Privacy Policy

CineSprout — operated by RefineSpark Studio
Effective date: 19 October 2026 · Last updated: 19 October 2026

This Privacy Policy explains what information the CineSprout mobile application for iOS and Android (the “Application”) collects, how we use it, and the choices you have. CineSprout is operated by RefineSpark Studio (“we”, “us”, “our”).

1. Scope

This policy applies to the CineSprout mobile application and the related services we operate to support it (the “Service”). It does not apply to TMDB, Apple, Google, or any other third-party service you use. Those services have their own privacy policies, linked in section 6.

2. Who we are

The data controller for the Service is RefineSpark Studio, which operates CineSprout.

Contact: admin@refinesparkstudio.com

3. Information we collect

3.1 Anonymous app identity

When you first use CineSprout, we create an anonymous account through our authentication provider, Supabase. This identity consists of a random identifier. It is not linked to your name, email address, phone number, or any other account.

We store:

• the anonymous user identifier;
• the date the identity was created;
• the status of the account (anonymous);
• a session token, kept in your device’s encrypted secure storage (iOS Keychain or Android Keystore-backed storage), which other apps cannot read.

We do not ask for or store a password, email address, or display name.

3.2 Preferences

We store a small set of preferences needed to run the app:

• language and region, which we send to TMDB so titles, descriptions, and availability match your locale;
• theme (system, light, or dark);
• colour source (whether the app follows your device’s accent colour), stored only on your device;
• an adult-content preference, disabled by default.

Theme and colour-source settings are stored on your device. Language, region, and the adult-content preference are stored in our database.

3.3 Optional TMDB connection

CineSprout works without a TMDB account. If you choose Connect TMDB, you are taken to TMDB’s own website to sign in and approve the connection. The in-app flow does not ask for or store your TMDB password.

When you approve the connection, we store:

• your TMDB account identifier;
• your TMDB username;
• the path to your TMDB avatar;
• when the connection was made or disconnected;
• an encrypted TMDB session token, which we use to read and update your lists on your behalf. The token is encrypted with AES-256-GCM and kept in a private database schema.

If you start a connection but do not finish it, we store a short-lived TMDB request token until it expires or is replaced.

3.4 Your TMDB lists

Your watchlist, favourites, and ratings are stored by TMDB, not by CineSprout. When you are connected, CineSprout reads them from TMDB and sends your changes (adding or removing a title, rating a title) to TMDB. Those lists are governed by TMDB’s terms and privacy policy. Deleting your CineSprout account does not delete your TMDB account or your lists on TMDB.

3.5 Search and browsing

When you search or browse, your query, the title you opened, and your language and region are sent through our catalogue service to TMDB so the result can be returned. CineSprout does not maintain a search history on its servers. Search results may be cached on your device for up to 24 hours.

3.6 Technical and security information

Our infrastructure providers may process technical information such as your IP address, request timestamps, app version, platform (iOS or Android), and error or rate-limit information. They use this to deliver requests, protect the Service, prevent abuse, and enforce rate limits. We do not use this information for advertising or to build a profile of you.

3.7 Information stored on your device

CineSprout stores some data locally:

• your session token, in encrypted secure storage;
• your theme and colour-source preferences, in the app’s local database;
• cached catalogue and account responses, for up to 24 hours;
• poster images and other artwork, in an image cache.

You can clear the image cache in Profile → Clear image cache. Uninstalling the app removes its local database and caches. Some secure-storage entries may persist at the operating-system level, depending on the platform. Local data is not sent to us.

3.8 What we do not collect

Through the Application, we do not collect or request:

• your name, email address, phone number, or postal address;
• precise or approximate location;
• contacts, calendar, photos, camera, or microphone data;
• health, biometric, or financial information;
• advertising identifiers or cross-app tracking data;
• passwords for CineSprout (there are none) or for TMDB (the in-app connection flow never asks for one).

CineSprout does not use third-party analytics, crash-reporting, advertising, or attribution SDKs.

4. Summary of data we handle

5. How we use information and our legal bases

We use the information described above to:

• create and maintain your anonymous identity and sign you in;
• remember your language, region, and appearance settings;
• fetch catalogue data and search results from TMDB;
• connect to TMDB and read or update your lists when you ask us to;
• keep the Service secure, prevent abuse, and enforce rate limits;
• comply with legal obligations and respond to lawful requests.

Where the GDPR or UK GDPR applies, our legal bases are:

• performance of a contract — providing the Service you ask for;
• legitimate interests — keeping the Service secure and preventing abuse, in a way that does not override your rights;
• consent — connecting your TMDB account, and any other processing for which we ask your permission. You can withdraw consent at any time;
• legal obligation — where we must retain or disclose information by law.

We do not use automated decision-making that produces legal or similarly significant effects.

6. When we share information

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We share it only:

• with the service providers listed in section 7, as needed to run the Service;
• when required by law, such as in response to a valid subpoena or court order;
• when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to a lawful government request;
• with professional advisers, in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections;
• with your direction or consent.

