CollectionistCollectionist — Privacy Policy
Last updated: October 3, 2026
Collectionist is an app for keeping track of movies, series, games and books you want to watch, play or read. This policy explains what happens to your data when you use it.
The short version: Collectionist has no accounts, no advertising, no analytics and no tracking. Your library stays on your device. To find titles and show their details, the app asks the public databases listed below, mostly through a small server we run for that purpose. That server sees your search terms and your IP address. It does not store your IP address; it keeps the databases' answers, including answers to searches, for a short time without any link to you.
Who is responsible
Jon Doe
test test
test@example.com
What stays on your device
Everything you create in Collectionist — your library, shelves, folders, ratings, notes and completion history — is stored only on your device, in the app's own storage. It is not sent to us, our server never receives it, and we cannot see it.
The app also keeps temporary caches of titles and images it has already loaded, so it works faster and offline. Settings › Diagnostics clears the cached title data, and all caches are removed when you delete the app.
If you use iCloud Backup or a computer backup, your device's backup includes the app's data. That backup is handled by Apple or by you, not by us.
What the app sends to other services
To search for titles and show their details, the app needs these services:
| Service | What it is used for | Operator | How the app reaches it |
|---|---|---|---|
| The Movie Database (TMDB) | Movies, series, cast, release dates, posters, where-to-watch | TMDB, Inc., USA | through our server |
| IGDB | Games, platforms, release dates, cover art | Twitch Interactive, Inc. (Amazon), USA | through our server |
| Hardcover | Books, authors, series, covers | Hardcover | through our server |
| OMDb API | Critic scores for movies and series (Metacritic, Rotten Tomatoes, IMDb) | OMDb API | through our server, IMDb ID only |
| Steam Store | Store release dates and review scores for games | Valve Corporation, USA | directly from your device |
Our server
Requests to TMDB, IGDB, Hardcover and OMDb go to a small server we operate on Cloudflare Workers. It exists so that the app itself contains no access keys: the server adds our keys and passes the request on. Cloudflare, Inc. (USA) runs it for us as our processor under its data processing addendum. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/
The server receives:
- what you searched for, or the ID of the title you opened,
- your language and region setting,
- technical data every internet request contains: your IP address, the time, and the app's name and version together with your iOS version.
It uses your IP address only in the moment, to limit how many requests one address can send per minute, and does not store it. So that not every request reaches the services again, the server keeps their answers: search results for 12 hours, everything else, such as a title's details or the release calendar, for up to 7 days. When a service is down, it serves an expired answer for up to 7 more days. Only the answer is stored, under a checksum (hash) of the request, so a search term is not kept in plain text. Your IP address, a device identifier or anything else linking it to you is not stored with it, and anyone making the same search gets the same answer. When one of the services answers with an error, the server records which service and which kind of request failed and the service's error message, without your IP address or search terms; Cloudflare keeps these records for 3 days.
To make sure only the genuine Collectionist app uses the server, the app relies on Apple's App Attest. On first use your device creates a key in its Secure Enclave, and Apple confirms to our server that the key belongs to an unmodified copy of the app on a real Apple device; for this, your device contacts Apple (Apple's privacy policy: https://www.apple.com/legal/privacy/). The server then stores that key's random identifier, its public part and a counter. They say nothing about you, your device model or your Apple Account. With the key, the app obtains a session token for 24 hours at a time and sends it with its requests. The server deletes a stored key after 180 days without use.
What the services receive
TMDB, IGDB, Hardcover and OMDb receive your search term or the title's ID, your language and region setting, and the app's name and version with your iOS version. They do not receive your IP address; they see our server's instead.
The Steam Store is contacted directly from your device, because it needs no access key. It receives the ID of the game, your language and region setting, and your IP address.
To link a critic score to its page, the app also searches Rotten Tomatoes (Fandom, Inc., USA) and Metacritic (Fandom, Inc., USA) directly from your device, the way a browser would. They receive the title and year of the movie or series and your IP address.
We do not send your library, your ratings, your notes or any identifier that links requests to you. Each service processes this data under its own privacy policy, and may process it outside the EU, in particular in the USA:
- TMDB: https://www.themoviedb.org/privacy-policy
- Twitch / IGDB: https://www.twitch.tv/p/legal/privacy-notice/
- Hardcover: https://hardcover.app/pages/policies
- Valve / Steam: https://store.steampowered.com/privacy_agreement/
Where-to-watch information is provided by JustWatch through TMDB. Your device does not contact JustWatch directly.
Sharing a link to Collectionist
When you share a web page to Collectionist from another app, Collectionist loads that page on your device to recognise which title it is about. The website you shared receives the same technical data as when you open it in a browser. The page's content is analysed on your device and not sent to us.
Links that leave the app
Trailers, streaming services and store pages open in your browser or in the respective app. From that point on, that provider's privacy policy applies.
This website
collectionist.de is hosted on Cloudflare Pages by Cloudflare, Inc. (USA), as our processor. To deliver the pages and protect them from attacks, Cloudflare processes your IP address and the technical data your browser sends with every request. The site sets no cookies and uses no analytics, tracking or embedded content from other services.
Legal basis (for users in the EU and UK)
The requests described above are necessary to provide the features you use (Art. 6(1)(b) GDPR). Limiting requests per IP address and checking requests with App Attest protect the service from misuse, which is in our legitimate interest (Art. 6(1)(f) GDPR). Keeping caches on your device is in the legitimate interest of making the app fast and usable offline (Art. 6(1)(f) GDPR). Keeping the services' answers on our server is in our legitimate interest of asking the services only as often as needed and staying within their usage limits (Art. 6(1)(f) GDPR). Delivering and protecting this website is in our legitimate interest of presenting the app (Art. 6(1)(f) GDPR).
How long data is kept
We do not store your library or your IP address. Answers kept on our server are not linked to any person and are deleted at the latest 7 days after they expire, so search results after at most 7.5 days and everything else after at most 14 days. The error records described above are deleted after 3 days, App Attest keys after 180 days without use. Data on your device stays until you delete it or the app.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. Because we do not keep data about you, requests about data held by TMDB, Twitch, Hardcover or Valve are best sent to them directly. You are welcome to contact us at the address above with any question.
Children
Collectionist is not directed at children under 13 and does not knowingly process their data.
Changes to this policy
We will update this policy when the app changes how it handles data, and change the date at the top.