KlaqThis policy explains how Klaq (the iOS and Android app and the server behind it, together the "Application") handles your personal data. The Application is run by Gabriel Henrique Silva ("we"), an individual established in Brazil, who is the data controller under the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD").
Who is responsible
- Controller and data protection officer: Gabriel Henrique Silva.
- Contact for privacy and for exercising your rights: [email protected].
Data we collect
Data you provide
- Account: email and password. The password is stored by the sign-in provider (Supabase) and never reaches us in plain text.
- Profile: name, @username, bio (optional), avatar color and whether your account is private or public.
- What you log: movies, series and episodes you watched, with dates, ratings and rewatches; your "Want to watch" list; your bookshelf, with status (want to read, reading, read), pages, dates and ratings.
- Community content: reviews, replies, reports you make and your acceptance of the community rules.
- Connections: who you follow, who follows you, follow requests and blocks.
- Searches: the text you type to search for movies, series, books and people.
Data generated by use
- Notification token for each device, if you allow notifications.
- Moderation records: when you post (for the posting limit), reports received by your content and, if applicable, a ban.
- Server logs: date and time, the address requested and connection data for each request, used to run the service, investigate errors and protect the Application.
What we don't collect: we don't ask for your age, location, contacts or photos. The Application doesn't use analytics, advertising or cross-app tracking tools, and we don't sell data.
What other people can see
The Application has social features. You must be signed in to see any content: nothing below is visible on the open web.
- Your profile (name, @username, bio, avatar color, follower counts) shows up in people search once you finish setting up your profile.
- Public account: anyone signed in can see your history, lists, bookshelf and activity (what you watched and rated).
- Private account: only the followers you accept see that content.
- Reviews and replies are public to anyone signed in, including from private accounts, and show the rating you gave the title.
- Blocks hide content both ways.
Why we use your data and the legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Creating and keeping your account, syncing your logs across devices and showing the catalog | Performance of a contract (item V) |
| Social features: profile, following, activity feed, reviews and replies | Performance of a contract (item V) |
| Sending push notifications (new followers, accepted requests, replies to your reviews and Klaq news) | Consent (item I), given through your device's notification permission and revocable at any time |
| Moderating content, enforcing the community rules, preventing abuse and keeping the service secure | Legitimate interest (item IX) |
| Making backups and restoring the service after a failure | Legitimate interest (item IX) |
| Complying with legal obligations and responding to authorities | Legal obligation (item II) and exercise of rights (item VI) |
Who we share data with
We rely on a few providers to run the Application. They process data on our behalf and only for these purposes.
- Supabase: sign-in (email, password and session). Older versions of the app also stored history, lists and notification tokens in Supabase.
- Google Firebase Cloud Messaging: delivering push notifications (the device token and the notification text).
- Cloudflare: the network that connects the Application to our server (requests go through it).
- Cloud storage: holds the database backups, which are encrypted before they leave the server.
- Catalog: TMDB (movies and series), Google Books, Open Library and BrasilAPI (books). Searches are made by our server, without sending your identity. Images (posters and covers) are loaded by your device directly from these services, which therefore receive your device's IP address.
We may also share data when required by law, by a court order or a competent authority, or to protect rights, the safety of users or the service itself.
International transfers
Some providers (such as Supabase, Google and Cloudflare) may store or process data outside Brazil, for example in the United States. These transfers follow article 33 of the LGPD, based on the contractual safeguards those providers offer and, where applicable, the rules of the Brazilian Data Protection Authority (ANPD).
How long we keep data
- Account and content: as long as the account exists. When you delete your account, the data is deleted (see Delete account).
- Items you delete (a history entry or a book on your shelf): removed from the server within 7 days. That window lets the deletion reach all your devices.
- Encrypted backups: up to about 6 months, then discarded automatically.
- Server and moderation logs: as long as needed to keep the service secure, or as long as the law requires.
- On your device: the app keeps a local copy of your library so it works offline. It is only removed when you uninstall the app.
Your rights
Under the LGPD (art. 18), you can ask at any time for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- portability of your data;
- deletion of data processed based on your consent;
- information about who we share your data with;
- withdrawal of consent.
You can do much of this in the app itself: edit your profile, make your account private, delete logs and reviews, block people and turn off notifications. For anything else, write to [email protected]. We may ask you to confirm that the account is yours. You can also file a complaint with the ANPD (www.gov.br/anpd).
If you live outside Brazil, we honor the rights provided by your local law (such as the GDPR in the European Union or the CCPA in California) through the same contact.
Notifications
Push notifications are only sent if you allow them. You can turn them off in Settings → Notifications in the app, or in your device settings.
Children and teenagers
The Application is not intended for anyone under 16. If we learn that an account belongs to someone younger without their guardians' consent, it will be deleted. Parents or guardians can request deletion at [email protected].
Security
Connections to the Application are encrypted (HTTPS). Access to your data requires a valid sign-in token, checked on every request. Backups are encrypted before they leave the server. No system is completely immune to failures, but we take reasonable technical and administrative measures to protect your data.
Security incidents
If an incident could create a relevant risk or harm to you, we will notify you and the ANPD, as required by the LGPD.
Changes to this policy
We may update this policy when the Application changes. The effective date is shown at the top of the page. Relevant changes will also be announced in the app.
Contact
Privacy questions: [email protected].