Privacy Policy

1. Introduction

Welcome to Bunkalist, a smart entertainment tracking app for movies, series, and anime. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application and this website.

Bunkalist is a personal project developed and operated by Naim Dridi Podadera as an individual developer. This is not a commercial entity or registered company.

By using Bunkalist, you agree to this Privacy Policy. If you do not agree, please do not use the app.

2. What Data We Collect

2.1 Account & Profile Data

When you create an account or sign in, we collect and store the following on our servers (Firebase Firestore):

• Google Sign-In: If you sign in with Google, we receive your Google account ID, display name, email address, and profile photo URL from Google's authentication service. This data is used solely to create and manage your Bunkalist account.
• Sign in with Apple: If you sign in with Apple (available on iOS), we receive your Apple user ID and, if you choose to share it, your email address from Apple's authentication service. Apple may provide a private relay email address instead of your real address. This data is used solely to create and manage your Bunkalist account.
• Anonymous Authentication: If you use the app without signing in, Firebase generates a persistent anonymous user ID (UID) for your device. This ID contains no personal information.
• User Profile: Your display name, profile visibility preference (public/private), and account settings you configure in the app.

2.2 Content Tracking Data

The core purpose of Bunkalist is to let you track what you watch. This data is stored in your account on our servers (Firebase Firestore) so it syncs across your devices:

• Watchlists: Movies, series, and anime you add to lists (e.g., Watching, Completed, Plan to Watch, Dropped).
• Ratings & Reviews: Any star ratings or text reviews you assign to content.
• Tops Lists: Custom ranked lists you create and optionally share publicly.
• Watch Progress: Episode tracking progress for series and anime.

2.3 Data Collected on Our Servers

• Anonymous UID / Account UID: Used to identify your account and sync data across devices.
• Subscription Data (RevenueCat): We use RevenueCat to manage premium subscriptions. RevenueCat collects your anonymous or account user ID, purchase receipts from Apple/Google, subscription status, and device information (platform, OS version, app version) to verify entitlements. RevenueCat does not have access to your payment information (credit card, billing address), which is processed exclusively by Apple App Store or Google Play Store. Learn more: RevenueCat Privacy Policy.
• Remote Configuration: We use Firebase Remote Config to deliver feature flags and app settings. This service logs minimal anonymous usage data (device type, app version) to determine which configuration to serve.
• Crash & Diagnostic Reports: We use Firebase Crashlytics and Sentry to collect anonymous crash reports and diagnostic data. This includes crash logs, device information (model, OS version), and app state at the time of crashes. No personal data or user-generated content is included in these reports. You can disable crash reporting in Settings at any time.
• Analytics Events: We use Firebase Analytics to collect anonymous, aggregated usage events (e.g., screen views, feature usage). This data does not identify you personally and is used solely to understand how features are used so we can improve the app.
• Push Notification Tokens: If you enable push notifications, Firebase Messaging stores a device token on our servers to deliver notifications. This token is linked to your account UID.

2.4 App Settings (Stored Locally)

Your app preferences (theme, default content type, notification settings, etc.) are stored locally on your device using secure storage and Shared Preferences. These are not transmitted to our servers.

2.5 Data We Do NOT Collect

• We do not collect your name or phone number unless you explicitly provide them (e.g., your display name is optional).
• We do not collect location data, contacts, or device photos.
• We do not use third-party advertising networks or tracking pixels.
• We do not include personal data, watchlist content, or user-generated text in crash reports.
• We do not sell your data to anyone, ever.

3. How We Use Your Data

We use the data we collect for the following purposes only:

• Core Functionality: To provide entertainment tracking features, sync your lists across devices, and manage your account.
• Subscription Management: To verify and manage your premium subscription entitlements via RevenueCat.
• Push Notifications: To deliver optional notifications about new releases or list activity that you have opted into.
• Feature Flags: Remote Config allows us to test new features and roll them out gradually without requiring app updates.
• App Stability: Anonymous crash reports help us identify and fix bugs to improve reliability and performance.
• Product Improvement: Anonymous, aggregated analytics help us understand which features are most useful.

We do not use your data for advertising, profiling, behavioural tracking, or any purpose other than those listed above.

