our Disclaimer for how to treat that information.

Some of our providers process data outside the European Economic Area. Where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

We keep account and watchlist data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain limited records to comply with legal obligations. Analytics data is kept in aggregate form.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these, email legal@streamcal.app. You can turn off notifications in your settings and unsubscribe from emails directly. You also have the right to lodge a complaint with your local supervisory authority — in Greece, the Hellenic Data Protection Authority (HDPA).

StreamCal is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We use reputable providers and reasonable technical measures to protect your data, but no online service can be completely secure. Keep your password confidential and contact us if you suspect unauthorized access to your account.

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.

Questions about your data or this policy? Email legal@streamcal.app. For general support, use info@streamcal.app.