Privacy Policy

Wavelength VR Ltd, a company registered in England and Wales under company number 11055409, with registered office at 16 Elgin Crescent, London, W11 2JR, United Kingdom, is the data controller for the limited personal data described in this policy.

You can reach us at info@kinoraapp.fun.

Kinora has no accounts. There is no sign-up, no password and no sign-in, and you can use every part of the app without telling us anything about yourself.

The Profile screen offers to save an email address. Nothing else in the app asks for one — setting Kinora up does not, and you reach your recommendations without ever seeing the offer. It is genuinely optional: nothing is withheld if you decline, and declining costs you no feature.

If you do give us one, the address is very nearly all we hold. It goes onto a beta contact list along with your two-letter market code, the version of the app you were using, and which of the two places you answered. We never ask for your name, phone number or date of birth, and there is no field in the app in which to give them to us.

We use your address for one thing: writing to you about the beta — what has changed, what we would like your read on, and anything that affects how the app handles your data. We do not send marketing, and every email we send has an unsubscribe link.

Saving your address does not save anything else, and this is the point most worth being clear about. It is not a backup and it is not sync: your swipes, ratings, watchlist and taste profile stay on your device, are not uploaded with the address, and cannot be restored from it. The app calls this “save your taste” because the address is how we will be able to reach you if cross-device sync is ever built — not because anything syncs today.

What matters most is what your address is not connected to. It is deliberately not linked to the device identifier described below, not attached to any analytics event, and not linked to your swipes, ratings, watchlist or taste profile. We can write to you. We cannot look up what you have watched.

You can remove the address from your device at any time at Profile → Email, which makes Kinora forget it and stop asking. To come off the contact list as well, write to info@kinoraapp.fun and we will delete the record. The app cannot do that second part itself, by design: it has permission to add an address to that list and no permission at all to read one back or remove one, which is what stops the list being readable by anyone who unpacks the app.

Separately from any of the above, when you first open the app your device generates a random identifier (a UUID) for itself. It is stored on your device and is not derived from any hardware identifier, advertising ID, phone number or anything else about you or your device. It is the only identifier attached to the anonymous usage data described below.

That identifier is not linked to your email address, and not to any other real-world identity we hold. If you reset your data from the Profile screen, a new identifier is generated and the previous one is no longer used.

Everything that makes Kinora personal is stored locally, in a database on your device, and is never transmitted to us:

• every swipe, including which films you skipped;
• films you marked as watched, and whether you loved, liked or disliked them;
• your watchlist;
• the taste profile the recommendation engine derives from all of the above;
• the moods you selected;
• your country/market setting and optional age band;
• your daily reminder preference and time;
• a cached copy of the film catalogue so the app works offline.

We have no copy of any of this and no technical means of retrieving it. That is a deliberate design choice, and it has a consequence you should understand: if you uninstall the app, reset your data, or lose your device, it is gone permanently and we cannot restore it.

To understand whether the product actually works, we send anonymous usage events to PostHog, our analytics provider. Each event carries the random device identifier described in section 2, a timestamp, and a small number of non-identifying properties.

The events record things like: the app being opened; a swipe being made and in which direction; a deck being completed; a mood being selected; a recommendation being shown and which template explained it; a trailer being played; a where-to-watch panel being opened; whether you answered “yes” or “no” when asked if a film was one you wanted to watch; a screen being opened; an outbound link being opened, such as booking a call with us or sharing the app; whether the offer to save an email address was shown, accepted, declined or dismissed — never the address itself; which of the three answers you gave when asked whether Kinora is getting your taste, and whether you added a note — never the note itself; and settings such as your market or reminder being changed.

These events deliberately do not include:

• your name, email address, phone number, or any other contact information. If you have given us an email address under section 2, it is held separately and is never attached to an analytics event;
• the text of anything you type, including search queries. When a search is recorded, only the number of characters typed and the number of results returned are sent, never the query itself;
• your precise location. See section 7;
• any advertising identifier (IDFA / GAID). We do not request or use one.

Analytics is not essential to the app. If our analytics provider is unreachable, or if analytics is switched off in the build, the app works exactly as it otherwise would.

The app fetches film data from our own servers (Supabase Edge Functions). These requests are made to serve you content and carry only what is needed to answer them:

• downloading the catalogue on first launch, and refreshing individual films — sends your two-letter market code so we can return the right certification and availability;
• looking up where a film is streaming — sends the film ID and your market code;
• fetching a trailer — sends the film ID;
• searching — sends the text you typed. This is one of only two cases where something you have written leaves your device, because a search cannot be answered without it. It is used to run the search and is not stored against your device identifier or used to build a profile of you;
• sending us feedback — sends the answer you chose and, if you wrote one, your note. This is the second case, and the only one where we keep what you wrote. It is stored with your market code, the app version and nothing else: no email address, even if you have given us one, and no device identifier. That is a deliberate trade and it has a cost worth knowing — it means we cannot reply to feedback, and cannot connect it to anything else about you. If you want an answer, the Profile screen has a link to book a call with us instead.

As with any internet request, our server infrastructure processes your IP address in order to route the response. We do not use IP addresses to identify or profile you, and we do not combine them with your analytics identifier.

