Privacy Policy
Effective date: 2026-10-04
This policy explains how your personal data is processed when you use Movsight (https://movsight.com). It is based on the EU General Data Protection Regulation (GDPR, 2016/679), Turkey’s Personal Data Protection Law No. 6698 (KVKK) and Germany’s Telecommunications Digital Services Data Protection Act (TDDDG), where our servers are located. Users in Turkey should also read the KVKK Information Notice.
1. Controller
The controller responsible for your personal data (GDPR Art. 4(7), KVKK Art. 3(1)(ı)) is:
- Onuralp Başar
- Türkiye
- E-mail: privacy@movsight.com
Write to this address with any privacy question or request.
2. Data we process, purposes and legal bases
We process only the data needed to provide the service (data minimisation, GDPR Art. 5(1)(c); KVKK Art. 4(2)(ç)). We do not process data for advertising, profiling or analytics, and we never sell data.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | E-mail address, password (stored only as an irreversible hash), birth year (to check the minimum age; the full date of birth is not stored), username, display name, bio, profile photo | Creating and running your account | GDPR Art. 6(1)(b) (contract); KVKK Art. 5(2)(c) |
| Journal content | Film/series notes, quotes, lessons, ratings, viewing dates, visibility setting | Providing the personal cinema journal | GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Social data | Accounts you follow and that follow you | Follow and feed features | GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Google sign-in data | Name, e-mail address and profile photo link shared by Google | Letting you sign in with Google | GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Consent and acceptance records | Date and version of the Terms you accepted, your cookie choices | Demonstrating compliance | GDPR Art. 6(1)(c) and Art. 7(1); KVKK Art. 5(2)(ç), 5(2)(e) |
| Server and security logs | IP address, timestamp, requested page, browser/device data, session tokens | Security, abuse prevention, debugging | GDPR Art. 6(1)(f) (legitimate interest); KVKK Art. 5(2)(f) |
| E-mail delivery data | E-mail address, send time, delivery status | Sign-in link, verification and password-reset e-mails | GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) |
| External media (YouTube) | IP address and device data are sent directly to Google | Playing trailers on the site | Only with your consent: GDPR Art. 6(1)(a), TDDDG §25(1); KVKK Art. 5(1) |
You may object at any time to processing based on legitimate interest (GDPR Art. 21). We then stop unless we have compelling legitimate grounds.
3. Publicly visible information
Movsight is a social journal. The following is visible to anyone on the internet:
- Your profile: username, display name, bio and profile photo
- Follow relationships (whom you follow, who follows you)
- Only the journal notes you mark as “public”
New journal notes are private by default (GDPR Art. 25(2), privacy by default). A note is only shared if you set its visibility to “public” yourself, and you can change that at any time.
5. Recipients and processors
We work with the following providers under GDPR Art. 28 data processing agreements. They may process your data only on our instructions:
| Provider | Role | Location | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting (web application, server logs) | Germany (EU) | GDPR Art. 28 data processing agreement; standard contract under KVKK Art. 9 |
| Supabase, Inc. | Database, authentication, avatar storage | Japan, Tokyo (ap-northeast-1); support access from the US | EU adequacy decision for Japan (2019/419); GDPR Art. 28 DPA and EU Standard Contractual Clauses (2021/914); standard contract under KVKK Art. 9 |
| Resend, Inc. | Account e-mails (sign-in link, verification, password reset) | United States (sending infrastructure: Ireland) | EU-US Data Privacy Framework certification, DPA and Standard Contractual Clauses; standard contract under KVKK Art. 9 |
Google sign-in: If you use it, Google acts as an independent controller under its own policy (Google Privacy Policy).
TMDB: Film and series information comes from The Movie Database. No personal data is shared with TMDB; requests are made by our server without identifying you.
Otherwise we share data with authorities only where a legal obligation requires it (GDPR Art. 6(1)(c); KVKK Art. 8(2)(a) and Art. 28).
6. International transfers
Our web server is in Germany (EU). Your account and journal data (database, authentication, profile photos) are stored by Supabase in Japan (Tokyo). For users in Turkey both are a cross-border transfer under KVKK Art. 9. These transfers are carried out on the basis of the standard contracts published by the Turkish Personal Data Protection Board, and the signed contracts are notified to the Authority within the statutory deadline.
Transfers outside the EU/EEA rely on the following safeguards: the European Commission’s adequacy decision for Japan (2019/419, GDPR Art. 45); for US-based providers (Supabase, Resend), the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses (GDPR Art. 45–46). You can request a copy of these safeguards.
7. Retention
- Account and journal data: kept while your account exists. Deleted immediately when you delete your account, and gone from provider backups within 30 days at most.
- Profile photo: deleted when you replace it or delete your account.
- Server logs (IP address etc.): kept for at most 14 days, then deleted automatically.
- E-mail delivery logs: kept by the e-mail provider for a limited period to verify delivery.
- Consent records: kept with your account and deleted with it. Your cookie choice is stored on your device for 12 months.
Where the law requires longer retention, data is kept only for that period and with processing restricted.
8. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time, without affecting earlier processing (Art. 7(3)). You may also lodge a complaint with a supervisory authority (Art. 77).
Under KVKK Art. 11 you may learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties it is transferred to; request correction if it is incomplete or wrong, and erasure or destruction under KVKK Art. 7, with notice to recipients; object to an outcome against you that results solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Self-service: On the Settings page you can download all your data in a machine-readable format (JSON) and permanently delete your account.
Requests: For anything else write to privacy@movsight.com. We answer free of charge within 30 days at the latest (GDPR Art. 12(3); KVKK Art. 13). To verify your identity we may ask you to write from the e-mail address registered to your account.
You can complain to the Turkish Personal Data Protection Board (KVKK Art. 14) or to the data protection authority of the EU country where you live or work.
9. Providing data; automated decisions
An e-mail address and a username are required to create an account; without them no account can be opened. No account is needed to browse. Every other field is optional.
There is no automated decision-making or profiling with legal or similarly significant effects (GDPR Art. 22). Film suggestions rely only on TMDB’s content relationships.
10. Minimum age
You must be at least 16 to create an account. We ask for your date of birth when you sign up; the check runs on your device and only your birth year is stored. You can report an account you believe belongs to someone under 16 to privacy@movsight.com; if confirmed, we delete it and the related data.
11. Security
We use appropriate technical and organisational measures (GDPR Art. 32; KVKK Art. 12): all connections are TLS-encrypted, passwords are stored only as hashes, the database enforces row-level access rules (RLS), and administrative access is restricted. In case of a data breach we notify the authority, and you where required, within the statutory deadlines (GDPR Art. 33–34; KVKK Art. 12(5)).
12. Changes
We may update this policy when the service or the law changes. The current version is always on this page, with its effective date at the top. We notify you on the site of material changes.