Privacy policy

Who is responsible for your data

CineTrotter is published by Croissants SAS, the controller of your data. Its full details are in the legal notice.

For any question about your data, or to exercise your rights, write to contact@cinetrotter.fr.

In the app, an identifier drawn at random

On first launch, the app draws at random an identifier that says nothing about you. It attaches it to every request it sends to our server: that is how it finds your ongoing searches and your notifications again.

The app keeps this identifier on your phone and also hands it to the phone’s backup: the iCloud Keychain on iPhone, your Google account backup on Android. As a rule, if that backup is turned on, it comes back after a reinstall, or on a new phone signed in to the same Apple or Google account; otherwise, the app draws a new one.

You will find it in the app under Settings › About › Client identifier, and a long press copies it. That is what to give us with any request about your data.

What our server keeps for this identifier

Linked to this identifier, and to nothing else, our server keeps:

• the films and places you opened, how many times, and the days on which you used the app;
• the films you asked us to search for, and the notifications we sent you;
• your phone’s language and system (iPhone or Android) and, if you allowed notifications, the token used to send them to you.

This data makes the app work: resuming a search, telling you when it succeeds, writing to you in your language. It also feeds our statistics, which tell us which films and places people look at.

Your location, on the other hand, stays on your phone. To load the places to show, the app sends our server the rectangle of map visible on screen; when the map is centred on you, that rectangle surrounds you. Our database does not keep it, but like any request it may appear in the server logs described below.

The list of your recent searches stays on your phone: you can empty it from the search, with Clear history. Each search you type, however, goes to TMDB, which finds the films, and to Google Firebase Analytics, as explained below.

Notifications

As soon as the app launches, whether or not you have allowed notifications, your phone obtains a notification token from Google (Firebase Cloud Messaging); the app passes it on to us only if you allow them. On iPhone, notifications then go through Apple. This token designates your phone, not you, and serves only to alert you, for instance when the places of a film you asked for are ready.

To deliver each notification, Google and, on iPhone, Apple receive this token and the whole message: its title and text, written in your phone’s language, and its type; the title of the film it concerns and the film’s number at TMDB; the address of an image, either the film’s poster or a picture chosen by our team; and lastly technical numbers that identify the notification and the screen of the app to open.

To turn notifications off, use the switch under Settings › Notifications › Push notifications: the token is then erased from our server. Turning them off in the phone’s own settings is not enough: the phone stops showing them, but the token stays with us.

Advertising and audience measurement

Now and then the app shows a full-screen ad served by Google AdMob: that is what pays for CineTrotter.

In the European Economic Area, the United Kingdom and Switzerland, a Google form first asks for your choice; elsewhere, no form appears. On iPhone, the app also asks whether it may use the device’s advertising identifier.

Once this form has been answered, whatever your answer, or from the very first launch where it does not appear, Google AdMob receives the phone’s IP address, technical information (model, system, language) and its advertising identifier: on iPhone, only if you allowed it; on Android, unless you deleted it in the phone’s settings (in the European Economic Area, the United Kingdom and Switzerland, only if you agreed to it in the form). If you decline personalisation, the ads take no account of your interests.

At the same moment, audience measurement by Google Firebase Analytics starts, here too whatever your answer: declining personalised ads does not stop it. It receives the screens opened and the actions taken in the app (opening a film, tapping a place, starting a search), including the text typed in the film search, linked to an identifier specific to this installation of the app. It also receives the phone’s advertising identifier: on iPhone, if you allowed it; on Android, unless you deleted it in the phone’s settings. It never receives your CineTrotter identifier, the coordinates of your location or your notification token, and we only ever read totals from it.

You can review your advertising choices at any time under Settings › Privacy › Manage ad preferences. This setting only concerns advertising: it changes nothing in audience measurement.

Other services the app contacts

To show you a film or a place, the app talks directly to a few services. Each of them receives your phone’s IP address, as with any web page:

• TMDB (The Movie Database), for the title you type in the search, and for film details and posters;
• Wikipedia and Wikimedia Commons, for a photo of the place, looked up by its name or its position;
• Google Maps on Android and Apple Maps on iPhone, for the base map.

