Official Policy Document · saved September 7, 2026
Last updated: September 7, 2026
This Privacy Policy explains how BuddyCinemas collects, uses, shares, and protects information when you use our website, mobile apps, and streaming service (the "Service"), including as an anonymous guest.
Depending on where you're located, the data controller for your information is:
Account & profile information: email address, authentication identifiers (including Google/Apple sign-in tokens where you choose social login), display name, date of birth or age-band where required for content-rating purposes, language/region preference, and any household profiles (including Kids profiles) you create.
Guest / device information: before you register, we assign your device an anonymous identifier (a signed cookie on web, or an install ID on mobile) so you can browse and search without providing personal information. Watching requires a registered account. We also use lightweight device signals (device model, OS, screen size, coarse locale) for fraud prevention and to keep your guest session consistent across visits.
Visit and sign-in records: each time the Service is opened, and each time an account signs in, we record the date and time, the IP address the request came from, the country and city that address resolves to, and the operating system and browser reported by your device. This applies to guest sessions as well as registered accounts. We use it to understand how many people reach the Service and how many go on to create an account, to show you where your own account has recently been used, and to detect abuse. We keep these records for 180 days and then delete them. Your most recent sign-in of this kind is also stored on your account, and everything in this paragraph is included in the copy of your data you can download (see §9).
Viewing activity: titles watched, watch progress/resume position, likes, favorites/watchlist, search queries, ratings interactions, and playback quality signals (buffering, bitrate, errors) used to improve streaming quality.
Token & transaction data: token balances, earn/spend ledger entries, ad-completion verification results, subscription/rental/purchase records, and payment metadata such as amount, currency, and payment method type. We never see or store your full card number, CVV, or bank credentials — those are handled directly by our PCI-compliant payment processors (Razorpay, Cashfree, Stripe).
Communications: support requests, feedback/ratings you submit, and email/push notification delivery status.
Technical & analytics data: IP address (used for geo-routing, fraud checks, and approximate location — never stored alongside precise GPS unless you separately grant location permission for a specific feature), app version, crash/error reports, and aggregated product-usage analytics.
We use your information to: operate and improve the Service (streaming, recommendations, continue-watching, search); process payments, entitlements, and token rewards; verify device integrity and detect fraud or abuse (including account sharing, ad-reward farming, and payment fraud); communicate with you (transactional emails/push, and marketing where you've consented); comply with legal, tax, and regulatory obligations (including GST/VAT invoicing); and produce aggregated, de-identified analytics and producer/partner reporting (partners only ever see performance and revenue for their own titles, never your individual identity).
We use cookies and comparable device-storage technologies for authentication, guest-session continuity, preferences, and (where you consent) analytics and advertising personalization. See our Cookie Policy for the full list and how to manage your choices.
We share information with: payment processors (Razorpay, Cashfree, Stripe) to process transactions; cloud infrastructure, storage, and CDN providers (including Cloudflare) that host and deliver the Service; analytics and product-telemetry providers used in aggregate/product-improvement form; advertising networks, but only for ad delivery and reward verification, and only with personalization where you've consented; content partners/producers, but only in aggregated, per-title performance and revenue form — never your individual viewing identity; and law enforcement or regulators where we are legally required to do so. We do not sell your personal information.
Because the Service is delivered on global cloud infrastructure, your information may be processed in countries other than where you live, including India and the United Arab Emirates. Where required, we rely on appropriate safeguards for such transfers.
We retain account and transaction data for as long as your account is active and afterward as needed to satisfy legal, tax, and dispute-resolution obligations (financial and royalty ledgers are kept immutable for audit purposes). Guest-device data that never converts to a registered account is periodically cleaned up.
Some categories have a fixed window and are deleted automatically once it passes:
You can request deletion at any time — see §9.
We apply access controls, encryption in transit, signed/short-lived tokens for playback and sessions, and server-side verification for every value-bearing action (token grants, entitlements, payments) so client tampering cannot create value.
Playback watermarking: while a title is playing, the player displays a visible marker derived from your account. It is there so that a recording of our content can be traced back to the account that made it, which is a condition of the licences under which we carry other people's films. It is shown to you, not hidden from you. No system is 100% secure, and we encourage you to use a strong, unique password and keep your devices up to date.
Depending on where you live, you may have rights to access, correct, download, or delete your personal data, object to or restrict certain processing, and withdraw consent (for example, for personalized ads) at any time without affecting the lawfulness of processing before withdrawal. If you're in India, these rights are provided consistent with the Digital Personal Data Protection Act, 2023 (DPDP Act) — you can also nominate another individual to exercise your rights in the event of death or incapacity. To exercise any of these rights, contact us at hello@buddycinemas.com or see our Grievance Redressal & Copyright Policy for our formal complaint process and response timelines.
The Service supports household Kids profiles with mature-content filtering and an optional parental PIN. We do not knowingly collect more personal information from a child than is necessary to operate a Kids profile, and a parent/guardian account holder is responsible for configuring and supervising it.
If you register after using the Service as a guest, we merge whatever that guest session held (token balance, watch history, watchlist, favorites, likes, and any active unlocks) into your new registered account, using a documented conflict policy (for example, summing balances, keeping the latest resume point). This merge is recorded for audit purposes. Note that a guest session cannot watch or earn tokens, so in practice there is usually little to merge beyond browsing history.
We may update this Privacy Policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, provide additional notice before they take effect.
For any privacy question, request, or complaint, contact us at hello@buddycinemas.com, or see our Grievance Redressal & Copyright Policy for our designated Grievance Officer and formal escalation process.