Playing a trailer loads an embedded YouTube player. That is a direct connection between your device and Google, subject to Google’s privacy policy, and Google may set cookies or collect data through it. If you would rather not, do not open trailers.

For the avoidance of doubt, Kinora does not collect, request or use:

• GPS or any device location. Your market is derived from your device's language and region settings, or chosen by you, and is used only for streaming availability and age certification. It is never used to infer anything about your taste;
• your contacts, calendar, photos, camera, microphone or health data;
• payment or financial information. There is nothing to buy;
• advertising identifiers. We do not serve ads and do not track you across other apps or websites;
• biometric data or anything else in a special category under data protection law.

The daily reminder is scheduled by the app on your own device. The film it names is chosen on your device from the catalogue already stored there.

We do not operate a push notification service, we never receive a push token, and we have no technical ability to send a message to your device. Nothing about which reminders you received, or whether you opened one, is transmitted to us.

You can turn reminders off or change their time at Profile → Daily reminder, or revoke notification permission in your device settings.

Where UK GDPR applies, we rely on the following bases:

• Legitimate interests (Article 6(1)(f)) — for the anonymous usage analytics in section 4, in order to understand whether the product works and to fix it when it does not. We have assessed that this is a limited, low-risk processing activity that a user would reasonably expect, involves no profiling of identifiable individuals, and does not override your rights;
• Performance of a contract (Article 6(1)(b)) — for the catalogue and lookup requests in section 5, which are necessary to provide the Service you have asked for;
• Consent (Article 6(1)(a)) — for sending you notifications, which you give through your device's permission prompt and can withdraw at any time;
• Consent (Article 6(1)(a)) — for holding your email address and writing to you about the beta. This basis is available to us precisely because giving us the address is optional: nothing in the Service is conditional on it, so consent here is freely given in the sense the law means. You can withdraw it at any time, by using the unsubscribe link in any email or by writing to info@kinoraapp.fun, and withdrawing changes nothing about how the app works for you.

Much of what this policy describes may not be personal data at all, because it is not linked to an identifiable person. We describe it here anyway, so you can see the whole picture rather than only the parts we are legally required to disclose.

We do not sell your data, and we do not share it for advertising. We use the following processors and providers:

• PostHog — product analytics. Receives the anonymous events in section 4;
• Supabase — hosts our catalogue database and Edge Functions, stores your email address on the beta contact list if you give us one, and stores any feedback you send;
• The Movie Database (TMDB) — supplies film metadata and images to our servers;
• JustWatch — supplies streaming availability data;
• YouTube / Google — serves trailers, if and when you play one. Google has no other role: there is no Google sign-in, because there is nothing to sign in to;
• Expo / Apple / Google — distribute the app and provide crash and delivery infrastructure at the platform level.

We may also disclose information where we are legally required to do so, or to establish, exercise or defend legal claims.

Our analytics is configured to use European hosting. Some of our providers may nonetheless process data outside the UK and the European Economic Area.

Where that happens, we rely on appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Addendum to the European Commission’s standard contractual clauses.

Data on your device stays there until you delete it, by resetting your data from the Profile screen or uninstalling the app.

Anonymous analytics events are retained by our analytics provider for no longer than 12 months from collection, after which they are deleted or aggregated beyond any link to a device identifier.

If you gave us an email address, we keep it until you ask us to remove it, or until the beta ends and we have told you it is closing. A request to info@kinoraapp.fun deletes the record.

Feedback you send us is kept for as long as it is useful to the product, and is not linked to you. Because it carries no address and no device identifier, we have no way to find yours in order to delete it — which is the same property that makes it anonymous. Please do not put anything in a feedback note that you would later want withdrawn.

If you are in the UK or the EEA, you have rights to access, correct, erase, restrict and object to the processing of your personal data, and to data portability.

Because there is no account, the practical position is unusually simple: the data that is actually about you is on your device and under your control. You can view it in the app, and you can erase all of it at any time from Profile → Reset my data. You do not need our permission or cooperation to do so.

If you gave us an email address, write to us at info@kinoraapp.fun from it and we can act on any of those rights in respect of it, including deleting it outright. We do not require anything more than the request itself.

The anonymous analytics events are a different matter, because they are deliberately not linked to your address. We can only act on a request about them if you tell us the device identifier they are attached to — without it we have no way to find those records, and knowing your email address does not help us, by design. If you would like us to try, contact us at info@kinoraapp.fun.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

The Service is not directed at children under 13 and we do not knowingly collect data from them.

If you believe a child under 13 has used the Service, contact us at info@kinoraapp.fun. As no account exists and the data sits on the device, the fastest remedy is to reset the app’s data from the Profile screen and uninstall it.

Data on your device is stored in the app’s private storage area, protected by your device’s own operating system security and, where you have enabled one, your device passcode or biometric lock. The device identifier is additionally held in the platform keychain / keystore.

All network requests use encrypted connections (HTTPS).

No system is perfectly secure. Because we hold no personal data about you on our servers, the consequences of a breach on our side are limited by design rather than by promise.

We may update this policy. When we do, we will change the “last updated” date at the top of this page, and where a change materially affects you we will bring it to your attention in the app.

Questions, requests or complaints about privacy can be sent to info@kinoraapp.fun.

Wavelength VR Ltd., 16 Elgin Crescent, London, W11 2JR, United Kingdom.