Privacy Policy

Last updated: 23 May 2026

This privacy policy explains what personal data följa (the "Service") processes, why, on what legal basis, and what rights you have. The policy applies to the följa mobile and web applications and to this website.

1. Controller

The controller responsible for processing your personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:

Email: info@följa.com

2. What we process and why

2.1 Account data

When you create an account, we process your email address and a hashed password through Supabase Auth. We use this data to provide access to your account.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Storage: Supabase project hosted in the EU (Frankfurt, eu-central-1).

2.2 Watch logs, library, lists and storage

Data you create in the app — watch events (media, date, platform or physical format), library items, custom lists, storage containers, and your selected streaming platform subscriptions — is stored in our Supabase database. Database row- level security ensures only you can read or modify your own data.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Storage: Supabase, EU (Frankfurt).

2.3 Media metadata from TMDB

When you search for or open a movie or TV show, the Service contacts the TMDB API (The Movie Database, operated from the United States) to fetch titles, descriptions, posters, cast, and episode information. The query contains the search term or the TMDB ID of the title you opened, but not your account email or other account identifiers.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing media information).
• Recipient: The Movie Database (US). See their privacy policy.
• Transfer mechanism: EU Standard Contractual Clauses where applicable.

2.4 CSV and JustWatch imports

When you import a CSV file or a JustWatch HAR export, the file is parsed locally on your device. Only the resulting watch logs are written to our Supabase database. The original import file is never uploaded to our servers.

2.5 Website and app hosting logs

This website and the web version of följa are served by Firebase Hosting (operated by Google LLC / Google Ireland). When you access them, the hosting provider automatically receives technical access data such as your IP address, the requested URL, timestamp, referrer, and user agent. This data is used solely for delivering content and for security purposes (for example, abuse and attack mitigation).

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and securing the Service).
• Recipient: Google LLC / Google Ireland Limited. See Google's privacy policy.
• Transfer mechanism: EU Standard Contractual Clauses where applicable.

3. Sub-processors

4. International data transfers

Account and library data is stored in the EU. TMDB and Firebase Hosting may process data in the United States. Where transfers leave the EU/EEA, they are protected by EU Standard Contractual Clauses and, where applicable, supplementary measures.

5. Retention and deletion

We retain your account and the data you have entered until you request deletion of your account. To request deletion, send an email to info@följa.com from the address associated with your account. Hosting access logs are retained by the hosting provider according to its own retention schedule.

6. Cookies and local storage

följa does not use analytics, advertising, or tracking cookies. The web app stores a Supabase authentication token in your browser's localStorage so you remain signed in between visits. This is strictly necessary for the Service to function and does not require consent. No cookies are set by this website.

7. Your rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw any consent you have given, with effect for the future;
• lodge a complaint with a supervisory authority — for example, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) in Germany, or your local data protection authority.

To exercise these rights, contact us at info@följa.com.

8. Security

Connections to our servers and to TMDB are encrypted with HTTPS. Passwords are stored as salted hashes by Supabase Auth. Database access is restricted by row-level security so each user can only access their own data.

9. Children

The Service is not directed at children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy to reflect changes to the Service or to applicable law. The current version is always available at this URL. Material changes will be announced in the app or on this website.