Privacy

Andrea Zichittella. For any question or request about your data, write to privacy@nexteptv.com.

• Account: email, password (stored only as a cryptographic hash, never in plain text), time zone, language and country, to sign you in, show releases in your time and data in your language.
• What you watch: followed shows, watched episodes with date and time, watched or planned movies, ratings and reviews. This is the service itself: without it there would be nothing to show you.
• Settings: your streaming subscriptions, your username and whether your profile is public.
• Feedback, if you send it from Settings: the message and the type of device and browser, to read it and reply to your account email.
• Push notifications, if you turn them on: the address of your browser's notification service, to tell you about new releases.
• Technical data: IP address and requests in the server logs, and any app errors (page, message, browser), for security (for example limits on sign-in attempts) and to fix problems.

The legal basis is the contract, that is providing the service you asked for by signing up (art. 6.1.b GDPR); for technical data and security, the legitimate interest in keeping the service working and protected (art. 6.1.f).

• Amazon Web Services (Frankfurt): the app server, the logs and sending emails (to reset your password and to forward feedback to the developer).
• Neon (Frankfurt): the database with accounts and activity.
• Upstash (Frankfurt): the cache of title data and the attempt counters.
• Vercel: serves the website through a worldwide network of servers, including outside the EU (with the safeguards required by the GDPR, such as standard contractual clauses).
• Browser notification services (Google, Mozilla, Apple, Microsoft) receive the notifications, encrypted, only if you turn them on.
• Posters and photos come directly from TMDB, which therefore sees your IP address when you load them. Searches and title pages go through Nextep's server instead: TMDB doesn't learn who you are.

Only technical cookies: one to keep you signed in (it lasts 30 days) and two to remember your language and country (one year). No profiling or third-party cookies, so no banner to accept. To work offline too, the app keeps the latest loaded data and the ticks not yet sent in your browser: it deletes them when you sign out.

It's off until you turn it on. If you do, anyone with the link sees your username, the numbers of what you've watched, ongoing and completed shows and your latest movies with rating and review; people with an account can compare tastes with you. It never shows your email or your watchlist, and it doesn't appear in search engines.

• Account and activity: until you delete your account.
• Demo accounts: 24 hours, then they delete themselves.
• Server logs: 14 days.
• Password reset links: one hour, and they work only once.

From the app or the website: sign in, open Settings and tap Delete account, then confirm with your password. Account, shows, watched episodes, movie diary, ratings, feedback, public profile and notifications are deleted immediately and for good; the server logs keep technical data without content for at most 14 days. If you can no longer sign in, write to privacy@nexteptv.com from your account email: we'll delete it within 30 days.

• Get your data: in Settings → Download your data you get a file with everything Nextep knows about you.
• Delete it: Settings → Delete account deletes your account and activity immediately and for good.
• Correct it or object to processing: write to privacy@nexteptv.com.
• You can also lodge a complaint with your data protection authority, for example the Italian Garante per la protezione dei dati personali.