Privacy Policy

Last updated: 2026-09-19

This policy explains what the Movier Android app (name.gpm.movier) does with data. It covers the app only.

The short version: Movier asks The Movie Database for what is in cinemas, what is coming and what a film is about, and shows you what it says. There is no account, no server belonging to us, and nothing that identifies you is ever sent to TMDB or to anyone else.

Who is responsible

Gabriele Proietti Mattia is the data controller for the processing described here. Contact: apps@gpm.name.

What leaves your device

Requests to The Movie Database (TMDB), and nothing else.

Movier is a client for TMDB’s catalogue: what’s in cinemas, what’s coming, a film’s own page, and search. Opening a screen or typing a search sends a request that carries:

the app’s own API key, which identifies the app to TMDB — not you;
a region and a language tag (for example IT and it-IT), taken from your phone’s locale, so dates and text match where you are;
for a search, the words you typed;
for a film’s own page, its TMDB id.

Nothing else. No name, no email, no advertising id, no install id, no device information and no coordinates — TMDB does not ask for them and Movier does not send them. Poster images come from TMDB’s own image servers the same way, by path only. TMDB’s own privacy policy governs what it logs on its side.

Movier does not ask any other service. There is no cinema-showtimes provider yet — TMDB gives titles, synopses, runtimes and release dates, but not showtimes — and until one is added, this is the whole of what leaves the device. When a showtimes provider is chosen, this page will be updated first, naming it and saying exactly what a request to it carries.

Writing in, and reading the answers

Movier has a report screen — something is wrong, or an idea — and a messages screen where you can read what was written back. Both are optional and neither runs on its own: nothing is sent until you write something and press send.

What a report carries

What you wrote: whether it is a bug or an idea, the title and the description.
What makes it fixable: the app’s version, your Android version, the phone’s manufacturer and model, and your language tag. Typed into the message by the app — none of it is read from an identifier.
A screenshot, only if you pick one. Nothing is captured for you. The picture is shrunk and re-encoded on your phone, and what you see before sending is exactly what leaves it — so if part of the screen has nothing to do with the problem, remove it first.
Your email address, only if you type one. Without it a report is anonymous and cannot be answered; with it, it is how you get a reply.
A random identifier for that single report, so that sending twice on a bad connection is not counted as two. It is not a device id, it is not stored on your phone, and a second report gets a different one.

It goes to apps-management.gpm.name, a service run by the author. It is not shared with anyone, not used to build a profile and not published: reports are read, given a state and answered by hand.

No advertising id and no install id, ever — in a report or anywhere else.

Reading the answers, and the key that costs

A report is answered by email, to the address you typed into it. That is the whole of what is needed, and if you never open the messages screen nothing below applies to you.

That screen shows what you sent and everything written back, without going to find the mail. Since your reports are yours, it has to be sure it is you: it asks for the address and sends a six-digit code there. Once the code is checked the app keeps a key, and it is the one thing here that resembles a login, so it is worth being exact about it:

it hangs from the address you proved, never from your phone — nothing about the device goes into it, two phones that prove the same address get two separate keys, and removing the app throws the key away rather than recovering it;
it works for Movier only, and opens nothing in any other app;
the service stores a one-way hash of it, not the key itself;
it stops working after a year without use, and Sign out withdraws it at the service and not only on your phone.

Sending a report needs none of this. You can report something having proved nothing, and that report carries no identifier of any kind.

Feature requests and votes

The same screen lists what people have asked for in Movier, and lets you ask for something and vote. Reading that list costs nothing and needs no address. Asking and voting do, for one reason: one vote per person is a promise, and without something to hang it on the count would mean nothing.

What is published is the request itself, once it has been read. Never your address, and never who voted for what.

What stays on your device

Your watchlist. The films you follow — title, original title and language, synopsis, poster, release date, runtime and rating — kept so the list works with no network at all, for example on a train.

All of it is in the app’s private storage and is included in Android’s backup, so a new phone keeps it. Uninstalling removes it, as for any app.

Permissions declared for what is not built yet

Two permissions are in the manifest for features this version does not have:

ACCESS_COARSE_LOCATION, reserved for a future “cinemas near me” feature.
POST_NOTIFICATIONS, reserved for the two alerts the app is meant to send: a film you follow opening, and tonight’s original-language screenings.

Neither does anything in this version. There is no runtime prompt for either, no notification is ever posted, and no code in this build reads your location — nothing related to either is sent anywhere, because neither feature exists yet. When one ships, this page will say exactly when the app asks and what, if anything, leaves the device.

Diagnostics

None, in either build. Movier has no crash reporting and no usage statistics today, on Google Play or through the F-Droid repository. If that changes, it will be opt-in and named here before it ships.

What the app never does

No account and no sign-up, and no password anywhere. An email address only if you type one in yourself — to be answered about a report, to read those answers in the app, or to vote for a request — and never for anything else.
No account, sign-up or email address.
No advertising, and no sale or sharing of data with anyone.
No tracking, across this app or any other.
No background location, no movement history, no route recording.
No reading of your contacts, messages, call history, photos or files.

For readers in the EU/EEA and the UK: Gabriele Proietti Mattia receives no personal data from this app, so there is no processing on that side to which a legal basis under Article 6 would attach. The TMDB requests described above happen automatically as you browse and search — that is what makes the screens work — and carry nothing that identifies you; TMDB is an independent controller of what it then holds.

Retention

A sign-in key stops working a year after you last use it, and is withdrawn the moment you press Sign out. Deleting the app removes the copy on your phone.

Reports are kept while they are useful — an open one until it is answered, a closed one as the record of a decision. A screenshot is part of the report it came with and goes when it goes. Ask and yours is deleted, including the address you sent it from.

Beyond reports, Gabriele Proietti Mattia holds nothing. On your device, your watchlist remains until you remove a film from it or uninstall the app.

Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data. Because Gabriele Proietti Mattia holds no data about you from this app, there is nothing to access, correct or delete on that side; deleting the local data is done by removing a film from your watchlist or uninstalling the app. You retain the right to lodge a complaint with a supervisory authority.

Write to apps@gpm.name for any request.

Children

Movier is not directed at children under 13 and knowingly collects no data from them — or from anyone.

Changes

Material changes will be published on this page with a new date at the top, and significant ones will be noted in the app’s changelog.

Last updated: 2026-09-19