Umbral
Privacy
Policy
The short version
- We collect your email address and the things you do in the app (your ratings, lists and streaming services) so your recommendations work and sync across your devices.
- We don't sell your data, show ads, or track you across other apps and websites.
- You can delete your account and everything in it at any time from inside the app.
Who we are
Umbral is made by Onyx Ryft LLC, an Indiana limited liability company ("Onyx Ryft", "we", "us"). This policy explains what information the Umbral app collects, how we use it, and the choices you have. If you have questions, email us at privacy@onyxryft.com.
What we collect
| Information | Why |
|---|---|
| Email address and password | To create and secure your account, send sign-up and password-reset codes, and let you sign in on other devices. Your password is stored only in hashed form by our authentication provider; we never see it. |
| Your streaming services | So we only recommend titles you can actually watch. |
| Ratings, watchlist, watched list and "Not for me" list, with basic details about each title (name, year, genres, poster) and when you added it | To personalize your recommendations and keep your lists in sync across devices. |
| If you turn on Watchlist alerts: a push notification token for your device, and a record of which alerts we've sent you | To send you a notification when a title on your Watchlist arrives on one of your streaming services, and to avoid sending the same alert twice. The token is deleted when you turn alerts off, sign out on that device, or delete your account. |
| Crash and error reports: what went wrong, the screen and app version, device model, iOS version, and the app's recent steps before the problem. They don't include your email, your account ID, your lists or your IP address. | To find and fix bugs. Kept by our error-reporting provider for up to 90 days. |
| Technical data our service providers record automatically when the app connects: your device's IP address, an approximate location based on it (city or region), your account ID, and the time and type of each request | Needed to deliver content to your device and keep the service secure and working. Kept for one day, then deleted by our hosting provider. We don't use it for anything else. |
Umbral does not ask for or use your location, and does not collect your contacts, photos, browsing history, advertising identifiers or payment details. Your recommendations are calculated on your device.
Information stored on your device
Umbral keeps a copy of your account data, streaming catalogs and downloaded poster images on your device so the app is fast and works with a weak connection. Signing out or deleting the app removes this local copy.
How we use information
- To provide the app: your account, recommendations, lists and sync.
- To send service emails you need, such as confirmation and password-reset codes. We don't send marketing email unless you choose to receive it.
- To keep Umbral secure and to fix problems.
- To comply with the law.
We do not sell or rent personal information, use it for advertising, or share it with data brokers.
Service providers we use
We rely on a small number of providers to run Umbral. They process information only to provide their service to us.
- Supabase: account sign-in, secure storage of your account data, and the servers that pass title details and searches to TMDB. Supabase also hosts the streaming catalogs the app downloads.
- Email delivery: our authentication provider, or an email service acting for us, sends your sign-in and reset codes.
- The Movie Database (TMDB): title details and your Library searches go through our servers, which pass them to TMDB without your IP address or any account information. We don't store your searches. Posters and other images load directly from TMDB, so TMDB receives your device's IP address with those requests. Streaming availability data is provided by JustWatch through TMDB. See TMDB's privacy policy.
- Sentry: receives crash and error reports from the app (see above) so we can fix problems. Reports aren't linked to your account, and Sentry doesn't store your IP address for Umbral. See Sentry's privacy policy.
- Expo: delivers app updates and, if you turn on Watchlist alerts, delivers those notifications. When the app opens, it checks Expo's servers for a newer version of the app's code. Expo receives your device's IP address and a random ID for this installation of the app, which isn't linked to your account and changes if you reinstall. Expo uses them to deliver updates and count active installations. For Watchlist alerts, Expo's push service receives your device's push token and the text of each alert, and passes them to Apple's push notification service for delivery. See Expo's privacy policy.
- Apple: distributes the app through the App Store under Apple's own terms and privacy policy.
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger, sale or transfer of the business. In that case this policy continues to apply to your information.
How long we keep it
We keep your account data for as long as you have an account. When you delete your account, your account and the data linked to it are deleted from our live systems right away. Copies may remain in our providers' routine backups for a limited time until those backups are replaced. Technical request logs are kept for one day. Crash and error reports are kept for up to 90 days.
Your choices and rights
- Delete your account: in the app, go to Profile → Delete account. This permanently deletes your account, ratings, lists and service choices.
- Edit your data: change or remove any rating, list item or service in the app at any time.
- Notifications: Watchlist alerts are off unless you turn them on. Turn them off any time in Profile → Watchlist alerts, or in your iPhone's Settings.
- Get a copy of your data, or ask a privacy question: email privacy@onyxryft.com and we'll respond within 30 days.
Depending on where you live, you may have additional rights under local law, such as the right to access, correct, delete or obtain a copy of your personal data. Contact privacy@onyxryft.com to use them. We won't treat you differently for doing so.
Security
Data is sent over encrypted connections (HTTPS), and access to account data is restricted so each account can only read and change its own data. No system is perfectly secure, but we work to protect your information and will notify you if a breach affects you, as the law requires.
Children
Umbral is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.
Where your data is processed
Onyx Ryft is based in the United States, and our providers may process data in the United States and other countries. By using Umbral, you understand that your information will be processed there.
Changes to this policy
If we change this policy, we'll update the effective date above. If the change is significant, for example new kinds of data collected, we'll also let you know through the app or by email before it takes effect.
Contact
Onyx Ryft LLCprivacy@onyxryft.com
This product uses the TMDB API but is not endorsed or certified by TMDB. Streaming availability data provided by JustWatch.