Privacy Policy
1. Who is responsible
The data controller is [ShortFilms legal entity name], [postal address] ("ShortFilms", "we"). You can reach our privacy team at privacy@reelmax.app.
2. What we collect
2.1 Information you give us
| Category | Details |
|---|---|
| Account | Name or display name, email address, and the sign-in provider you used (Google, Apple, Facebook, TikTok or email). We receive only the basic profile the provider shares. |
| Purchases | What you bought, when, the amount, and a transaction identifier from Apple or Stripe. We never receive or store your full card number. |
| Creator applications | Name, email, series title, a link to your trailer or episode, genre, episode count, and your pitch, plus the time of submission, your IP address and browser type. This is stored in a private store and is visible only to the ShortFilms team. |
| Support | Anything you include when you email us. |
2.2 Information collected automatically
| Category | Details |
|---|---|
| Usage | Series and episodes viewed, watch time, searches, and interactions such as likes and list additions, when you are signed in. |
| Device and connection | Device type, operating system, app version, language, IP address, approximate location derived from IP (country or region), and crash and performance data. |
| Server logs | Our hosting provider, Vercel, records standard request logs, including IP address, URL, and timestamp, for security and operations. |
3. Data that stays on your device
A large part of ShortFilms works without an account. When you are not signed in, your watch history, My List, likes, language preference, coin balance, unlocked episodes and cookie choice are stored only in your browser's or app's local storage on your device. We cannot see them, they do not sync between devices, and clearing your browser data or deleting the app removes them. When you sign in, we may sync these to your account so they follow you across devices.
4. How we use data
- To provide the Service: stream content, remember where you left off, keep your list, process purchases and unlocks, and honour your VIP subscription.
- To run the creators programme: review submissions, contact you about them, and manage any resulting agreement.
- To improve ShortFilms: understand which content people watch and where they drop off, fix bugs, and plan features. We use aggregated and de-identified data for this wherever possible.
- To communicate: transactional messages such as receipts, renewal reminders and security notices, and, if you opt in, news about new series. You can opt out of marketing at any time.
- To keep the Service safe: detect fraud, abuse, bots and account sharing, and enforce our Terms.
- To comply with law: tax, accounting, and responding to lawful requests.
We do not use your data for automated decisions that have legal or similarly significant effects on you.
5. Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Service and processing purchases); legitimate interests (improving and securing the Service, evaluating creator submissions, and communicating with you about your account), balanced against your rights; consent (marketing emails and non-essential cookies), which you can withdraw at any time; and legal obligation (tax and records).
6. Who we share data with
We do not sell your personal data and we do not share it with advertisers. We share it only with:
- Service providers who process data for us under contract: Vercel (hosting, serverless functions and file storage), Stripe (web payments), Apple (app distribution and in-app purchases), sign-in providers (Google, Apple, Facebook, TikTok), and email delivery providers for transactional email.
- Creators and partners, in aggregated form only, such as view counts and retention for their series. We do not give creators your identity.
- Authorities when required by law, court order, or to protect the rights, safety or property of ShortFilms, our users or others.
- A successor if ShortFilms is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.
7. Cookies and similar technologies
Our website uses local storage and a small number of cookies for essential purposes: keeping you signed in, remembering your preferences and cookie choice, and protecting against fraud. The banner you see on first visit records your choice. We do not currently use advertising cookies or third-party tracking pixels. Fonts are loaded from Google Fonts and poster artwork from our own storage; those requests share your IP address with the provider as any web request does. You can block or clear cookies and local storage in your browser settings, but some features will stop working.
8. How long we keep data
- Account data: for as long as your account exists, then deleted within 30 days of a deletion request, except where we must keep it longer (see below).
- Purchase records: 7 years, for tax and accounting.
- Creator applications: 24 months from submission, or longer if it leads to an agreement, so we can consider resubmissions and honour our commitments.
- Server logs: up to 90 days.
- Support emails: 24 months after the last message.
9. Your rights and choices
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent. To exercise any of these, email privacy@reelmax.app from the address on your account. We will respond within 30 days, or sooner where the law requires, and may ask you to verify your identity. You also have the right to complain to your local data protection authority.
Deleting your account: go to Me › Account › Delete account, or email us. Deletion removes your profile, list, history and unspent coins; it does not refund coins or subscriptions. Purchase records are retained as described above.
Marketing: every marketing email has an unsubscribe link. Transactional messages continue while you have an account.
10. International transfers
ShortFilms is operated from [country] and our providers store data primarily in the United States. If you are in the EEA, UK or Switzerland, transfers of your data outside those areas are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard, and by our providers' own certifications. Contact us for a copy of the relevant safeguards.
11. Security
We protect data with encryption in transit (TLS), private storage for application data, access limited to people who need it, and secure payment processors so card details never touch our servers. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires.
12. Children
ShortFilms is for adults 18 and over and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
13. California residents
Under the CCPA/CPRA you have the rights described in Section 9, plus the right to know the categories of personal information we collect (identifiers, commercial information, internet activity, and inferences about your viewing preferences, as set out in Section 2), the right to non-discrimination for exercising your rights, and the right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined in California law, and we have not done so in the preceding 12 months. You may designate an authorised agent to make requests on your behalf.
14. Changes to this policy
We will update this policy as the Service changes. For material changes we will notify you in the app or by email before they take effect. The date at the top shows when it was last revised.
15. Contact
[ShortFilms legal entity name]
[Postal address]
Privacy requests: privacy@reelmax.app
General support: support@reelmax.app