NibletThe short version. We collect what we need to run Niblet: your account, your library and the social features you use. We don't show ads, we don't sell your data, and the Niblet apps contain no advertising, analytics or cross-app tracking software. You decide who sees your activity, and you can delete your account at any time from inside the app.
1. Who we are
This policy explains how Niblet ("Niblet", "we", "us") handles personal data when you use the Niblet apps for iPhone and Android (the "App") and the website at niblet-app.com (together, the "Service").
Data controller: Anıl Turgut, Ataşehir, Istanbul, Türkiye · email: support@niblet-app.com.
Your personal data is collected electronically and by automated means through the App and the website, and when you email us.
2. Information you give us
Account
- Email and password when you create an account. Passwords are stored by our authentication provider in hashed form; we never see them in plain text.
- Username and display name, which identify you to other people on Niblet.
- Sign in with Apple or Google. If you choose one of these, we receive a unique account identifier and, depending on what you share, your name and email address (which may be an Apple private relay address).
Profile
- Profile photo and cover photo you upload, a short bio, and the top movies and series you pin to your profile.
- Optional details you choose to add, such as profile mood, zodiac sign and favorite genre.
Your library and activity
- Titles on your watchlist, what you're watching and what you've watched, including rewatches.
- Ratings (including episode ratings), the date you watched, where you watched (for example cinema or home) and who you watched with, if you add them.
- Notes and reviews, their visibility setting (everyone, friends or only you), spoiler flags and reactions.
- Folders, lists, shared watchlists and series progress.
- Niblet Match activity: the mood and filters you choose and how you swipe on titles. We use this to build your recommendations.
- Your language and watch region, used to show content and streaming availability for where you are.
Social features
- Friend requests, friendships and accounts you follow.
- Titles you recommend to friends, including any note you add, and watch-together invites and responses.
- People you block and reports you submit (the reported content, the reason and any details you add).
Support
If you email us, we receive your email address and whatever you include in your message.
3. Information collected automatically
- Push notification token. If you allow notifications, we store your device's push token and app language so we can send you notifications in the right language.
- Technical logs. Our hosting providers keep standard server logs (such as IP address, time of request and request type) to operate and secure the Service.
- On-device storage. The App stores your settings, a cache of images and catalog data, and your sign-in session (in the iOS Keychain or Android secure storage) on your device.
The App does not collect advertising identifiers, precise location, contacts or your photo library (beyond the photos you choose to upload), and it doesn't use analytics or tracking SDKs.
4. Importing and exporting your history
When you import an IMDb or Letterboxd export, the file is read on your device. Only the details needed to identify each title (such as its name and year) are sent, through our server, to The Movie Database (TMDB) for matching. You review the matches, and only the titles you confirm are saved to your Niblet library together with the ratings and dates from your file.
The Export Data feature creates a CSV file of your watched titles and watchlist on your device, which you can save or share as you choose.
5. Guest mode
If you continue as a guest, your choices are stored only on your device. We don't create an account for you, and no library data is sent to our servers.
6. How we use your information
- To provide the Service: keeping your account and library in sync across devices, showing title information and streaming availability, and running features like Match, stats, Recaps and Wrapped.
- To personalize: recommendations are calculated from your ratings, library, Match choices and swipes. They are suggestions only and have no legal or similarly significant effect on you.
- For social features: showing your profile and activity according to your privacy settings, calculating taste compatibility with friends, and delivering recommendations and invites.
- To send notifications such as friend requests, recommendations from friends and watch-together invites. Monthly recap and Wrapped reminders are scheduled on your device.
- For safety: reviewing reports, enforcing our Terms of Use, and preventing abuse, fraud and security incidents.
- To provide support and respond to your requests, and to comply with legal obligations.
7. Legal bases
We process each category of data for the purposes and on the legal bases below, under Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and, where it applies, the GDPR.
| Data category | Purpose | Legal basis |
|---|---|---|
| Account and identity: email, username, display name, Apple/Google account identifier | Providing the Service | Establishment and performance of a contract — KVKK Art. 5/2(c); GDPR Art. 6(1)(b) |
| Profile: photo, cover, bio, favorites | Showing your profile | Performance of a contract — KVKK Art. 5/2(c); GDPR Art. 6(1)(b) |
| Optional profile details: zodiac sign, profile mood, favorite genre | Showing them on your profile | Explicit consent — KVKK Art. 5/1; GDPR Art. 6(1)(a). You can withdraw consent by deleting these fields. |
| Library and activity: watchlist, watched titles, ratings, watch date, place and companions, notes, lists, Match swipes | Providing and personalizing the Service | Performance of a contract — KVKK Art. 5/2(c); GDPR Art. 6(1)(b) |
| Social: friendships, follows, recommendations, invites | Social features | Performance of a contract — KVKK Art. 5/2(c); GDPR Art. 6(1)(b) |
| Blocks and reports | Safety and moderation | Legitimate interest — KVKK Art. 5/2(f); GDPR Art. 6(1)(f); and legal obligation — KVKK Art. 5/2(ç); GDPR Art. 6(1)(c) |
| Push token and app language | Sending notifications | Performance of a contract — KVKK Art. 5/2(c); GDPR Art. 6(1)(b). You can turn off notification permission in your device settings. |
| Technical logs: IP address, request time | Security | Legitimate interest — KVKK Art. 5/2(f); GDPR Art. 6(1)(f) |
| Support emails | Responding to requests | Performance of a contract and legal obligation — KVKK Art. 5/2(c) and (ç); GDPR Art. 6(1)(b) and (c) |
You don't need to give explicit consent to use the Service; we rely on explicit consent only for optional profile details.