7. Third-party services

CineSprout relies on these providers:

When CineSprout loads posters and artwork, your device contacts TMDB’s image servers directly, so TMDB receives your IP address and request information. When you open TMDB’s website to connect your account, TMDB’s own privacy policy applies. When the app checks for updates, Expo receives technical information about the app and your device.

We do not control these providers’ privacy practices. Please review their policies.

8. Cookies and tracking technologies

The Application does not use cookies, pixels, advertising identifiers, or cross-app tracking technologies. The web version of this policy, if hosted, does not set advertising cookies.

We do not respond to “Do Not Track” signals because we do not track you across third-party websites or apps. We do not use Global Privacy Control signals for the same reason.

9. International transfers

We and our service providers may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, adequacy decisions, or your consent. Data protection laws in those countries may differ from those in your jurisdiction.

10. Retention

• Anonymous identity and preferences: kept until you delete your account. We may also delete anonymous identities that appear abandoned after a cleanup period of 90 days. Cleanup runs periodically; until it runs, data may be retained longer. Before deleting an identity, we revoke any linked TMDB session.
• TMDB link and encrypted session: kept while the link is active. When you disconnect, we revoke the TMDB session and clear the stored credential. When you delete your account, we revoke the session first, then delete the link.
• Pending TMDB request tokens: short-lived; they expire and are removed automatically.
• Local caches: up to 24 hours, or until you clear the image cache or uninstall the app.
• Provider logs and security records: kept by our providers for their own limited periods, as described in their policies.
• Legal holds: we may retain information longer where required by law or to establish, exercise, or defend legal claims.

11. Security

We use HTTPS/TLS for data in transit, row-level security to restrict database access to your own rows, AES-256-GCM encryption for the stored TMDB session token, and the device’s secure storage for your session token. Our database provider encrypts data at rest. Access to private data is limited to the server functions that need it.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

12. Your rights (EEA, UK, and similar jurisdictions)

If you are in the EEA, the UK, or another jurisdiction with similar laws, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• restrict or object to processing;
• data portability;
• withdraw consent where processing is based on consent;
• complain to your local data protection authority.

To exercise these rights, use Profile → Delete account in the app or contact us at admin@refinesparkstudio.com. Because CineSprout identities are anonymous, we may not be able to locate your data from your email address alone; the in-app control is the most reliable way to act on your account. We will respond within the time required by applicable law.

13. California and other US state privacy rights

If you are a California resident, you have the right to:

• know what personal information we collect, use, and disclose;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit the use of sensitive personal information;
• not be discriminated against for exercising your rights.

We do not sell personal information, share it for cross-context behavioural advertising, or collect sensitive personal information as those terms are defined by the CCPA/CPRA. We do not disclose personal information to third parties for their direct marketing purposes. We do not offer financial incentives in exchange for personal information.

Residents of other US states with comprehensive privacy laws (for example, Colorado, Connecticut, Virginia, Utah, and Texas) have similar rights, including the right to access, correct, delete, and obtain a copy of their data, and to appeal a denial of a request. To exercise any of these rights, use the in-app deletion control or contact us at admin@refinesparkstudio.com. We may need to verify your request; because identities are anonymous, we will explain what is needed.

You may use an authorised agent to submit a request on your behalf, subject to verification.

14. Deleting your account and data

You can delete your CineSprout identity at any time:

1. Open Profile.
2. Tap Delete account.
3. Confirm.

This revokes any connected TMDB session, deletes your TMDB link, and deletes your anonymous identity and preferences from our database. It does not delete your TMDB account, your watchlist, your favourites, or your ratings on TMDB. To delete those, use TMDB’s own account controls.

You can also request deletion by emailing admin@refinesparkstudio.com. Because the identity is anonymous, the in-app control is the fastest and most reliable method.

If you uninstall the app without deleting your account, the session token is removed from your device and the identity becomes unreachable from that installation. The anonymous identity may remain on our servers until routine cleanup removes it, or until you ask us to delete it. If your identity was connected to TMDB, the stored session may remain until cleanup or deletion, and we will revoke it before deleting the identity.

15. Your consent

Where we rely on consent, you give it by affirmatively choosing the relevant feature — for example, by connecting your TMDB account. You may withdraw consent at any time. Withdrawal does not affect processing carried out before you withdrew it. Processing based on other legal bases is carried out as described above.

16. Children

CineSprout is not intended for children under 16, or the higher age of digital consent in your jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact admin@refinesparkstudio.com and we will delete it. If you are under the required age, do not use the Application.

17. Data breach notification

If a breach affects your personal data, we will notify you and the relevant authorities as required by applicable law, including, where required, information about the nature of the breach and the steps taken to address it.

18. Changes to this policy

We may update this policy. We will post the new version with an effective date and, where required, notify you in the app or by other appropriate means. Material changes will apply from the date stated. We encourage you to review this page periodically. Previous versions are available on request.

19. Contact

Questions, requests, or complaints: admin@refinesparkstudio.com.

TMDB attribution. This application uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB. TMDB is operated by TiVo Platform Technologies LLC. Film and television metadata, ratings, and artwork are provided by TMDB and its licensors.