When you ask for a film CineTrotter does not know yet, our server goes looking for its places. To do so, it sends the film’s title to artificial intelligence services (OpenAI, Anthropic), never your identifier.

From time to time, the app asks Google Play, on Android, or the App Store, on iPhone, to invite you to rate it. They alone decide whether to show the window, and your rating and review go straight to them, under your Google or Apple account. We never learn whether the window appeared, nor what you answered: audience measurement only records that the request was made.

On the cinetrotter.com website

The website has no accounts and sets no cookies, neither for advertising nor for audience measurement. That is why you see no consent banner on it.

Three things stay in your browser: the theme (light, dark or your system’s), the base map (plan or satellite) and the fact that you closed the map’s welcome panel. They are never sent to us, and they disappear when you clear the site’s data.

We count visits with Umami, installed on our own server: no cookie, no tracking from one site to another, no IP address kept in the clear. We only draw totals from it: pages viewed, country, device.

Your browser contacts only three outside services, and only on the map: OpenFreeMap for the base map, Esri for satellite imagery, and Photon (Komoot) to look up a place, which also receives the text you type and the centre of the map. Film posters come from TMDB, but our server copies them: your browser never talks to TMDB.

The button that centres the map on you asks your browser for your location only when you press it. Your location itself is sent to no one, but the map then centres on you: the map images of your neighbourhood are requested from OpenFreeMap or Esri and, as long as the map stays there, each place search sends Photon its centre, to within about ten metres. Together, these requests roughly tell where you are.

Server logs

Every request made to the website or to the app’s server leaves a technical line: IP address, address requested, browser or app, date and time. It is used for security and troubleshooting. When we erase your data, the app’s server also records the erasure in its logs, with a fingerprint of your identifier and its first 8 characters.

To protect the service against abuse, the app’s server also counts the requests of each phone. It files them under a fingerprint of its identifier, along with the identifier’s first 8 characters, never under the whole identifier.

If a phone or an IP address draws attention, with bursts of requests for instance, the server keeps a report on it: a fingerprint of the identifier or the address, the figures that got it noticed, the dates and the decision taken. The oldest reports also hold its first 8 characters. When a report calls for a human eye, it is also sent to Slack, our team’s messaging tool, so that a person can decide. Slack then receives a truncated fingerprint of the identifier or the address, the type of report (phone or IP address), its alert level, its score and the figures that got it noticed; never the whole identifier, nor the IP address.

Where your data lives

The website and the app’s server run on servers we rent from OVH, in France. The database of the app’s server is hosted by Supabase.

Several services named here are established outside the European Union, notably in the United States: Google, Apple, TMDB, Esri, OpenAI, Anthropic, Slack and the Wikimedia Foundation. When we entrust data to them, the transfer relies on the safeguards provided for by the GDPR: an adequacy decision of the European Commission or its standard contractual clauses.

How long we keep it

• Data linked to your identifier: at most until you ask us to erase it.
• The notification token: until you turn notifications off in the app.
• The website’s logs: 7 days. Those of the app’s server: 90 days at most.
• The counters against abuse: 7 days.
• Reports against abuse: how long they are kept has not been set yet.
• Backups of the database: 30 days at most.
• Audience measurement in Google Analytics: 14 months at most. Advertising data: according to Google’s rules.

Your rights

You may ask to access your data, to have it corrected or erased, to restrict its use or to object to it, and to receive it in a machine-readable format. Your advertising choices and notifications, for their part, can be changed at any time in the app’s Settings.

Write to contact@cinetrotter.fr and include the app’s client identifier: it is the only link between you and your data, since we know neither your name nor your email address. We answer within one month at most.

How to erase everything is explained on the Delete your data page.

You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

On what grounds

• Running the app and the website: performing the service you use.
• Notifications: your permission, which you can withdraw at any time.
• Personalised advertising: your consent, collected by Google’s form where the law requires it.
• Security, the fight against abuse and the statistics drawn from our server: our legitimate interest in protecting the service and improving it.

Children

CineTrotter is not aimed specifically at children and asks nobody’s age. If you believe a child has sent us data, write to us and we will erase it.

Security and changes

Exchanges with the website and with the app’s server are encrypted (HTTPS). We sell your data to no one.

When this policy changes, the date at the top of this page changes with it.