Privacy Policy

This Privacy Policy for FriendRex ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Use our web application at friendflix4747.netlify.app or any future domains
• Use our social entertainment platform where you rank movies and shows, share what you are actively watching, chat with friends, interact with our AI companion Rex, and participate in the creator economy
• Engage with us in other related ways, including marketing or events

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services.

Summary of Key Points

• Personal Information: We collect personal information you provide (names, emails, usernames, passwords, date of birth) and automatically collect device/usage data.
• AI Features: Our AI companion Rex uses your watch history, ratings, and profile data to personalize responses. This data is processed by third-party AI providers.
• Sensitive Info: We do NOT process sensitive personal information beyond date of birth for age verification.
• Third Parties: We share data with Firebase (Google), TMDB, AI providers, Stripe for payment processing, and Google AdMob for ads shown to free users in our apps.
• Ads: Free users on our iOS and Android apps see a banner ad at the bottom of the home feed, labeled sponsored cards inside the home feed and search results, an occasional skippable video ad in Reels (at most one every few minutes), and can choose to watch a rewarded ad for bonus Rex messages. Ads are never shown to Plus or Pro members. For adults they may be personalized (you can opt out any time via Do Not Sell or Share or in Settings); for users under 18 they are always non-personalized. We never sell your personal information.
• Processing: We process info to provide services, communicate, personalize your experience, and ensure security.
• Sharing: We may share info in specific situations like business transfers or legal requirements.
• Security: We use industry-standard protections, though no internet transmission is 100% secure.
• Your Rights: Depending on your location, you may have rights including access, deletion, portability, and opt-out of data collection.

1. What Information Do We Collect?

Personal Information You Provide

We collect personal information that you voluntarily provide when you register, use our Services, or contact us:

• Account Data: Email address, username, display name, password
• Date of Birth: Used for age verification and content filtering (COPPA compliance)
• Profile Data: Bio, avatar image, profile preferences
• Content You Create: Reviews, ratings, rankings, lists, poll responses, chat messages
• AI Interactions: Messages you send to Rex (our AI companion), stored locally on your device
• Payment Data: On iOS, purchases are processed by Apple via the App Store. We do NOT store credit card numbers.
• Payment Data: On Android, purchases are processed by Google via Google Play. We do NOT store credit card numbers.
• Payment Data: On the web, purchases are processed by Stripe. We do NOT store credit card numbers.
• Safety & Moderation Data: Reports you submit about content or users; your block and mute lists; and moderation actions taken on your account (such as content removals, warnings/strikes, suspensions, or bans). When content is removed for a policy violation, a copy may be retained in a restricted archive for appeals, audits, and legal or safety obligations.

Information Automatically Collected

When you use our Services (with your consent), we may automatically collect:

• Log and Usage Data: IP address, device information, browser type, activity timestamps
• Firebase Analytics: Page views, feature usage, session duration (only with your consent)
• Device Data: Device ID, model, operating system
• Push Notification Tokens: If you opt in to notifications

2. How Do We Use Your Information?

We process your information to:

• Provide, operate, and maintain our Services
• Create and manage your account
• Personalize your experience, including AI-powered recommendations through Rex
• Filter content based on your age group (teen safety protections)
• Enable user-to-user communications (messaging, group chats)
• Process payments and subscriptions through Stripe
• Send administrative communications (terms updates, security alerts)
• Enforce our Terms of Service and Community Guidelines
• Protect against fraud and abuse
• Comply with legal obligations

3. AI Features & Data Disclosure

Rex AI Companion: Rex is an AI-powered chatbot that provides personalized movie and TV recommendations. When you interact with Rex:

• Your watch history, ratings, reviews, and profile data are sent to our AI provider to generate personalized responses
• Conversation history within a thread is maintained for context
• Rex conversations are stored locally on your device (localStorage), not on our servers
• You can delete Rex conversations at any time from the Rex interface
• AI responses are generated by a third-party AI service and may not always be accurate

No AI Training Without Consent. We do not use your User Content, Rex conversations, ratings, reviews, or other personal data to train artificial-intelligence models without your explicit, prior, opt-in consent. A toggle in Settings → Privacy & Security → AI Training lets you opt in to having your public content contribute to AI model training; the toggle is OFF by default and may be reversed at any time. Our AI provider does not use your data to train its general-purpose models under our service agreement with them.

4. Third-Party Services

We use the following third-party services to operate FriendRex:

Movie and TV data is provided by TMDB. This product uses the TMDB API but is not endorsed or certified by TMDB.

