Legal Notice

Operator

Questions, takedown requests, or anything else: contact matthias.machold@gmx.at.

Data Protection

Movie Swiper is designed to work without accounts. The site collects only what is needed to make group swiping function:

  • Nickname. The display name you type when you create or join a group. Visible to other members of your group.
  • Session token. A random identifier stored both in our database and in a cookie called ms_session. The cookie lasts 30 days, and each visit extends it by another 30 days, so that returning to a group keeps your existing swipes instead of signing you in as a new member. It is used solely to keep you signed in to your group on the same device, never for analytics or tracking.
  • Group code, join time, last-seen time. Used to assemble the group and show who is currently active.
  • Swipe decisions. For each movie shown to you, whether you picked like or pass, with a timestamp. This is the whole point of the app — your swipes are compared with your group's to find matches.
  • IP address. When you create or join a group, your IP address is used to count recent attempts and block abuse (spam and automated flooding). It is stored as part of a rate-limit counter and is never tied to your nickname or swipes. The counter stops being used once its time window passes, but the row itself is retained — see Retention below. We keep no general access or IP logs of our own beyond this.

We do not collect your real name or email address. We do use one advertising measurement tag, Google Ads conversion tracking — see Advertising below.

Analytics

To understand overall traffic — how many people visit and which pages and countries they come from — we use Umami, a privacy-focused analytics tool. Umami is cookieless: it sets no cookies, does not track you across other websites, and does not store data that identifies you personally. It collects only aggregate, anonymous figures such as page views, approximate country, referring site, browser, and device type. We do not use Google Analytics. We rely on our legitimate interest (Art. 6(1)(f)) in understanding and improving the service.

Advertising

We advertise Movie Swiper on Google Search. To see which ads lead to someone actually using the app, the site loads Google's advertising tag (gtag.js) from googletagmanager.com. What this means in practice:

  • Google receives a request from your browser when the tag loads, which includes your IP address, browser identification, and the page you are on. This happens on every page except /admin.
  • It sets a cookie (_gcl_au and related _gcl_* values) on this domain, lasting up to 90 days. Its purpose is to connect an ad click to a later action on the site.
  • It reads the click identifier (gclid and similar) that Google appends to the URL when you arrive from one of our ads.
  • What we get back is aggregate only: counts of how many people who clicked an ad went on to create or join a group. We cannot see individual people, and this data is never joined to your nickname, your group, or your swipes.

The data controller for this processing is Google Ireland Limited, and data may be transferred to Google LLC in the United States. Google's handling of it is governed by its own privacy terms.

This is not necessary to run the site, and under the ePrivacy rules and the GDPR it is lawful only with your consent (Art. 6(1)(a)). You can prevent it entirely by blocking third-party scripts or cookies in your browser, by using a content blocker, or through Google's own ad settings. Blocking it does not affect any feature of Movie Swiper. We do not use remarketing or audience lists, and we do not build advertising profiles ourselves.

Cookies and local storage

We use one strictly necessary cookie, ms_session (described above), to keep you in your group. Our analytics (above) is cookieless. The Google Ads tag described under Advertising sets a _gcl_* cookie for advertising measurement — that one is not necessary, and blocking it costs you nothing. Separately, your browser's local storage keeps a few preferences on your own device — your list of recent groups, your chosen streaming country, and (if you set one) your Jellyseerr address. This data stays in your browser, is never sent to us, and you can clear it at any time through your browser settings.

Why we are allowed to process this (legal basis)

Under the GDPR, we rely on:

  • Performance of a service you requested (Art. 6(1)(b)). Nicknames, session tokens, group data, and swipes are processed so the group-swiping feature can work at all.
  • Legitimate interests (Art. 6(1)(f)). The temporary IP-based rate limiting is used to keep the service available and protect it from abuse, and the cookieless analytics described above.
  • Consent (Art. 6(1)(a)). Google Ads conversion measurement, described under Advertising. It is not needed for the site to work, and the same section explains how to block it.

Is swipe history personal data?

Possibly. Under the GDPR (Art. 4(1)), data is “personal” whenever it can be linked to an identifiable person. Because nicknames are user-chosen and may include real names or recognizable handles, the combination of nickname + swipe history could allow someone to be identified by people who already know them. We therefore treat this combination as potentially personal data. If you do not want your swipes to be associated with you in any way, pick a nickname that does not identify you.

Retention

We currently keep group data until it is deleted on request. A group and everything attached to it — members, nicknames, swipes, and matches — stays in the database after you stop using it. There is at present no automatic deletion, so a group you created weeks ago is still stored.

The rate-limit counters described above, which contain an IP address, are also kept rather than expiring on their own.

To have a group and its swipes erased, email the address above with your group code and nickname and we will delete it.

Your rights

Where the GDPR applies, you have the right to access the personal data we hold about you, to ask us to correct or delete it, and to object to processing based on legitimate interests. Because we hold no account or email for you, the practical way to exercise these rights is to email us with your group code and nickname so we can identify the relevant data. Because nothing is deleted automatically at the moment, a request is the way to have your data removed.

Third parties

Movie metadata and poster images are loaded from The Movie Database (TMDB). When those assets load, your browser contacts TMDB directly; their privacy terms apply to that connection. Movie Swiper is not endorsed or certified by TMDB.

The other third parties your browser contacts are Umami for cookieless analytics and Google for the advertising tag described under Advertising. There are no others.