Privacy Policy

This Privacy Policy for FriendRex ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Use our web application at friendflix4747.netlify.app or any future domains
• Use our social entertainment platform where you rank movies and shows, share what you are actively watching, chat with friends, interact with our AI companion Rex, and participate in the creator economy
• Engage with us in other related ways, including marketing or events

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services.

Summary of Key Points

• Personal Information: We collect personal information you provide (names, emails, usernames, passwords, date of birth) and automatically collect device/usage data.
• AI Features: Our AI companion Rex uses your watch history, ratings, and profile data to personalize responses. This data is processed by third-party AI providers.
• Sensitive Info: We do NOT process sensitive personal information beyond date of birth for age verification.
• Third Parties: We share data with Firebase (Google), TMDB, AI providers, and Stripe for payment processing.
• Processing: We process info to provide services, communicate, personalize your experience, and ensure security.
• Sharing: We may share info in specific situations like business transfers or legal requirements.
• Security: We use industry-standard protections, though no internet transmission is 100% secure.
• Your Rights: Depending on your location, you may have rights including access, deletion, portability, and opt-out of data collection.

1. What Information Do We Collect?

Personal Information You Provide

We collect personal information that you voluntarily provide when you register, use our Services, or contact us:

• Account Data: Email address, username, display name, password
• Date of Birth: Used for age verification and content filtering (COPPA compliance)
• Profile Data: Bio, avatar image, profile preferences
• Content You Create: Reviews, ratings, rankings, lists, poll responses, chat messages
• AI Interactions: Messages you send to Rex (our AI companion), stored locally on your device
• Payment Data: Processed by Stripe — we do NOT store credit card numbers

Information Automatically Collected

When you use our Services (with your consent), we may automatically collect:

• Log and Usage Data: IP address, device information, browser type, activity timestamps
• Firebase Analytics: Page views, feature usage, session duration (only with your consent)
• Device Data: Device ID, model, operating system
• Push Notification Tokens: If you opt in to notifications

2. How Do We Use Your Information?

We process your information to:

• Provide, operate, and maintain our Services
• Create and manage your account
• Personalize your experience, including AI-powered recommendations through Rex
• Filter content based on your age group (teen safety protections)
• Enable user-to-user communications (messaging, group chats)
• Process payments and subscriptions through Stripe
• Send administrative communications (terms updates, security alerts)
• Enforce our Terms of Service and Community Guidelines
• Protect against fraud and abuse
• Comply with legal obligations

3. AI Features & Data Disclosure

Rex AI Companion: Rex is an AI-powered chatbot that provides personalized movie and TV recommendations. When you interact with Rex:

• Your watch history, ratings, reviews, and profile data are sent to our AI provider to generate personalized responses
• Conversation history within a thread is maintained for context
• Rex conversations are stored locally on your device (localStorage), not on our servers
• You can delete Rex conversations at any time from the Rex interface
• AI responses are generated by a third-party AI service and may not always be accurate

4. Third-Party Services

We use the following third-party services to operate FriendRex:

Movie and TV data is provided by TMDB. This product uses the TMDB API but is not endorsed or certified by TMDB.

5. When Do We Share Your Information?

We may share your information in the following situations:

• With Other Users: Your profile, reviews, ratings, and public activity are visible to other users as part of the social platform
• Service Providers: With third-party services listed above to operate our platform
• Business Transfers: In connection with a merger, sale, or acquisition
• Legal Obligations: If required by law, court order, or to protect our rights
• With Your Consent: For any other purpose with your explicit consent

We do NOT sell your personal information to third parties.

6. Cookies & Tracking

FriendRex uses the following local storage technologies:

• localStorage: To store your preferences, settings, cached data, and Rex AI conversations
• Firebase SDK: Authentication tokens stored via IndexedDB
• Firebase Analytics: Usage tracking cookies (only with your explicit consent via our consent banner)

You can manage cookie preferences through our consent banner. Declining analytics cookies does not affect core app functionality.

7. How Long Do We Keep Your Information?

We keep your information for as long as necessary to provide our Services. When you delete your account:

• Your profile data is anonymized immediately
• Your posts, reviews, and ratings are deleted
• Your messages are disassociated from your identity
• Backup data is purged within 30 days

8. How Do We Keep Your Information Safe?

We implement appropriate security measures including encrypted connections (HTTPS), Firebase Security Rules, server-side API key protection, and access controls. However, no electronic transmission over the Internet is guaranteed to be 100% secure.

9. Children & Minors

FriendRex requires users to be at least 13 years old. We do not knowingly collect data from children under 13. If we learn we have collected data from a child under 13, we will delete it immediately.

Users aged 13-17 receive enhanced protections:

• Mature content (R-rated movies, TV-MA shows) is automatically restricted
• Content safety filters are permanently enabled and cannot be disabled
• Age-appropriate recommendations are enforced

10. Your Privacy Rights

All Users

• Access: View your personal data in Settings
• Export: Download all your data (Settings > Data & Storage > Download My Data)
• Correction: Update your profile information at any time
• Deletion: Delete your account and all associated data (Settings > Delete Account)
• Opt-Out of Analytics: Decline analytics via our consent banner, or revoke consent by clearing cookies

California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected. Use Settings > Delete Account or email us.
• Right to Opt-Out of Sale: We do NOT sell your personal information. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Information: We only use date of birth for age verification and content filtering.

Categories of personal information collected in the last 12 months:

To exercise your CCPA rights, email us at privacy@friendrex.app or use the in-app tools. We will verify your identity before processing requests.

European Economic Area / UK Residents (GDPR)

If you are in the EEA or UK, you have rights under the General Data Protection Regulation (GDPR) including:

• Right of Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Data Portability: Export your data in a machine-readable format (JSON)
• Right to Object: Object to processing based on legitimate interests
• Right to Restrict Processing: Request limitation of data processing
• Right to Withdraw Consent: Withdraw consent for analytics at any time via our consent banner

Our legal bases for processing are: contract performance (providing Services), consent (analytics, marketing), and legitimate interests (security, fraud prevention).

11. Video Processing & Watermarks

When you post a video reel to FriendRex, we transcode it for delivery and store both the source file and generated renditions in Firebase Storage on Google Cloud.

When another signed-in user requests to download or save one of your videos, FriendRex generates a branded export on our servers by compositing a FriendRex watermark and a short (≤2 second) FriendRex end-card animation onto a copy of the source video using ffmpeg. The branded export is then delivered to the requesting user. In-app playback of your video is not modified. Basic metadata about each download event (requesting user ID, owner user ID, reel ID, timestamp, success/error status) is logged to enable abuse detection, rate limiting, and product analytics.

Your controls. You can disable downloads of your videos by other users at any time under Settings → Privacy & Security → "Allow others to save my videos." This setting is enforced server-side.

Legal basis (EEA / UK users). We process video content to deliver the Services you have requested (GDPR Article 6(1)(b) — performance of a contract) and to pursue our legitimate interests in operating, securing, and promoting the Services (GDPR Article 6(1)(f)). You can object to legitimate-interest processing by contacting us at privacy@friendrex.app.

Retention. Branded export copies are cached for up to 24 hours to reduce regeneration cost and then regenerated on demand. Download event logs are retained for up to 90 days for abuse monitoring.

12. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. We honor DNT signals by not loading analytics for users who have not consented via our consent banner.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email. Continued use of the Services after changes constitutes acceptance of the updated policy.