5. When Do We Share Your Information? (Recipients of personal data)

We may share your information in the following situations:

• With Other Users: Your profile, reviews, ratings, and public activity are visible to other users as part of the social platform
• Service Providers / Sub-processors: With the third parties listed in our Sub-Processor List to operate our platform. The sub-processor page is the source-of-truth and supersedes any older list embedded in this document.
• Business Transfers: In connection with a merger, sale, or acquisition
• Legal Obligations: If required by law, court order, or to protect our rights
• With Your Consent: For any other purpose with your explicit consent

We do NOT sell your personal information to third parties. See our Do Not Sell or Share My Personal Information page for California-specific opt-out rights.

6. Cookies, Local Storage & Advertising

Ads in our apps. On our iOS and Android apps, free users see ads served by Google AdMob: a banner at the bottom of the home feed, labeled sponsored cards inside the home feed and search results, an occasional skippable full-screen video ad while browsing Reels (capped in frequency), and an optional rewarded ad they can choose to watch for bonus Rex messages. Plus and Pro members never see ads. Some FriendRex home-feed placements may also be sold directly to entertainment brands and are always labeled "Sponsored". For adult users, these ads may be personalized. On iOS, we ask your permission through Apple's App Tracking Transparency prompt before any advertising identifier is used; if you decline, ads are non-personalized. You can also turn off personalized ads at any time in Settings → Privacy & Security → "Do Not Sell or Share My Personal Information," on our Do Not Sell or Share page, or with a Global Privacy Control signal. Under California law, personalized advertising counts as "sharing" personal information; we do not sell it. Where required by law (for example in the EEA, UK and certain US states), Google's consent form lets you choose how your data is used for ads. Users under 18 never see the tracking prompt and only receive non-personalized ads. See how Google uses data from partner apps.

FriendRex does not use tracking cookies on iOS or native devices. Apart from the ads described above, we do not track you across other apps or websites. We use the following secure local storage technologies solely to operate the app:

• localStorage: To store your preferences, settings, cached data, and Rex AI conversations locally on your device
• Firebase SDK (IndexedDB/Local Storage): Secure authentication tokens to keep you logged in
• Firebase Analytics (Web/PWA only): Standard first-party usage measurement to improve app performance (only with your explicit consent, and never shared with third-party ad networks or used to track you across other apps or websites)

You can manage your analytics preferences at any time in your Settings.

7. How Long Do We Keep Your Information?

We keep your information for as long as necessary to provide our Services. When you delete your account:

• Profile data (display name, bio, avatar, email, date of birth) is permanently deleted.
• Your own content — reels, xposts, lists, ratings, polls, follows, likes, push tokens, subscription state, and all per-media subcollections (movies, TV, books, manga, games) — is permanently deleted.
• Direct messages in chats you own are deleted; in chats you participate in but do not own, your messages are disassociated from your identity (sender shown as "[Deleted User]").
• Comments and replies you posted on other users' content are not automatically deleted or anonymized by our system; they remain attached to your former username, which after account deletion will appear as an unknown or deleted-user placeholder to other users. If you would like your comments to be removed or anonymized, contact us at privacy@friendrex.app and we will process the request within the GDPR / CCPA timeframe (30 days). Retention of these comments is permitted under GDPR Art. 17(3)(a), which preserves other users' right of access to information shared with them.
• Audit log entries (such as records that an under-13 sign-up attempt was blocked, or that a moderation report was filed) are retained without any identifying information for the period required by law and our Community Rules.
• Backup data is purged within 30 days of deletion.

8. How Do We Keep Your Information Safe?

We implement appropriate security measures including encrypted connections (HTTPS), Firebase Security Rules, server-side API key protection, and access controls. However, no electronic transmission over the Internet is guaranteed to be 100% secure.

9. Children & Minors

FriendRex is intended for users 13 years of age or older. In compliance with the Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312) and the UK Age-Appropriate Design Code, we do not knowingly collect personal information from children under 13.

How we enforce this: During account creation, every user is required to provide their date of birth. We perform two independent age checks:

1. A client-side check during onboarding that blocks anyone who reports an age under 13.
2. A server-side Cloud Function that re-computes the user's age from the date of birth they submitted. If the user is under 13, the system automatically deletes the account, all associated data (profile, preferences, watch history, social graph), and the underlying authentication record. An immutable audit row is retained solely to evidence that the under-13 attempt was blocked, and contains no information that could identify the child.

