Vestigo Privacy Notice

Last updated: 25 October 2026

About this notice

This notice explains what personal information Vestigo collects, why, who receives it, how long we keep it, and the choices you have. It covers the Vestigo app for iOS (the “App”) and the website at vestigo-app.com (the “Website”).

Vestigo is a personal tracker for movies and series. Most of what you put into it stays on your device and in your own iCloud account.

Vestigo is created by Josiah Hyman and run by Katie Hyman (“Vestigo”, “we” or “us”), who is the controller of the personal information described in this notice. You can contact us at vestigosupport@gmail.com.

The short version

• Your library, ratings, notes and settings stay on your device and sync between your own devices through iCloud, unless you choose to share them with Friends.
• An account is optional and only needed for Friends.
• One switch in Settings covers usage statistics, crash reports and the activity we use to understand what is popular. It is on after you have seen a one time notice, and you can turn it off or delete your analytics data at any time.
• We do not sell your personal information, share it for advertising, or use advertising identifiers. Some third parties receive limited information to make features work, and the types of recipient are listed below.
• Deleting your account or your data does not remove everything. The Your choices and controls section explains what each option does.

Information on your device and in iCloud

The App stores on your device your library (watchlist, watched list, ratings, favourites, collections, notes, watched episodes and optional watch dates), your settings (including your display name, streaming region and streaming services), caches of title information and images, a cache of what your friends share with you, and identifiers for calendar events the App creates. Your sign in session and a copy of your analytics identity are kept in the iOS Keychain on that device only.

If iCloud is on, the App copies your library and settings, including your notes and display name, to iCloud so they sync between your devices. That copy is held by Apple under your iCloud account and Apple’s terms apply to it. Our servers do not receive it. You can turn off iCloud for Vestigo in iOS Settings.

Siri and Shortcuts actions run in the App on your device. Changes you make through them are treated like changes made in the App, including for Friends sharing and analytics.

Your account and Friends

Friends is optional and needs an account, which you create with Sign in with Apple. We ask Apple for your name once, only to suggest a display name. We do not request or store your email address.

If you create an account, we store your display name, an optional profile photo, your friend connections and invitations, your sharing settings, and copies of what you choose to share. Our backend is hosted by a cloud hosting provider in the United States.

What your confirmed friends can see

• Always, whatever your sharing settings: your display name, your profile photo, and the titles on your profile under “Featured” and “Excited for”. If you have not chosen Featured titles, the App shows up to six of your favourites there. You can change or clear any of these at any time.
• If you share your watchlist: your watchlist.
• If you share your watched items: your watched titles together with your ratings, what you are currently watching, your favourites, the date you watched each title and any notes you have written about those titles.

Sharing is off by default (“Don’t share anything”). Turning a share off deletes our copy, but cannot recall anything a friend has already seen. Only confirmed friends can see your information, and you can remove a friend at any time. Invitation links contain a token and expire after a short time.

Reporting. You can report a friend from their profile. When you report someone, we store the reason, any text you add, the date, the account IDs of both people, and a copy of the names and profile picks shown at the time. We review reports on our internal dashboard. The person you report is not told. Reports, and any action we take such as a warning, suspension or ban, are kept for a limited period for safety reasons, even if an account is deleted. For a ban, we keep a scrambled form of your Apple sign in identifier so you cannot rejoin while banned. If we take action, we may show you a message in the App. If you block someone, we record that you did; they are not told.

Lookups, location and device features

Lookups made through our servers

When you search for or open a title, or ask Siri where something streams, the App sends the search text or title IDs, and where relevant your streaming region, to our backend. Our backend then asks third party data sources using our own keys: film and TV databases, streaming availability and recommendation services, an open knowledge database, a video platform (to check trailers) and a cinema chain (for showtimes). Those sources see our server, not your device or IP address, and these requests carry no account information. If you enter your own key for our ratings service, it is sent through our backend to that service with ratings requests.

Our hosting providers receive your IP address with these requests and keep standard request logs for a limited period. To prevent abuse we limit how many requests can be made:

• For lookups this uses your IP address, held briefly by our rate limiting provider.
• For analytics uploads it uses a scrambled version of your IP address that changes regularly and is deleted shortly afterwards.
• For Friends actions it uses your account ID, which is also kept only briefly.

