Diplodocus collects the minimum it needs to work as a social recommendations app. No ads, no ad tracking, and your data is never sold.
What we collect
- Account — your email address (for sign-in) and the profile you create: username, optional bio and avatar.
- Activity — the titles you save, mark watched, and rate; the recommendations you send and receive (including notes); your comments and likes; who you follow and who follows you.
- Push token — a device token so we can deliver notifications (new recommendations, likes, replies). Stored only while you're signed in on that device.
- Reports and blocks — if you report content or block someone, we store that to act on it and to enforce the block.
- Usage events — which features get used, and when the app is opened and closed, so we can tell what's working. These carry no email, no name, and nothing you wrote or watched. They do carry your account's internal ID, your device model, your OS and app version, your language and time zone, and an approximate region derived from your IP address. Screen recording is off.
Who can see what
Your watched titles, ratings and activity are visible to people who follow you. A recommendation (and its note) is visible to the person you sent it to, and to people who follow you both. Comments are visible to whoever can see the activity they're posted on. Blocking someone makes you invisible to each other, both ways.
Comments and notes are not end-to-end encrypted. Like on most social apps, they're stored on our servers and can be accessed by us when needed — for example to review a report.
Where it lives, and who else is involved
- Supabase hosts the database and authentication.
- TMDB provides movie/series metadata; your searches are proxied through our backend, so TMDB doesn't receive your identity.
- TheTVDB provides public awards metadata (winners and nominees). Our servers fetch it on a schedule — the app never contacts TheTVDB, and nothing about you is sent to it. Metadata provided by TheTVDB.
- Expo / Apple / Google deliver push notifications.
- PostHog (EU servers) receives the usage events above, including the device and approximate-region details listed there. It is product analytics, not advertising — nothing is shared with advertisers or sold.
- Podcast audio streams directly from each show's public feed; trailers play via YouTube's embedded player, subject to YouTube's own terms.
Deleting your data
You can delete your own content (ratings, comments, watched entries, recommendations) in the app at any time.
To delete your account and all data associated with it, go to Profile → the settings gear → Delete account at the bottom of Settings. That takes effect immediately and cannot be undone. If you can't sign in, email darw.ahmad@gmail.com from the address you signed up with and we'll do it within 30 days. Full details of what deletion removes and what is retained.
Changes
If this policy changes materially, the update will appear here with a new "last updated" date.
Contact
Privacy questions: darw.ahmad@gmail.com.