If you believe a child under 13 has created an account: Please contact us at privacy@friendrex.app. We will investigate, delete any child's data within 30 days of confirmation, and terminate the account.

Users aged 13-17 receive enhanced protections:

• Mature content (R-rated movies, TV-MA shows) is automatically restricted
• Content safety filters are permanently enabled and cannot be disabled
• Age-appropriate recommendations are enforced

10. Your Privacy Rights

All Users

• Access: View your personal data in Settings
• Export: Download all your data (Settings > Data & Storage > Download My Data)
• Correction: Update your profile information at any time
• Deletion: Delete your account and all associated data (Settings > Delete Account)
• Opt-Out of Analytics: Decline analytics via our consent banner, or revoke consent by clearing local site data

California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected. Use Settings > Delete Account or email us.
• Right to Opt-Out of Sale: We do NOT sell your personal information. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Information: We only use date of birth for age verification and content filtering.

Categories of personal information collected in the last 12 months:

To exercise your CCPA rights, email us at privacy@friendrex.app or use the in-app tools. We will verify your identity before processing requests.

European Economic Area / UK Residents (GDPR)

If you are in the EEA or UK, you have rights under the General Data Protection Regulation (GDPR) including:

• Right of Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Data Portability: Export your data in a machine-readable format (JSON)
• Right to Object: Object to processing based on legitimate interests
• Right to Restrict Processing: Request limitation of data processing
• Right to Withdraw Consent: Withdraw consent at any time — for analytics via our consent banner, and for ads via Settings → Privacy & Security → "Ad Privacy Choices." Withdrawing consent does not affect processing that happened before you withdrew it.
• Right to Complain: You may lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office; in the EEA, the authority in the country where you live or work). We'd appreciate the chance to address your concern first at privacy@friendrex.app.

Legal Bases for Processing (EEA / UK)

11. International Data Transfers

FriendRex LLC is based in the United States, and our servers and most of our service providers (including Google Firebase, Google Cloud and Google AdMob) process data in the United States. If you use FriendRex from outside the United States — including from the EEA or UK — your personal data is transferred to and processed in the United States, which may have data protection laws different from those where you live.

Where we transfer personal data from the EEA or UK, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, as incorporated into our service providers' data processing terms (see our Sub-Processor List), and, where a recipient is certified, the EU-U.S. Data Privacy Framework and its UK Extension. You can request more information about these safeguards at privacy@friendrex.app.

12. Video Processing & Watermarks

When you post a video reel to FriendRex, we transcode it for delivery and store both the source file and generated renditions in Firebase Storage on Google Cloud.

When another signed-in user requests to download or save one of your videos, FriendRex generates a branded export on our servers by compositing a FriendRex watermark and a short (≤2 second) FriendRex end-card animation onto a copy of the source video using ffmpeg. The branded export is then delivered to the requesting user. In-app playback of your video is not modified. Basic metadata about each download event (requesting user ID, owner user ID, reel ID, timestamp, success/error status) is logged to enable abuse detection, rate limiting, and product analytics.

Your controls. You can disable downloads of your videos by other users at any time under Settings → Privacy & Security → "Allow others to save my videos." This setting is enforced server-side.

Legal basis (EEA / UK users). We process video content to deliver the Services you have requested (GDPR Article 6(1)(b) — performance of a contract) and to pursue our legitimate interests in operating, securing, and promoting the Services (GDPR Article 6(1)(f)). You can object to legitimate-interest processing by contacting us at privacy@friendrex.app.

Retention. Branded export copies are cached for up to 24 hours to reduce regeneration cost and then regenerated on demand. Download event logs are retained for up to 90 days for abuse monitoring.

13. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. We honor DNT signals by not loading analytics for users who have not consented via our consent banner.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email. Continued use of the Services after changes constitutes acceptance of the updated policy.

15. Response Times to Legal & Privacy Inquiries

We monitor the following dedicated email addresses and respond within the stated timeframes (business days):

• dmca@friendrex.app — DMCA takedown notices and counter-notices: response within 24 business hours.
• legal@friendrex.app — Legal inquiries (subpoenas, law-enforcement requests, regulatory notices): response within 72 hours.
• privacy@friendrex.app — Privacy / data-subject requests (access, deletion, portability, opt-out): response within 72 hours; we aim to fulfill verified requests within 30 days as required by GDPR / CCPA.

We send an automated acknowledgment to confirm receipt. If you have not received an acknowledgment within 12 hours of sending a DMCA notice, please re-send to legal@friendrex.app as a backup.