Privacy Policy — Zappix

Last updated: 24 August 2026

Zappix (“the app”, “we”) is a mobile app for tracking TV shows, films and manga. We take your privacy seriously. This policy explains, in accordance with the General Data Protection Regulation (GDPR, EU 2016/679), what data we process, why, on what legal basis, with whom, for how long, and what your rights are.

1. Data controller

The data controller is Thomas Vignet, sole trader operating under the business name “Zappix”, registered in France under SIRET number 10781409700013, publisher of the Zappix app.
Contact: contact@getzappix.net.

2. Data we process

Category	Data	Source
Account	Email address, password (encrypted, never readable by us)	Provided by you when you sign up
Profile	Display name and @username, avatar colour, avatar, banner, frame and title bought in the shop	A neutral display name (“Member 4821”) and its @username are assigned to you automatically when you sign up: we derive nothing from your email address. You can change them at any time. The colour and theme are optional.
Viewing activity	Shows/films tracked, episodes watched, films watched, manga progress (chapters read), favourites, custom lists	Generated by your use of the app, or imported by you from another service’s export (TV Time, or a Zappix backup)
Game progress	Level, experience points, unlocked trophies	Calculated from your activity
Published content	Ratings given to titles, reviews written, replies to other members’ reviews, emoji reactions on reviews, and — for any list you choose to publish — its name and the note you attach to it	Published by you
Relationships	Friend requests sent and received, friends list	Generated by your interactions
Moderation	Reports you submit, users you block	Generated by your actions
Settings	Notification preference	Stored on your device
Technical	Minimal operational data (authentication), device notification token if you enable notifications	Automatic

We do not collect: your location, your contacts, your banking, biometric or health data. Zappix uses no behavioural analytics tools and never sells your data.

Advertising. Zappix displays no advertising and embeds no ad network. No advertising identifier is read or transmitted.

3. Purposes and legal bases

Purpose	Legal basis (GDPR art. 6)
Create and secure your account, authenticate you	Performance of the contract (Terms of Use)
Record and sync your viewing activity across your devices	Performance of the contract
Show you your personal statistics	Performance of the contract
Send you notifications (episode releases, friend requests, your friends’ reviews)	Your consent (can be enabled/disabled)
Publish your ratings and reviews, and show them to other users	Performance of the contract (a feature you trigger)
Let you add friends and compare your libraries	Performance of the contract
Display leaderboards (top titles, most active members)	Performance of the contract
Moderate published content (filtering, reports, blocks)	Legitimate interest, and obligations under the distribution platforms’ rules
Ensure security and prevent abuse	Legitimate interest

4. Recipients and processors

We neither sell nor rent your data.

4.1 What other users can see

Zappix has social features. Some information is therefore visible to other signed-in users:

Information	Who can see it
Display name, @username, avatar colour	All users (friend search, leaderboards)
Avatar and frame chosen in the shop	All users (leaderboard, friends list, your profile)
Banner and title chosen in the shop	All users, on your profile. They appear neither on the leaderboard nor in the friends list.
Level, XP, number of episodes, films and chapters	All users (member leaderboard)
Your total watch time	All users, on your profile
Ratings and reviews you publish, with your display name	All users, on the page of the title concerned
Friend code	Anyone you give it to. No longer assigned to new accounts.
Your list of shows and your watched films	Your friends. And, if you turn on “Public profile” in your profile, all users. Off by default.
The favourites you put on display, and your favourite people and characters	Your friends. And all users if “Public profile” is on. Your other favourites stay private.
The lists you publish, and those you share	All users for a published list; only the people invited for a shared list. Your other lists stay private.

Conversely, the following stay strictly private: your email address, the episode-by-episode detail of your progress, your zaps and your shop purchases, the users you have blocked and the reports you submit (the identity of the person reporting is never disclosed).

Controlling who sees your list: by default, only someone you have accepted as a friend can view your list. The “Public profile” setting, in the Profile tab, extends this visibility to all members; you can turn it off at any time, and removing a friend ends their access immediately.

You stay in control: you can change your display name and @username at any time, delete your reviews, remove a friend, block a user, or delete your account.

4.2 Moderation of published content

To protect users, reviews go through an automatic language filter before publication. You can report a review or a published list, and block a user; a review reported often enough is hidden automatically. This moderation data is kept for as long as is necessary to deal with abuse.

