Glotz

Privacy policy

As of

This is a translation for convenience. The binding version is the German one at glotz.xyz/de/datenschutz.

1. Controller

meinTechniker
Owner: Vincent Jungmann
Neugasse 44
67487 Maikammer
Germany

Phone: +49 175 7573333
Email: hello@glotz.xyz

2. The short version

3. This website

Visiting the pages

The website is hosted by Vercel Inc. and served from the Frankfurt am Main region. When you visit, the server processes technically necessary access data: IP address, time, requested address, transferred data volume, browser type and operating system. This data is required to deliver the site and keep it secure.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a technically sound and secure presence. A data processing agreement is in place with the provider; for transfers to the USA the EU Commission’s standard contractual clauses apply.

Cookies, fonts, analytics

The site uses only the fonts your operating system ships with and employs no analytics or advertising services. A cookie is set only when you sign in to your account (see section 4). It is technically necessary within the meaning of § 25(2)(2) TDDDG; neither consent nor a cookie banner is required for it.

4. Account and waitlist

Which data

When you create an account we store your email address, a hash of your password (the password itself is not stored), optionally your name, the chosen language, and the time of creation and last sign-in. When you join the waitlist your details are added: the devices you want, the kind of subscription, an optional note and whether you are applying for TestFlight.

Why

To keep you on the waitlist, show you your position and invite you through App Store Connect when a TestFlight seat opens up. Apple sends the invitation to your account’s address; for that we pass your email address and, if given, your name to Apple. We do not use the address for newsletters or advertising and do not pass it on otherwise. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request).

Where

The data lives in a database operated by Neon, Inc. (Delaware, USA) in the Frankfurt am Main region on Amazon Web Services infrastructure. A data processing agreement is in place with Neon; should data be transferred to the USA, the EU Commission’s standard contractual clauses apply.

Session cookie

After signing in the website sets a cookie named glotz_session holding a random session key. It is valid only for this domain, cannot be read by scripts, is transmitted only over encrypted connections and expires after 90 days or when you sign out. The database holds only a hash of the key.

Protection against bulk requests

To protect the sign-in forms from automated requests we count requests per sender for a short time. The IP address is hashed for that; the address itself is not stored. The legal basis is Art. 6(1)(f) GDPR.

Retention and deletion

We keep the data until you delete your account. You can do that yourself at any time on the account page with immediate effect, or by emailing us. Waitlist entry and sessions are deleted with the account. At the latest six months after the app launches on the App Store we delete the waitlist entirely.

Confirmation emails

Where set up, we send a confirmation to your address after you join. It is sent through our own mail server, not through an email service provider.

5. Browser preview

At glotz.xyz/app a preview shows the app’s interface in the browser. It plays no provider streams and requires no account. Our server fetches the film and series data from The Movie Database (TMDB); your IP address does not reach TMDB that way. Posters and images, however, are loaded by your browser directly from TMDB’s image servers, which transmits your IP address to TMDB (TiVo Corporation). The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in a preview with real data.

Trailers are loaded from YouTube (Google Ireland Limited) only after you tap “Load trailer”. Only then does Google receive your IP address and possibly set its own cookies; we use the privacy-enhanced mode (youtube-nocookie.com). The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give with the click and end by closing the trailer. Your watchlist in the preview lives only in your browser’s storage.

6. The app

Your provider credentials

The app stores the address, username and password of your IPTV subscription in your device’s keychain. They are transmitted exclusively to the provider you entered, to sign you in there; they never reach us. The legal basis is Art. 6(1)(b) GDPR.

Your provider

When fetching lists and during playback the app connects directly to your provider’s server. Which data it collects and stores is governed by its privacy policy. We have no influence on that processing.

Film and series data (TMDB)

To show posters, descriptions and ratings the app retrieves data from The Movie Database (TMDB). Titles or ids and, for technical reasons, your device’s IP address are transmitted to TMDB. We do not transmit who watched which title. The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in a usable presentation of your library.

Guide data for live TV

For the programme guide the app downloads publicly available guide files in XMLTV format. Your device’s IP address is transmitted to the respective server. The legal basis is Art. 6(1)(f) GDPR.

Sync through iCloud

The app stores watchlist, playback progress and finished titles in your private iCloud key-value store so they match across your devices. That data sits in your Apple account; we have no access to it. Apple is responsible for iCloud. Sync can be switched off in your device settings. The legal basis is Art. 6(1)(b) GDPR.

Shared titles

When you share a title the app creates a link to glotz.xyz/t/… with the title’s id. When the link is opened our server fetches title, image and description from TMDB and displays them. The link contains neither your provider nor your credentials nor the stream.

Downloads

Downloaded films and episodes live exclusively on your device. Nothing is transmitted to us.

Purchases

Subscriptions are handled by the App Store. Apple is the contracting party for payment; we receive no payment data. The app merely checks whether a valid subscription exists for your device. Apple is responsible for payment processing under its own privacy terms.

Crash reports and usage statistics

We embed no analytics tools of our own. If you have agreed in your device’s system settings to share diagnostics with developers, Apple provides us with aggregated, non-personal crash and usage reports. You give that consent to Apple and can withdraw it there.

7. Getting in touch

If you email us we process the details it contains to answer your request. The legal basis is Art. 6(1)(b) or (f) GDPR. We delete the correspondence once it is no longer needed and no statutory retention periods apply.

8. No automated decision-making

There is no automated decision-making including profiling under Art. 22 GDPR. The order of TestFlight invitations follows the time of joining and the seats available, not an assessment.

9. Your rights

You have the following rights towards us:

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

10. Changes

We update this policy whenever the app or the website changes. The version published here applies.