Privacy policy

Your account

Your name and email address. If you sign up with a password, we store it hashed, never in plain text.

Google sign-in

If you continue with Google, we receive your Google account ID, name, email address and profile picture link. See Google user data below.

Your library

The titles you add to your watchlist and the ratings you give, with the date of each.

Sign-in sessions

For each device you sign in on: when the session expires, its IP address and browser details (user agent). They help keep your account secure.

Password reset

When you ask to reset your password, a one-time link that expires after 60 minutes, and a count of reset emails so the service can’t be used to flood inboxes.

To show where a title streams in your country, we read the country from your connection (your IP address, via our host) or your browser’s language. We use it for that page and don’t store it.

We only use cookies that sign-in needs: one that keeps you signed in and one that remembers your session for a few minutes so pages load faster. Signing in with Google also sets short-lived cookies that protect the sign-in from forgery. We use no advertising or analytics cookies, so there’s nothing to opt out of.

If you sign in with Google, we ask only for your basic profile (name, email address and profile picture) and use it only to create your account, sign you in and show your name. Google also gives us sign-in tokens, which are stored with your account and not used for anything else: we don’t access your Gmail, contacts, calendar, files or any other Google data.

We don’t sell Google user data, share it with anyone except the services below that run the app, use it for advertising, or use it to train AI models. Pop Next’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Pop Next’s access at any time from your Google Account.

These services run parts of Pop Next and process data for it:

Vercel

Hosts the app. Like any web server, it sees your IP address and keeps request logs for a limited time.

Neon

Hosts our database, where your account, library and sessions are stored.

Resend

Sends password reset emails, so it receives your email address and name when you ask for one.

Google

Signs you in, if you choose to use it.

TMDB

Movie and show information comes from TMDB, and your browser loads posters and images directly from TMDB’s servers, which see your IP address. We don’t send TMDB anything about you.

Ratings from other sites are fetched by title, never with anything about you. Links to trailers (YouTube) and streaming services (via TMDB and JustWatch) take you to those sites, where their own privacy policies apply.

Account and library

Until you ask us to delete your account.

Sessions

30 days after your last visit on that device, or until you sign out there. Resetting your password signs you out everywhere.

Reset links

60 minutes, or until used.

You can remove titles from your watchlist and change your ratings at any time. To get a copy of your data, correct it, or delete your account and everything linked to it, contact us using the address below. We’ll handle requests within 30 days.

Pop Next isn’t meant for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, contact us and we’ll delete it.

If this policy changes, we’ll update it here and change the date at the top.

A contact address for questions and requests about your data will be listed here soon.