4.3 Processors

To operate, the app relies on:

Supabase — database hosting, authentication and storage of your account and your activity. Hosted in the European Union (Frankfurt region). Supabase privacy.
The Movie Database (TMDB) — provides the TV and film catalogue. Your searches are sent to TMDB so it can return results; no personally identifiable data is transmitted to it. TMDB privacy.
AniList (manga) and, where applicable, TVmaze (TV shows) — provide metadata; same principles as TMDB (no personal data transmitted).
Brevo — sends the service’s emails (sign-up confirmation, password reset). Only your email address is passed to it, solely to deliver those messages. French company, data hosted in the European Union. Brevo privacy.
RevenueCat — manages Premium subscriptions. Receives an anonymous identifier and the state of your subscription; neither your email address nor your viewing data. No payment method passes through Zappix: the purchase is made in Google Play. US company. RevenueCat privacy.
Expo Push (Expo Inc., United States) and Google Firebase Cloud Messaging — deliver push notifications to your device. They receive your device push token and the text of the notification, which contains the display name of the member who triggered it (a friend request, an accepted request, a new review from a friend). They never receive your email address or your viewing data. Notifications can be turned off in Settings, which deletes the token. Expo privacy.
Google Play — distribution of the app (subject to Google’s policy).

5. Transfers outside the European Union

Your account and viewing data are hosted in the EU (Supabase, Frankfurt), and so are the emails we send (Brevo, France).

Two kinds of exchange do leave the EU:

Catalogue queries — TMDB and AniList are located outside the EU. What reaches them is a search term or a title identifier, never anything that identifies you.
Push notifications — if you turn them on, the text of each notification and your device token pass through Expo Push (United States) and Google Firebase Cloud Messaging. That text contains the display name of the member who triggered it. This is personal data leaving the EU, and it only happens while notifications are enabled: turning them off in Settings deletes the token and stops the transfer.
Subscription state — RevenueCat (United States) receives an anonymous identifier and whether your subscription is active.

These transfers are covered by appropriate safeguards (standard contractual clauses).

6. Retention period

Your data is kept for as long as your account exists. If you delete your account (see section 8), all of your data is erased immediately. You may also simply stay inactive: we keep no data beyond what the service requires.

This applies to your published content too. When your account is deleted, your reviews and their replies, ratings, emoji reactions, friendships, public profile, custom lists, reports and notification tokens are deleted at the same time — nothing is kept in anonymised form. A review you delete individually disappears immediately as well, along with the replies and reactions it carried.

7. Your rights

Under the GDPR, you have the following rights:

Access — find out what data we hold about you.
Rectification — correct your information (e.g. display name).
Erasure (“right to be forgotten”) — delete your account and all your data.
Portability — retrieve your data in a readable format (JSON/CSV).
Objection and restriction — object to certain processing.
Withdrawal of consent — turn off notifications at any time.

8. How to exercise your rights

Portability: directly in the app, via Profile → Import / Export (JSON or CSV export).
Rectification: via Profile → Edit profile.
Erasure: via Profile → Delete my account (immediate and permanent deletion of all your data).
Other requests: write to us at contact@getzappix.net; we reply within 30 days.

9. Security

Traffic is encrypted in transit (HTTPS). Access to data is protected by authentication and by row-level security rules (Row Level Security): each user reaches only their own data. Passwords are stored in encrypted form and are never accessible to us in clear text.

Data breach: in the event of a breach likely to result in a risk to your rights, we will notify the supervisory authority (the French CNIL) within 72 hours and, where necessary, the individuals concerned, in accordance with articles 33 and 34 of the GDPR. We apply the principles of data protection by design and minimisation (we collect only what is strictly necessary).

10. Cookies and trackers

The app uses no cookies. Technical data strictly necessary for operation (session token) is stored locally on your device. No advertising tracker is embedded.

11. Minors

The app is not intended for children under 16. The GDPR sets the digital age of consent at 16, with each country of the European Economic Area free to lower it to as young as 13 — France sets it at 15, Germany and Ireland at 16. Zappix applies 16, the highest, so that the same rule holds in every country where the app is distributed. If you are under 16, do not use Zappix without your parents’ agreement.

12. Changes

This policy may change. The “last updated” date at the top of the page indicates the version in force. If a change is significant, we will tell you in the app.

13. Contact and complaints

For any question: contact@getzappix.net.
You may also lodge a complaint with a supervisory authority. As the controller is established in France, the lead authority is the CNIL (www.cnil.fr); you may equally contact the supervisory authority of the EEA country in which you live.