Privacy Policy

This Privacy Policy describes how Teddy Code LLC (“Stusher,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Stusher mobile application (the “App”) and the stusher.app website (together, the “Service”). Stusher is designed around a simple principle: your taste profile and viewing history live on your device. We never sell your data, never run third-party ad trackers, and never upload your watch history to our servers without your explicit action.

1. Information we collect

1.1 Information stored on your device only

When you first open the App, we generate a random anonymous identifier (UUID) and store it on your device using encrypted local storage. We use it to associate your settings, taste profile, and library with your installation. The following data is stored exclusively on your device and is never transmitted to our servers unless you explicitly opt in to cloud backup:

• Your taste profile (genre preferences, ratings, the outcomes of the onboarding A/B duels)
• Your library (watchlist, watched, favorites, “not for me” items)
• Your settings (language, theme, notifications)
• Your country of residence (used to filter availability)
• The streaming services you have selected as your subscriptions
• Optional nickname and birth year

1.2 Information processed by our backend

To return personalized recommendations, we send anonymous, ephemeral requests to our backend (Supabase Edge Functions) including: your country code, the streaming services you selected, and a transient representation of your taste profile for the current request. These requests are not associated with any account, email, or persistent identifier on our servers, and are not stored beyond what is necessary to serve the response.

1.3 Information you choose to share

If you opt in to cloud backup (an optional feature available to Stusher Plus users), you may choose to provide an email address to receive a magic-link sign-in. We use this email solely to authenticate your backup. We do not send marketing emails unless you have separately opted in.

1.4 Automatically collected information

The App does not include third-party analytics SDKs, advertising SDKs, or social media tracking pixels. Our website may collect minimal aggregated, anonymized analytics (such as page views) using privacy-respecting tooling. We do not use cookies for cross-site tracking.

2. Third-party content metadata

Stusher fetches movie and series metadata (titles, posters, ratings, availability) from The Movie Database (TMDB). When you request a recommendation, your country code and the metadata IDs of the titles you interact with may be included in those requests so TMDB can return the correct data. We do not send TMDB any information that identifies you personally.

3. How we use information

• To generate your personalized recommendations on-device
• To return availability information for your country and streaming services
• To operate, maintain, and improve the Service
• To respond to your support requests
• To detect, prevent, and address fraud, security, and technical issues
• To comply with legal obligations

4. How we share information

We do not sell your personal information. We may share limited information only in the following circumstances:

• Service providers who help us operate the Service (e.g., Supabase as our backend provider, Google Play as the distribution platform). These providers process data on our behalf and are bound by contractual confidentiality obligations.
• Legal requirements, if we are required to disclose information to comply with applicable law, regulation, legal process, or governmental request.
• Business transfer, in connection with a merger, acquisition, or sale of assets. Users will be notified before their data becomes subject to a different privacy policy.

5. Data retention

On-device data persists on your device until you delete the App or clear its data. If you opt in to cloud backup, your backup data is retained while your account is active. After 18 months of inactivity, we may delete or anonymize backup data and notify you in advance where required by law.

6. Your rights

Subject to applicable law, you may:

• Access: Request a copy of any personal data we hold about you.
• Correct: Ask us to correct inaccurate data.
• Delete: Delete your library and taste profile from the device at any time via Settings. See our Account & Data Deletion page for details about cloud backups.
• Object: Object to certain processing or withdraw consent (where consent is the basis).
• Portability: Receive a machine-readable copy of your data.
• Opt out of sale/sharing: We do not sell or share your data for cross-context behavioral advertising. There is nothing to opt out of.

To exercise any of these rights, contact privacy@stusher.app. We will respond within 30 days.

7. Children's privacy

Stusher is not directed at children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal information from children under those ages. If you believe a child has provided us with personal information, please contact us at privacy@stusher.app and we will delete it. See our Child Safety Standards for details.

8. International data transfers

We are based in the United States. If you are accessing the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers from the EU/EEA, UK, and Switzerland.

9. Security

We use industry-standard safeguards to protect information, including encryption in transit (TLS) and at rest, encrypted device storage (MMKV) for on-device data, and least-privilege access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

10. Region-specific disclosures

10.1 California (CCPA/CPRA)

California residents have the right to know what personal information we collect, the purposes for which we use it, and to whom it is disclosed. You also have the right to request deletion and to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioral advertising.

10.2 European Economic Area, UK, and Switzerland (GDPR/UK GDPR)

The legal bases on which we process personal data are: (a) performance of a contract (to provide the Service); (b) our legitimate interests in operating and improving the Service; and (c) your consent (for optional features such as cloud backup). You have the right to lodge a complaint with your local data protection authority.

10.3 Brazil (LGPD)

Brazilian users have the rights set out in Article 18 of the LGPD, including access, correction, anonymization, deletion, and portability.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other reasonable means. The “Last updated” date at the top reflects the most recent revision.

12. Contact us