4. Data Sharing & Third Parties

4.1 Third-Party Services Used

Bunkalist uses the following third-party services to operate. Each service operates under its own privacy policy:

• Firebase (Google): For authentication (anonymous, Google Sign-In, & Apple Sign-In via Firebase Auth), cloud database (Firestore), remote configuration (Remote Config), crash reporting (Crashlytics), analytics (Firebase Analytics), and push notifications (Firebase Messaging). Firebase processes data under Google's privacy policies. Firebase Privacy.
• RevenueCat: For subscription management and entitlement verification. RevenueCat receives your user ID, purchase receipts (from Apple/Google), subscription status, and basic device information. It does not receive payment details (credit card, billing address), which remain with Apple/Google. RevenueCat Privacy.
• Apple App Store / Google Play Store: For processing subscription payments. All payment information is handled exclusively by Apple or Google. We never have access to your payment details. They share only purchase receipts with us (via RevenueCat) to verify subscription status.
• The Movie Database (TMDB): We use the TMDB API to fetch content metadata (titles, posters, descriptions, cast, etc.). We do not share your personal data with TMDB; queries are made with a non-personal API key. TMDB Privacy Policy.
• Sentry: For additional error monitoring and performance tracing. Sentry receives crash logs and anonymised diagnostic information. No personal data or user-generated content is sent. Sentry Privacy Policy.
• Google Sign-In (Google Identity Services): For OAuth-based authentication. When you sign in with Google, Google shares your account ID, name, email, and profile picture with us for authentication purposes. Google Privacy Policy.
• Sign in with Apple (Apple Inc.): For OAuth-based authentication on iOS. When you sign in with Apple, Apple shares your Apple user ID and optionally your email address (or a private relay address) with us via Firebase Authentication. Apple does not share your name or profile photo. Apple Sign-In is available on iOS devices only and is subject to Apple's privacy policy. Apple Privacy Policy.

4.2 No Data Selling

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes under any circumstances.

4.3 Legal Disclosures

We may disclose your data if required by law, court order, or government regulation, or to protect our legal rights, prevent fraud, or ensure the safety of users.

5. Device Permissions

Bunkalist requests the following device permissions only when you use specific features. All permissions are requested just-in-time, not at installation:

• Notifications: Required to send push notifications about new releases or list activity. You can grant or revoke this permission at any time in your device settings. All notification categories are individually controllable within the app's Settings.
• Internet Access: Required to fetch content metadata from TMDB, sync your lists with Firebase, and manage subscriptions via RevenueCat. This permission is always required for the app to function.
• Camera / Photo Library (optional): If you set a custom profile photo, we request access to your camera or photo library. The selected image is uploaded to our servers and associated with your profile. You can remove your profile photo at any time.

We never access your microphone, contacts, location, or any device permission not listed above.

6. Data Retention & Deletion

6.1 Local Data

App preferences and settings stored locally on your device are retained until you uninstall the app or clear app data. Uninstalling the app removes all locally stored data.

6.2 Server-Side Data

• Account & Watchlist Data: Stored in Firebase Firestore as long as your account exists. If you delete your account from within the app, your Firestore data (profile, lists, ratings, tops) will be permanently deleted within 30 days.
• Anonymous UID: Stored indefinitely unless you uninstall the app (no backup restore). Uninstalling without a linked account permanently removes the anonymous session.
• Crash Reports: Stored in Firebase Crashlytics and Sentry indefinitely for app stability analysis. You can disable crash reporting in Settings, or request deletion by contacting us.
• Push Notification Tokens: Stored as long as you have notifications enabled. Revoking notification permission in your device settings will cause the token to expire and be cleaned up automatically.

6.3 Right to Deletion

You can request deletion of any data we hold on our servers by emailing bunkalist@gmail.com. We will delete your account data, anonymous UID, crash reports, and any associated server-side data within 30 days.

You may also delete your account directly from the app via Settings → Account → Delete Account, which initiates the deletion process immediately.

7. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the data we hold about you (account profile, watchlist data, anonymous UID, crash reports).
• Right to Portability: Request an export of your watchlist data.
• Right to Correction: Request correction of inaccurate data in your profile.
• Right to Deletion: Request deletion of your account and all associated server-side data (see Section 6.3).
• Right to Restriction: Request that we limit processing of your data (e.g., stop using crash reports from your device).
• Right to Object: Object to processing of your data for specific purposes (e.g., analytics or crash reporting, which can be disabled in Settings).
• Right to Withdraw Consent: Withdraw consent for optional data processing at any time by adjusting your Settings or deleting your account.
• Right to Lodge a Complaint: If you believe we have mishandled your data, you can file a complaint with your local data protection authority (e.g., CNIL in France, AEPD in Spain, ICO in the UK).