Requests your device makes directly

Some features contact third parties directly from your device, so they see your IP address and what was requested: images from a film database, website icons from a search provider, related titles from an open knowledge database, and trailers from YouTube’s privacy enhanced player when you open one. These services handle your information under their own privacy notices. Links you tap open in your browser or another app.

Location

Vestigo uses your location only when you search for nearby cinema showtimes, and only with your permission while you are using the App. The App rounds your coordinates to about 1 km and sends them to our backend, which passes them to a cinema chain’s showtime service. Neither the App nor our backend stores them. Apple Maps also receives your device’s location directly to find nearby cinemas, work out your country and estimate driving times.

Calendar, camera and photos

If you add a release date to your calendar, Vestigo asks for permission to add events. It does not read your calendar. Camera and photo access are used only to set a profile photo.

Analytics and diagnostics

A single switch in Settings, under Data, called “Share usage and activity to help Vestigo”, covers three things: usage statistics, crash reports and popularity analytics. Before anything is sent, each of your devices shows a one time notice, “Help Improve Vestigo”. After you tap OK, sharing is on until you turn it off. The switch applies to all your devices through iCloud. Turning it off stops further sharing straight away, but does not delete what was already sent.

Usage statistics

We use an analytics provider based in the United States to see which screens and features are used. The App creates a random install ID that is not shared between your devices and is reset when you delete all data or your account.

Events include the tabs you open, the type of search (never the text), that you added or rated an item (never which title or the rating), use of features such as Pick For Me, cinema search, trailers, collections, Friends and streaming checks, and error categories. The provider also receives standard device information: app version, operating system, device model, language, region, time zone, screen size and network type.

Our analytics provider receives your IP address with each request, and we have set it not to store it. It keeps events for a limited period.

Crash reports

We use a crash reporting provider based in the United States to receive crash, hang and error reports and performance data for about 10 percent of sessions. Reports include device model, operating system, app version, memory and battery state, and use the provider’s own install ID. We do not send your name or account details, and we have not enabled the provider’s collection of personal information such as IP addresses.

Popularity analytics

We use activity to understand what is popular, how interest changes over time and which titles people with similar tastes enjoy. This works in two ways. Uploads are delayed by a random interval so they cannot be matched to the moment you acted.

Trend counts. When you mark something watched, add it to your watchlist, rate it or watch an episode, the App sends:

• the title and the type of action;
• a rating level (one of five) if you rated it;
• your streaming region and services, if you have set them;
• a tag calculated on your device.

The tag lets us avoid counting the same action twice, but cannot be used to link different titles to each other. Our server records only the day. We store counts, and keep region and services as separate counts. Tags are deleted after a period and the counts remain.

Library set. The App also keeps one record of your library under a random library ID: each title, whether it is on your watchlist or watched, and a rating level. It contains no names, account IDs or device identifiers, and apart from a month used to manage expiry it contains no dates. Your exact ratings never leave your device.

When sharing starts, your existing library is sent. The record is then kept up to date, with a full copy sent again from time to time (for example monthly, or when another of your devices joins). The library ID is stored in your iCloud and Keychain so your devices share it. Without iCloud, each device has its own.

Pseudonymous, not anonymous. These records carry random IDs rather than your name or account. If you also share with Friends, a similar copy of your library exists under your account, so someone with access to both could in principle match them. We keep them separate and do not do this.

Who sees it. Our internal dashboard shows aggregate figures only and hides any group of fewer than 10 people. We use this information only to understand and improve Vestigo, and we do not sell or license it.

Apple diagnostics

If you have chosen in iOS Settings to share analytics with app developers, Apple may share crash reports and usage statistics with us. Apple controls this.

Why we use information, and our legal bases (EEA and UK)

We rely on legitimate interests only where they are not overridden by your interests and rights.

Who receives information

We require our service providers to protect your information in line with this notice and to use it only to provide their services to us. We may also disclose information to professional advisers, to authorities where the law requires it or to protect rights and safety, and to a buyer or successor if Vestigo is sold or reorganised. We do not use advertising networks. If you would like the names of the providers who receive your information, contact us.