8. Who can see your information
- Public by default. Your username, display name, profile photo, cover, profile details, ratings, library, lists, favorites and activity are visible to other Niblet users.
- Private account. Turn on Private account in Settings and only your friends can see what you watch, your ratings, your lists, your favorites and your stats. Your username, display name and photo stay visible so people can find you and send friend requests.
- Your circle. Your followers, following and friends lists can only be opened by your friends, whether or not your account is private. The counts are visible to everyone.
- Notes and reviews are shown according to the visibility you choose for each one: everyone, friends or only you.
- Shared lists are visible to their members, and things you recommend are visible to the friend you send them to.
- Blocking. When you block someone, they can't see the content on your profile, your notes or your lists, can't find you in search, can't follow you, and can't send you requests or recommendations; any friendship or follow between you ends. They aren't notified.
9. Service providers and other parties
We don't sell your personal data or share it for advertising. We use the following providers to run the Service:
| Provider | What they do |
|---|---|
| Supabase | Database, authentication, file storage for profile and cover photos, and server functions. |
| Apple | Sign in with Apple, and push notifications on iPhone (APNs). |
| Google Sign-In and push notifications on Android (Firebase Cloud Messaging), and the fonts on our website (Google Fonts). | |
| Cloudflare | Hosting and security for our website, and cookieless website analytics. |
| TMDB | Movie and series information and images. Images are loaded directly from TMDB's servers, which therefore receive your IP address and standard request data. |
| OMDb API | IMDb, Rotten Tomatoes and Metacritic scores. Requested by our server; no personal data is sent. |
| JustWatch | Streaming availability, provided through TMDB. Links to streaming services take you to third-party sites and apps. |
Trailers open in YouTube or your browser and are governed by those services' own privacy policies. We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or transfer of the Service, in which case this policy will continue to apply.
10. Hosting and international transfers
- Your account and content data are hosted on Supabase servers in the European Union (Ireland). Our server functions may handle a request in a region closer to you while processing it.
- Notifications are sent through Apple (APNs) and Google (FCM). These providers may process data in other countries, including the United States.
- Images are loaded directly from TMDB's servers abroad, including in the United States; TMDB sees your IP address when this happens.
- Our website is delivered through Cloudflare's global network.
Transfers are made on the basis of appropriate safeguards, such as the standard contracts set by the Personal Data Protection Board under Article 9 of KVKK and the EU Standard Contractual Clauses under the GDPR.
11. How long we keep data
When you delete your account, your profile, library, ratings, notes, lists, friendships, preferences and uploaded photos are deleted from our production systems. If you used Sign in with Apple, we also revoke Niblet's access to your Apple ID. We keep data for the following periods:
- Account and content: for as long as your account exists.
- Encrypted backups after your account is deleted: up to 30 days.
- Technical server logs: up to 90 days.
- Report and moderation records: 1 year after the report is closed; if there is a legal dispute, until it is resolved.
- Support emails: 2 years after the request is closed.
- Push tokens: until you sign out or delete your account.
12. Your rights and how to apply
Under KVKK (Article 11) you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties it is transferred to in Türkiye or abroad, to ask for incomplete or incorrect data to be corrected, to ask for your data to be deleted or destroyed when the conditions are met and for those parties to be notified, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing. Depending on where you live, your GDPR rights of access, correction, deletion, portability, objection and restriction also apply.
- Edit your profile at any time in the App.
- Export your watched titles and watchlist from Settings › Export Data.
- Delete your account from Profile › Settings › Delete Account, or follow the steps on our support page.
- Control visibility with Private account, per-note visibility and blocking.
- Turn off notifications in your device settings.
To exercise your rights, write to support@niblet-app.com from the email address registered in our system, or send a written application to Anıl Turgut, Ataşehir, Istanbul, Türkiye. Applications are free of charge and are answered within 30 days at the latest. You also have the right to lodge a complaint with the Personal Data Protection Authority (KVKK) in Türkiye, or with your supervisory authority in the EU or UK.
13. Our website
niblet-app.com doesn't use cookies. It stores only your language preference, in your browser's local storage. The site is delivered through Cloudflare, which processes your IP address to serve and protect it, and it uses Cloudflare Web Analytics, a cookieless tool that counts visits in aggregate without building a profile of you. Fonts are loaded from Google Fonts, so Google sees your IP address when the page loads.
14. Children
Niblet is not intended for children under 13, or under the minimum age required in your country to consent to data processing. We don't knowingly collect personal data from children below that age. If you believe a child has given us personal data, contact us and we'll delete it.
15. Security
We protect your data with encryption in transit (HTTPS), access rules that limit each account to its own data, hashed passwords and secure on-device storage for sign-in tokens. No system is perfectly secure, so please use a strong, unique password.
If a security breach affects your personal data, we will notify the Personal Data Protection Authority and you as required by law.
16. Changes to this policy
We may update this policy as Niblet changes. We'll update the version and date at the top, and if a change is significant we'll let you know in the App before it takes effect.
17. Contact
Email support@niblet-app.com with any questions about this policy or your data.