To exercise any of these rights, contact us at bunkalist@gmail.com.

CCPA (California): California residents have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at the email above.

8. Children's Privacy

Bunkalist is intended for users aged 13 and over (or the minimum digital consent age in your jurisdiction). We do not knowingly collect personal information from children under 13. If a parent or guardian becomes aware that their child has provided us with personal data without consent, please contact us immediately at bunkalist@gmail.com and we will delete the data promptly.

If you are under 16 and located in the EU/EEA, you must obtain parental or guardian consent before using Bunkalist and providing any personal data.

9. Security Measures

We take the security of your data seriously and implement the following measures:

• Secure Storage: Sensitive local data (e.g., authentication tokens) is stored in iOS Keychain / Android Keychain via Flutter Secure Storage — never in plain-text storage.
• TLS Encryption: All data transmitted between the app and our servers or third-party APIs is encrypted in transit using TLS 1.2+.
• Firebase Security Rules: Firestore and other Firebase services are configured with security rules that restrict data access strictly to the authenticated account owner.
• No Plain-Text Logging: We do not log personal information, watchlist content, or account data in plain text in crash reports or logs.
• Dependency Management: We regularly review and update our dependencies to patch known security vulnerabilities.

While we strive to protect your data, no method of transmission or storage is 100% secure. You are responsible for safeguarding your device and account credentials.

10. Cookies & Website Tracking

This website (bunkalist.app) is hosted on Firebase Hosting. We do not use cookies for tracking or analytics on this website. The only cookies present may be essential session cookies required by Firebase Hosting for CDN caching functionality. We do not use Google Analytics, advertising pixels, or other third-party tracking technologies on this website.

The Bunkalist mobile app does not use cookies.

11. Premium Subscriptions & Payment Processing

Bunkalist offers optional premium subscriptions (Monthly, Annual, and/or Lifetime) managed through RevenueCat and processed by Apple App Store or Google Play Store billing systems.

11.1 What Data is Collected for Subscriptions

• Payment Information: Your credit card, billing address, and payment details are processed exclusively by Apple or Google. We never have access to your payment information.
• Purchase Receipts: Apple/Google provide purchase receipts to verify your subscription status. These receipts are shared with RevenueCat to manage entitlements.
• User ID: Your account or anonymous UID is linked to your subscription to sync premium status across devices.
• Subscription Status: RevenueCat tracks whether you have an active subscription, trial status, and expiration dates to grant or revoke premium features.

11.2 How Subscription Data is Used

• To verify your entitlement to premium features.
• To sync your subscription status across multiple devices.
• To manage free trials and auto-renewal.
• To process refunds and handle subscription issues (via Apple/Google support).

11.3 RevenueCat's Role

RevenueCat acts as a subscription management platform. It does not process payments or store payment information. RevenueCat only receives anonymous identifiers and purchase receipts to verify subscription status. See: RevenueCat Privacy Policy.

11.4 Subscription Data Retention

Subscription data (user ID, purchase receipts, subscription status) is retained as long as you have an active or expired subscription in RevenueCat's system. If you request deletion of your data (see Section 6.3), we will delete your user ID and subscription records within 30 days. Apple and Google may retain payment and purchase history under their own policies.

12. International Data Transfers

Bunkalist uses Firebase services, which may store and process data in data centres located in the United States and other countries. If you are located in the European Economic Area (EEA) or other regions with data protection laws, your data may be transferred to countries with different privacy protections.

Firebase (Google) complies with the GDPR through Standard Contractual Clauses (SCCs) and other appropriate safeguards. Learn more: Firebase Privacy & Security.

RevenueCat is headquartered in the United States and processes subscription data under its own GDPR compliance framework. See: RevenueCat Privacy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

We will respond to your inquiry within 30 days.

Note: As this is a personal project operated by an individual developer, there is no formal Data Protection Officer (DPO). All data protection inquiries should be directed to the email above.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or app features. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via an in-app message or, where available, via email.

Continued use of Bunkalist after changes take effect indicates your acceptance of the updated policy.

15. Summary of Key Points