International transfers

Our providers are based in, or host data in, the United States. If you are in the EEA, the UK or Switzerland, your information is transferred there. Where required, we rely on appropriate safeguards, such as standard contractual clauses or the recipient’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

How long we keep information

We keep personal information only for as long as we need it for the purposes described in this notice. How long that is depends on:

• what the information is and why we hold it;
• whether you still use the feature it supports, such as your account or Friends;
• whether you have deleted it, or asked us to;
• whether we need it to keep the service secure, to meet legal obligations, or to establish or defend legal claims.

For example, your account and Friends information is kept until you delete your account. Analytics information is kept while your library is active and is deleted after a period of inactivity, leaving only combined counts. Security records, such as those used for rate limiting, are deleted quickly. Information on your device and in iCloud stays until you delete it. Our providers keep request logs and reports for limited periods. When we no longer need information, we delete it or keep only what we need to run the service.

Your choices and controls

• Share usage and activity to help Vestigo (Settings, Data). Turning it off stops usage statistics, crash reports and popularity analytics on all your devices.
• Delete my analytics data (Settings, Data). Turns sharing off and deletes your library set from our servers. It completes when you are next online. It does not remove combined counts, tags already stored (which are deleted later), or data already held by our analytics and crash reporting providers. Your library is not changed.
• Clear all data (Settings). Empties your library and settings on this device and in iCloud, so your other devices are emptied too. It also deletes your library set from our servers and resets your install ID. It does not delete your Friends account.
• Delete my Vestigo account (Settings, Data). Asks you to sign in with Apple once more, then:
  • deletes your account, profile, photo, friend connections, invitations, sharing settings and shared copies;
  • removes Vestigo from the apps using your Apple ID;
  • does not delete your library on your devices, your library set, data already held by our analytics and crash reporting providers, or anything friends have already seen;
  • keeps reports for a limited period.
• Friends. Choose what to share, edit your profile, remove or block a friend at any time.
• Device permissions. Manage location, calendar, camera and photo access in iOS Settings.

Your rights

If you are in the EEA, the UK or Switzerland

You can ask for access to your personal information, correction, deletion, restriction or a portable copy, and you can object to our use of it, including where we rely on legitimate interests. You can also complain to your data protection authority, which in the UK is the Information Commissioner’s Office. To exercise a right, email vestigosupport@gmail.com. We may need to verify your identity.

Some records, such as analytics records linked only to a random ID, cannot be connected to you by us. Where we cannot identify you, we may not be able to act on a request about those records, and we will tell you. You can remove your library set yourself with Delete my analytics data, and stop all analytics with the Settings switch.

If you are a US state resident

Depending on where you live, you may have rights to know about, access, correct and delete your personal information, and not to be treated differently for using these rights. We do not sell personal information or share it for cross context behavioural advertising. Email vestigosupport@gmail.com to make a request. If we decline, you can appeal by replying to our decision.

Elsewhere

You may have similar rights under local law. Email us and we will deal with your request under the law that applies to you.

Children

Vestigo is not intended for children under 13 and we do not knowingly collect their information. If you think a child has given us information, email us and we will delete it.

Security

We use reasonable measures to protect your information. For example, profile photos are stored privately, only confirmed friends can see what you share, and our internal dashboard requires a passkey. No system is completely secure.

Our Website

The Website does not use analytics or cookies. Title pages use information from a film database and our backend and play trailers through YouTube’s privacy enhanced player. Invitation links pass you to the App with an invitation token. Our website hosting provider keeps standard request logs, including your IP address and, for invitation links, the token.

Third party services

Our trailer checks use YouTube API Services. Google’s Privacy Policy is at https://policies.google.com/privacy. Other providers that your device contacts directly have their own privacy notices, which apply to what they collect.

Changes and contact

If we make material changes, we will show a notice in the App or on the Website before they take effect and update the date above.

Questions or requests: Katie Hyman, vestigosupport@gmail.com. If you contact us, we use your email address and message to respond, and keep them for as long as needed to deal with your request.