Privacy Notice and Policy

Last updated: 26 September 2026

This notice has been prepared under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) for the Pick2Watch app and the pick2watch.com website. This page is an information notice. Advertising and tracking choices are collected separately in the app's UMP and ATT screens.

You can use Pick2Watch without an account; account data and sync are processed only when you sign in with Apple or Google. When we update this notice, we change the date above.

1. Data Controller and Contact

The data controller is Mustafa Turan, the individual who develops Pick2Watch. For privacy questions and KVKK requests: support@pick2watch.com

2. Personal Data We Process

• Account (only if you sign in): Email address, name and provider identifier from Apple or Google. If you choose "Hide My Email" with Apple, your email address is Apple's private relay address.
• Account-linked usage: Watchlist, Like / Dislike marks and genre signals, series progress (next season and episode and watching status).
• Content requests: Search text and query values such as region, language and excluded genres.
• Advertising: Advertising ID (IDFA only with ATT permission; Android advertising ID), IP address and the approximate location derivable from it, device and network information, ad impression and interaction information.
• Technical connection: IP address and standard network request information.
• Contact: Your email address and message when you write to us.

Theme, language, region preference, onboarding status and excluded genres are stored on your device and are not kept as a profile on the server. However, in a content request the region value (together with language and excluded genres, depending on the request) may be included as a parameter in the query sent to TMDB.

3. Purposes of Processing

• To create your account and let you sign in.
• To store your Watchlist, marks and series progress and sync them across your devices.
• To rank in-app recommendations using your like and genre signals (Settings → Personalization). We do not use these marks to build an advertising profile or for marketing.
• To show movie, TV and watch provider information and images.
• To show and measure ads so that the app can be offered free of charge.
• To provide the website and share pages and keep them secure.
• To carry out account deletion requests and answer requests and questions.

4. Legal Grounds

• Account, Watchlist, like and genre signals, series progress and the content service: establishment or performance of the service (contract), KVKK Art. 5(2)(c).
• KVKK requests: compliance with a legal obligation, KVKK Art. 5(2)(ç).
• General support emails: answering your request and running the service relationship, KVKK Art. 5(2)(c).
• Website and Cloudflare network data: providing the web service (KVKK Art. 5(2)(c)) and legitimate interest in security and abuse prevention (KVKK Art. 5(2)(f)).
• Personalised advertising: In version 1.0.2, the app serves non-personalised ads. Any future personalised advertising will be based on separately obtained explicit consent (KVKK Art. 5(1)).
• Limited technical AdMob data: IP, device and network information and ad impression and interaction information may be processed to the extent necessary to deliver ads, cap their frequency, keep them secure and prevent fraud and abuse. Where permitted, the advertising ID may also be used for these technical purposes: on iOS, the IDFA only with ATT permission; on Android, the Android advertising ID to the extent your device settings allow. Legal ground: legitimate interest, KVKK Art. 5(2)(f). This processing does not mean personalised advertising and does not replace required platform permissions.

5. Recipients and International Transfers

• Supabase: Hosting, database, sign-in and the TMDB request intermediary (tmdb-proxy). Database access is limited to the relevant account by RLS rules; Supabase processes this data as the infrastructure provider.
• Apple and Google: Sign-in with Apple or Google; revoking the Apple authorisation when an Apple account is deleted.
• Google (AdMob and UMP): Showing and measuring ads and the ad choices screen.
• TMDB: Movie and TV information. API requests go through tmdb-proxy; your IP address is not passed directly to the TMDB API, and values such as search text and region may be sent without identity information. Images are loaded directly from image.tmdb.org, so your IP address reaches TMDB's image server. Watch provider data is sourced from JustWatch via TMDB; the app does not send requests directly to JustWatch.
• Cloudflare: Website (Pages), share pages (Worker) and pick2watch.com email routing (Email Routing).

The infrastructure of Supabase, Google (including Google Sign-In and AdMob), Apple, TMDB and Cloudflare is located outside Türkiye. The data above is transferred abroad to these providers for the stated service purposes.

6. How Data Is Collected

Your data is collected electronically, by automated means, through the app, the website and email: from Apple or Google when you sign in, from the records you create in the app, from content requests, from the AdMob SDK and from website visits.

7. Retention and Account Deletion

Account and account-linked data are kept for as long as your account is active. You can delete your account in the app via Profile → Delete account; if you signed in with Apple, the Apple authorisation is revoked first.

After deletion, your account on Supabase and your Watchlist, like and dislike marks, genre signals and series progress are deleted automatically (cascade). Local settings on your device are not deleted automatically with your account; removing them may require deleting the app's data or the app. Providers' own operational records are outside the scope of this deletion and follow their own retention rules.

8. Your Rights and Requests

You have the rights set out in Article 11 of the KVKK, such as learning whether your data is processed, requesting information, knowing the third parties it is transferred to, and requesting correction, or erasure or destruction under Article 7 of the KVKK. You can send your request to support@pick2watch.com; we may ask for more information to verify your identity. Requests are concluded within 30 days at the latest.

9. Advertising, UMP and ATT

The app shows Google AdMob ads. Google's UMP ad choices screen is shown when required; on iOS, Apple's ATT permission is asked separately. You can later change these in the app via Settings → Privacy options (where required) and in iPhone Settings → Privacy & Security → Tracking. Choices made in these screens do not turn on ad personalisation in version 1.0.2.

The IDFA can be used only if you grant ATT permission. Even if you do not, AdMob may continue to process limited technical data such as IP, device and network information and ad impression and interaction information to serve ads. On Android, AdMob may use the Android advertising ID and Privacy Sandbox mechanisms; you can manage these in your device settings.

Pick2Watch is not an app directed at children.

10. Website, Cloudflare and Cookies

pick2watch.com is hosted on Cloudflare Pages; share pages starting with /s/ are served by a Cloudflare Worker. When serving pages, Cloudflare can see the visitor's IP address and standard network request information and may run its own technical mechanisms for infrastructure and security.

Share pages use the country Cloudflare determines from your connection to show watch providers; a share link may contain the sharer's region code. On these pages images come through Cloudflare and your browser does not connect to TMDB directly. The site uses no Pick2Watch cookies, analytics, trackers or localStorage.