Privacy Policy

1. Scope

This policy applies to the Viewlane iPhone application, its private pilot service, and this website. The current release is a private, invited iPhone pilot; public registration is not available. A full Android application is planned separately.

2. Information Viewlane processes

• Account information: a Viewlane account identifier; the Apple or Google account identifier used to sign in; and an email address or display name when the sign-in provider supplies it.
• Viewing information: titles added to the library, viewing status, watch and rewatch dates, episode and movie progress, ratings, favourites, notes, collections, ranked lists, and related preferences.
• App settings: preferences such as rating style, optional movie minute tracking, developer controls, icon selection, and display choices.
• Notification information: account and per-title reminder choices, time zone, quiet hours, device and registration identifiers, an Apple push-notification token, app version, registration timestamps, and whether a device registration is disabled. Reminder records include the relevant title or episode, planned send time, retry attempts, and delivery-service result codes.
• Import and recovery information: the Viewlane JSON file you choose to import, a private recovery copy of existing data created when a merge is applied, and receipts used to verify imports and prevent duplicate viewing records. Account migration can also create a private recovery snapshot.
• Metadata activity: searches, title identifiers, and metadata requests needed to return television and movie information from TMDB.
• Security and operational information: session records, authentication events, timestamps, and limited request information that hosting providers may process to operate and protect the service, such as an IP address or user-agent.

The Viewlane website does not use advertising cookies, behavioural analytics, account forms, or third-party tracking pixels.

3. How the information is used

• Provide and synchronize the user's library, progress, history, ratings, schedules, and statistics.
• Authenticate invited users and prevent access to another user's data.
• Retrieve and cache television and movie metadata.
• Schedule reminders you enable, deliver them through Apple Push Notification service, prevent duplicate sends, and disable registrations after sign-out.
• Maintain private backups, diagnose service failures, prevent abuse, and recover from data loss.
• Respond to support, privacy, recovery, and deletion requests.

4. Service providers

Viewlane relies on a limited group of service providers to operate:

• Supabase provides authentication, database storage, and server functions.
• Cloudflare provides private backup storage and hosts this static website.
• Apple and Google provide account authentication. Apple also provides Apple Push Notification service (APNs) for iPhone reminders.
• The Movie Database (TMDB) provides television, movie, cast, crew, artwork, release, and rating metadata.

These providers process information only as needed to provide their services and under their own applicable terms and privacy commitments. Viewlane does not sell personal information or share it with data brokers or advertisers.

5. Notification choices

Reminders are optional. In Viewlane, open Settings → Notifications to turn reminders on or off, choose reminder types and timing, and set quiet hours. Individual title screens offer per-title choices. The app uses the time zone reported by your iPhone for scheduling; it does not request GPS location for reminders.

When you enable reminders and allow iOS permission, Viewlane sends Apple the device token and reminder content, including the relevant title or episode and identifiers that open the correct screen. The reminder payload does not include your private notes, ratings, sign-in credentials, or full viewing history. Titles and episode details may appear on the Lock Screen; use iOS notification settings to control alerts and previews.

Disabling reminders stops future scheduling for your account once the change reaches the service; it does not erase your reminder preferences or existing delivery records. Signing out retires this iPhone's registration. If sign-out happens offline, the app retains a limited device-cleanup credential in the iPhone Keychain and retries cleanup when it reconnects. This credential cannot read or change your viewing data. A notification already handed to Apple cannot reliably be recalled.

6. Storage, retention, and backups

Active account data is retained while the account remains active. Disabling notifications marks registrations inactive rather than immediately deleting their stored tokens, identifiers, and delivery records. These account-linked records are removed when the account is permanently purged; erasing viewing data also removes its reminder delivery records. Minimal approval records for the private pilot are retained after deletion to prevent an old invitation from reopening an account.

Private import and migration recovery copies normally provide about 30 days of recovery availability. Expired payloads are removed by a scheduled cleanup job; a migration snapshot referenced by a retained transfer remains until that transfer is removed. Import and synchronization receipts are retained to prevent duplicate operations until viewing data is erased or the account is permanently purged.

Independent disaster-recovery backups are scheduled daily and expire after 30 days. Backup failures are tracked for the operator to resolve; a daily schedule is not a guarantee that every run succeeds.

Once account deletion is scheduled, access to personal data through the service is suspended and a 30-day recovery window begins. After the displayed deadline, the scheduled purge removes the live account and its personal data. A backup created before permanent deletion may retain an inaccessible copy until that backup reaches its own expiry date. As a result, the maximum practical period from the initial deletion request to expiry from every routine backup is approximately 60 days.

Backups are used only for disaster recovery. A restored backup must not reactivate or return data belonging to an account whose deletion deadline has passed.

On the iPhone, Viewlane keeps account-separated saved content and unsent changes for offline use. Saved read-cache entries stop being usable after 90 days; pending changes are retained until synchronized or explicitly resolved. Signing out makes another account's saved data unavailable in the app, but does not discard its pending changes. An offline device cannot learn of deletion or erasure on another device until it reconnects.

Files you export or share are separate copies in the location or service you choose. Erasing viewing data or deleting your account does not delete those files, their copies, or a disaster-recovery archive before its retention period ends. Keep exports private and remove copies you no longer need.

7. Export, erasure, and account deletion

Open Settings → Export & Import to create a personal-data export or select a Viewlane JSON file to merge. That screen also offers Erase Library & Viewing Data, which resets viewing data while keeping the account and sign-in methods.

To delete the account, open Library → Settings, select your name or Viewlane Account in the Account section to open Profile & Account, then select Delete Viewlane Account. Viewlane requires fresh verification through every linked Apple or Google identity, revokes those provider authorizations, signs out every Viewlane session, and immediately suspends personal data.

During the displayed 30-day recovery window, signing in to the same account and selecting Restore Account cancels deletion. After the deadline, recovery is not available. Full instructions and the inaccessible-device fallback are available on the account-deletion page.

8. Security

Viewlane uses encrypted network connections, provider-based authentication, account-level database access controls, protected server secrets, rate limits for sensitive operations, and private backups. No system can guarantee absolute security, but access is deliberately limited to what the private pilot requires.

9. International processing

Viewlane is operated from Canada. Service providers may process information in Canada, the United States, or other locations where they operate, subject to their contractual and legal safeguards.

10. Children

Viewlane is not directed to children under 13 and does not knowingly invite children to participate in the private pilot.

11. Changes to this policy

This policy will be updated when Viewlane's data practices materially change. The effective date above will be revised, and pilot users will be informed when a change meaningfully affects their choices.

12. Contact

For privacy questions or requests, email developer@viewlane.app. Do not send passwords, authorization codes, private keys, or other sign-in secrets.