Privacy Policy

Controller

The party responsible for processing data on this website is:

IT Dienstleistungen Sven Stauden Tilsiter Straße 75 66121 Saarbrücken Deutschland Email: hello@sstauden.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

In short

Match a Movie works without an account. No registration, email address or password is required. You only enter a nickname of your choosing and pick an avatar image.

We process only what is technically necessary to run a matching round. There is no cross-site tracking and no sharing of data for marketing purposes.

We measure how the app is used with Google Analytics, and we show ads through Google AdSense that help fund it — both only after you have agreed. You can withdraw that agreement at any time.

Cookies

For its own operation this website uses strictly necessary cookies only. They are required so you can return to a round after closing your browser. Under Art. 6(1)(f) GDPR and § 25(2) TDDDG no consent is required for these.

Both cookies are set with the HttpOnly attribute and therefore cannot be read by JavaScript. They expire after one year and can be removed at any time through your browser settings.

Your consent decision for analytics and advertising is not managed by us but by Google Funding Choices, the certified consent management service through which the consent prompt is shown to you. Google Funding Choices stores your decision in its own, Google-managed cookies or your browser's local storage, and passes it on to the Google services described below so they load, or do not load, according to your choice. Google publishes a current list of the cookies involved at https://policies.google.com/technologies/cookies. The cookies set by Google Analytics and Google AdSense themselves are described further below.

• mam_uid – a randomly generated, signed device identifier (UUID). It contains no personal information and serves only to associate your device with a round.
• mam_profile – the nickname you chose, your avatar image number and your genre selection, so they are pre-filled on your next visit.

What we process

Within a matching round the following is stored on our servers:

This data is accessible only to the participants of that round who know its join code.

• the nickname and avatar image you chose,
• your genre selection, along with the chosen region and streaming providers,
• your ratings of the films shown (like or pass) and the matches resulting from them,
• the round's name, its join code, and the times of creation and last activity.

Hosting

This website is hosted and processed by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open the site, Cloudflare processes technically necessary connection data such as your IP address, the date and time of the request, and details about your browser and operating system.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable delivery). Transfer to the USA takes place on the basis of the European Commission's standard contractual clauses.

Fonts are not loaded from third parties: they are served directly from our own server, so opening a page makes no connection to a third-party font service.

Film data from TMDB

Film information comes from The Movie Database (TMDB), operated by TiVo Platform Technologies LLC, USA. Film data is requested by our server; your IP address is not transmitted to TMDB in the process.

Film posters, however, are loaded directly from TMDB's servers (image.tmdb.org) into your browser. For technical reasons TMDB receives your IP address when this happens. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivering images efficiently).

Match a Movie is in no way affiliated with Netflix, Amazon Prime Video or Disney+.

Anonymous match statistics

When a group agrees on a film, we store a single row describing the shape of that decision, so we can publish statistics about how groups decide what to watch. It contains only the following:

This row contains no device identifier, no nickname, no round name, no join code and no round identifier. It cannot be linked to you, to your device or to the round it came from, and it is never read back by the app. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding and describing how the service is used). Because the data is anonymous, it is not personal data within the meaning of Art. 4(1) GDPR.

These figures are published in aggregate form only.

• the time of the match,
• the region and the streaming providers selected for the round,
• how many people were in the round,
• how many films had been shown, and how many seconds had passed since voting began,
• the genres of the matched film, and whether it was the round's first match or a later one.

Web analytics (Google Analytics 4)

With your consent this website uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland acts as our processor under a data processing agreement; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other Google group companies may act as sub-processors.

Google Analytics sets the two cookies listed below in your browser and processes a randomly generated identifier for your browser, the pages you open on this site, the language of the page, your approximate location derived from a shortened IP address, and your device and browser type. IP addresses are shortened by Google before storage.

In addition we record the following events: page views, creating or joining a round, the start of voting, each swipe (like or pass, and whether by gesture or button), reaching a match, opening the results, running out of films, and sharing an invite. No nickname, no join code, no round identifier and no film title is transmitted at any point.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without your consent no data is transmitted to Google; Google Analytics' technical scaffolding is loaded, but stays inactive until you agree through Google Funding Choices.

Data is transferred to the USA. Google LLC is certified under the EU–US Data Privacy Framework, and in addition the European Commission's standard contractual clauses are agreed with Google. Despite these safeguards, US authorities may be able to access transferred data, and remedies equivalent to those available in the EU may not be open to you.

You can withdraw your consent at any time with effect for the future, using “Cookie settings” at the bottom of this page. Withdrawing is as simple as giving consent, and does not affect the lawfulness of processing carried out beforehand. This analytics property uses no advertising features and no Google Signals; data sharing with other Google products is switched off.

Further information: https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/

• _ga – a randomly generated identifier for your browser, valid for two years.
• _ga_<measurement ID> – Google Analytics session state, valid for two years.

Advertising (Google AdSense)

With your consent this website shows ads through Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland acts as our processor under a data processing agreement; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other Google group companies may act as sub-processors.

Google AdSense sets cookies in your browser, processes an identifier for your browser and your interaction with the ads shown, and may — depending on your consent — personalise ads based on your prior browsing. Google publishes a current list of the cookies involved at https://policies.google.com/technologies/cookies; their lifetimes range from a single session up to about 13 months depending on purpose.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Whether, and in what form — personalised or not — ads are shown depends on the decision you make through Google Funding Choices.

Data is transferred to the USA. Google LLC is certified under the EU–US Data Privacy Framework, and in addition the European Commission's standard contractual clauses are agreed with Google. Despite these safeguards, US authorities may be able to access transferred data, and remedies equivalent to those available in the EU may not be open to you.

You can withdraw your consent at any time with effect for the future, using “Cookie settings” at the bottom of this page. Further information: https://policies.google.com/privacy and https://policies.google.com/technologies/ads.

Retention

Round data is deleted once it is no longer needed to operate the service, and at the latest once a round has been inactive for an extended period. The cookies described above expire after one year. Where statutory retention obligations apply, deletion follows their expiry.

Google Analytics data is deleted automatically after 14 months. Your analytics decision stays in your browser's local storage until you change it or clear your browser storage.

SSL / TLS encryption

For security reasons this website uses TLS encryption. You can recognise an encrypted connection by the browser address bar beginning with “https://”.

Your rights

You have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of processing. You also have the right to rectification, erasure, restriction of processing, data portability, and a right to object.

An informal message to hello@sstauden.de is enough to exercise these rights. Where possible, please include the join code of the round concerned so the data can be identified.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or the place of the alleged infringement.