FilmStacks Privacy Policy
FilmStacks is a catalogue of the films you own on disc. It is built to work without an account, and it is deliberately built so that almost nothing about your collection ever leaves your phone. The short version:
Your collection stays on your device and, if you choose, in your own iCloud Drive. There are no accounts, no user database of ours, no ads, no analytics, no third-party SDKs, no tracking and no data sale. We cannot see what films you own.
Your library
Titles, shelves, formats, editions, ratings, notes, custom fields, wishlist entries and your own cover photos are stored in a file on your device. We hold no copy and we cannot read it.
iCloud backup (optional, off by default)
If you turn on iCloud backup, FilmStacks writes the same snapshot the manual export produces into your own private iCloud Drive, under your Apple Account, in a container reserved for this app. We operate no server for it, we hold no copy and we cannot read it. It can be turned off in Settings at any time, and deleting the app's iCloud data removes it.
Film metadata, and the requests that leave your phone
Film titles, posters, cast, runtimes and streaming availability come from The Movie Database (TMDB). FilmStacks does not call TMDB directly. It calls a small service we run on Cloudflare, which holds the TMDB key so that it is not shipped inside the app.
That service receives, and only for as long as it takes to answer:
- the film title you typed into search, or the film id you opened
- the barcode digits, when you scan a disc
- the ordinary technical details every internet request carries, such as an IP address and a timestamp
It receives no account, no name, no email, no device identifier and no advertising identifier, because the app has none to send. Nothing ties one request to another or to you. Answers from TMDB are cached by film, not by person.
When a scanned barcode is unknown to the shared map, the app also asks a product-database service what retail product carries that barcode. That request contains the barcode digits and the ordinary technical details every internet request carries, and nothing else.
Library Card (optional, off until you choose a library)
Library Card shows whether your public library has a copy of a film on your wishlist on its shelf today. The list of libraries is built into the app, so looking through it sends nothing, and nothing is sent at all until you choose a library.
Once you have chosen a library, FilmStacks asks that library's online catalogue about the films on your wishlist, and about a film you scan or open. Each request contains:
- the film's title (and, when the library finds nothing under it, the film's original title)
- which library's catalogue to search, and the disc formats to look for
- the ordinary technical details every internet request carries, such as an IP address and a timestamp
It never contains a library card number, a PIN, your name or anything else about you, and FilmStacks never asks for them. These requests go from your phone straight to the library's catalogue, not through our service, so we do not receive them. For the libraries listed in the app, the catalogue is run for the library by BiblioCommons, under the library's own privacy policy.
When you tap Place a hold, Join or Search, the library's own website opens inside FilmStacks. Anything you do there, such as signing in with your card, is between you and the library; FilmStacks cannot see it.
The library you chose, its answers, your borrowed discs and their due dates are stored on your device with the rest of your library. Reminders before a disc is due are notifications scheduled on your iPhone.
The shared barcode map
Disc barcodes are not in any public film database, so FilmStacks builds the map from its users. When you confirm that a scanned barcode is a particular film, that single pairing (barcode, film) is stored so the next person who scans that disc is spared the work.
What is stored is only the pairing and a count. There is nothing attached to it that could identify you, and it says nothing about the rest of your collection. When nobody has confirmed a barcode yet, the app may store the product database's unconfirmed suggestion for it, so the next scanner starts from the same lead; confirmations are what make a pairing trusted. If you would rather contribute nothing, you can add titles by searching instead of scanning.
Camera and photos
The camera is used to read the barcode on a case and to look at the cover so FilmStacks can tell a 4K release from a Blu-ray. All of that runs on your device, using Apple's Vision framework. Camera frames are never uploaded and never stored. If you choose your own cover photo for a title, it is saved on your device and goes nowhere else.
Exports and shared images
CSV exports, backup files and the shelf poster image are produced on your device and go only where you send them. FilmStacks uploads none of them.
Files you choose to send us
If an import does not work, FilmStacks offers to email us the file so a later version can read it. Nothing is sent unless you choose to: the app opens your own Mail app with the file attached and a short note about what the app made of it (the kind of file, its column names and how many films matched), and the email goes only if you press Send. The file holds whatever it held when you exported it, usually your list of films and your notes.
We use the file only to teach FilmStacks to read files like it, and delete it once that update is out. We may keep its column names with a few made-up sample rows as a test, never your own entries. If you ask to be thanked, the name you type and what your file added appear on the Contributors page in the app. Your email address is never shown there or anywhere else.
Purchases
FilmStacks Pro is sold through Apple's In-App Purchase. Apple processes the payment and tells the app whether a subscription is active. We never see your name, your payment details or your Apple Account.
Service providers
- Cloudflare hosts the small service described above and processes those requests on our behalf.
- Google Cloud (Firestore) stores the shared barcode map on our behalf.
- TMDB supplies the film metadata and artwork. FilmStacks is not endorsed or certified by TMDB.
- Apple handles purchases and, if you enable it, your iCloud Drive backup.
Deleting your data
Deleting a title removes it from the app. Deleting FilmStacks removes the on-device library entirely. If you used iCloud backup, remove that copy in Settings, Apple Account, iCloud, Manage Account Storage. A barcode confirmation you contributed cannot be traced back to you, so there is nothing personal to remove from it; if you would like a specific pairing corrected, email us and we will fix it.
Data collection summary
| Category | What FilmStacks collects |
|---|---|
| Data used to track you | None |
| Data linked to you | None |
| Data not linked to you | Search terms and scanned barcodes, used to answer the request and to build the shared barcode map |
Library Card's requests go to the catalogue of the library you chose, not to us (see Library Card above). There is no analytics SDK, no advertising identifier and no third-party tracker in the app.
Children's privacy
FilmStacks is not directed at children under 13 and collects no personal data from anyone, of any age.
Changes to this policy
If this policy changes, the effective date above changes with it, and a material change will be noted in the app's release notes.
Contact
Questions about privacy, or anything else: support@madebykamal.app. See also the FilmStacks support page.