Privacy Policy

Last updated: 27 September 2026

This privacy policy explains what personal data följa (the "Service") processes, why, on what legal basis, and what rights you have. The policy applies to the följa apps for the web, Android and Windows, to the följa browser extension, and to this website.

1. Controller

The controller responsible for processing your personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:

Email: info@följa.com

2. What we process and why

2.1 Account data

When you create an account, we process your email address and a hashed password through Supabase Auth. We use this data to provide access to your account.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Storage: Supabase project hosted in the EU (Frankfurt, eu-central-1).

2.2 Watch logs, library, lists and storage

Data you create in the app — watch events (media, date, platform or physical format, rating and notes; for an imported entry also the service it came from and that service's id for it), library items, custom lists, tags, rooms and storage containers, and your settings such as your streaming platform subscriptions — is stored in our Supabase database. Database row-level security ensures only you can read or modify your own data.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Storage: Supabase, EU (Frankfurt).

2.3 Media metadata from TMDB

When you search for or open a movie or TV show, the Service contacts the TMDB API (The Movie Database, operated from the United States) to fetch titles, descriptions, posters, cast, and episode information. The query contains the search term or the TMDB ID of the title you opened, but not your account email or other account identifiers.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing media information).
• Recipient: The Movie Database (US). See their privacy policy.
• Transfer mechanism: EU Standard Contractual Clauses where applicable.

2.4 Trailer previews from YouTube

When a title's page lists trailers or clips, their preview images are loaded from YouTube. The request contains the video's id, but not your account email or other account identifiers. Playing a video opens it on YouTube, where YouTube's own privacy policy applies.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing a title's videos).
• Recipient: Google Ireland Limited / Google LLC (YouTube). See Google's privacy policy.
• Transfer mechanism: EU Standard Contractual Clauses where applicable.

2.5 Imports

When you import a file — a CSV saved by the följa browser extension, a file exported from följa, or any other CSV — it is parsed locally on your device and never uploaded to our servers. Only the entries you confirm before the import finishes are written to our Supabase database.

To find the titles in the file, the app searches TMDB for their names (see 2.3). For rows from Netflix or Prime Video it first looks up those services' title ids on Wikidata, which lists the matching TMDB entry. The lookup contains only those title ids, not your account email or other account identifiers.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in matching imported titles correctly).
• Recipient: Wikidata, operated by the Wikimedia Foundation (US). See their privacy policy.
• Transfer mechanism: EU Standard Contractual Clauses where applicable.

2.6 Browser extension

The följa browser extension works only on the JustWatch, Netflix and Prime Video sites, including Prime Video's watch history on Amazon's own sites. When you ask it to, it reads the watch history the site shows you and saves it as a CSV file through your browser's download dialog. It sends nothing to us or to anyone else: its only network requests go to the site you are on, the same ones the site makes itself. The last export stays in your browser's extension storage until the next one replaces it or you remove the extension. The extension's use of the data it reads complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

2.7 Website and app hosting logs

This website and the web version of följa are served by Firebase Hosting (operated by Google LLC / Google Ireland). When you access them, the hosting provider automatically receives technical access data such as your IP address, the requested URL, timestamp, referrer, and user agent. This data is used solely for delivering content and for security purposes (for example, abuse and attack mitigation).

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and securing the Service).
• Recipient: Google LLC / Google Ireland Limited. See Google's privacy policy.
• Transfer mechanism: EU Standard Contractual Clauses where applicable.

3. Sub-processors

4. International data transfers

Account and library data is stored in the EU. TMDB, YouTube, Wikidata and Firebase Hosting may process data in the United States. Where transfers leave the EU/EEA, they are protected by EU Standard Contractual Clauses and, where applicable, supplementary measures.

5. Retention and deletion

We retain your account and the data you have entered until you request deletion of your account. To request deletion, send an email to info@följa.com from the address associated with your account. Hosting access logs are retained by the hosting provider according to its own retention schedule.

6. Cookies and local storage

följa does not use analytics, advertising, or tracking cookies. The web app stores a Supabase authentication token in your browser's localStorage so you remain signed in between visits. This is strictly necessary for the Service to function and does not require consent. The apps also keep a few things on your device only, never sent to us: your recent searches, a copy of the titles and posters you have looked at so pages open faster, and settings that belong to that device. No cookies are set by this website; it only remembers in localStorage whether you chose to see the phone or the desktop screenshots.

7. Your rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw any consent you have given, with effect for the future;
• lodge a complaint with a supervisory authority — for example, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) in Germany, or your local data protection authority.

To exercise these rights, contact us at info@följa.com.

8. Security

Connections to our servers and to every service named above are encrypted with HTTPS. Passwords are stored as salted hashes by Supabase Auth. Database access is restricted by row-level security so each user can only access their own data.

9. Children

The Service is not directed at children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy to reflect changes to the Service or to applicable law. The current version is always available at this URL. Material changes will be announced in the app or on this website.