Privacy Policy
Last updated: 7 November 2026
The short version. We collect what we need to run your account and show your Sidequels to other people: your username, email, password (only as a secure hash), the content you post and the people you follow and message. We don't sell your data, we don't show ads, and we don't use analytics or tracking cookies. You can delete your account at any time from the app.
1. Who we are
Sidequel (the app at app.sidequel.app and our mobile apps) is run by Dimitrios Sideridis, Thessaloniki, Greece. He is the controller of your personal data under the EU General Data Protection Regulation (GDPR).
For anything about your data, write to privacy@sidequel.app. For everything else, support@sidequel.app.
2. What we collect
Information you give us
- Account: username, email address and password. We never store your password itself, only a one-way hash (BCrypt) that can't be turned back into it.
- Invite code: during the closed beta, which invite code you signed up with.
- Profile: an optional profile photo and a short bio.
- Content: your Sidequels, comments and replies, the images you upload, the GIFs you choose, your likes, your favorite movies, and the @mentions you write.
- Connections: who you follow, who follows you and who you block.
- Messages: your direct messages and the Sidequels you send to other people, and your messaging setting (who can message you).
- Reports: when you report content or an account, the report, the reason and any details you add, together with a copy of what you reported.
- Emails to us: whatever you write when you contact us.
Information created when you use Sidequel
- Notifications about likes, comments, replies, mentions and new followers.
- Session data: the tokens that keep you logged in. Your device stores them; our server stores only a hash of the long-lived one, so a copy of our database can't be used to log in as you.
- Security data: to stop spam and password guessing we count requests per IP address, account and email address over short time windows. These counters are stored only as one-way hashes and are deleted within hours.
- Verification codes we email you (to confirm your email or reset your password), stored only as a hash, and valid for 24 hours or 15 minutes respectively.
- Technical logs: our servers keep short technical logs (for example error messages, which can contain an IP address) to keep the service secure and to fix problems.
- Timestamps such as when you joined, posted, verified your email or last read a chat.
What we don't collect
We don't collect your location, your contacts, your real name (unless you put it in your username or bio) or your phone number. We don't use analytics, advertising or tracking tools, and we don't build advertising profiles.
3. Who can see what
- Everyone using Sidequel: your username, profile photo, bio, Sidequels, comments, replies, like counts, and your followers and following lists. While Sidequel is in closed beta, only logged-in members can see these; after launch some of them may also be visible without an account.
- Only you: your email address, your favorite movies list, who you have blocked, and your settings.
- You and the other person: your direct messages.
- Our moderators see content that someone reported. For a reported message they see only that one message, never the rest of the conversation.
Blocking someone hides your content and your conversations from each other in both directions.
4. Why we use your data (legal basis)
| What we do | Legal basis (GDPR art. 6) |
|---|---|
| Create and run your account, show your content, deliver messages and notifications, send the emails you ask for (verification, password reset) | Performance of our contract with you (the Terms of Service) |
| Keep Sidequel safe: rate limits, spam and abuse prevention, handling reports, moderation and suspensions, security logs | Our legitimate interest in a safe service, and the safety of other users |
| Backups, so that data isn't lost after a failure | Our legitimate interest in a reliable service |
| Answering requests from authorities and keeping records the law requires | Legal obligation |
You can object to processing based on legitimate interests (see section 9).
5. Who processes data for us
We use a few service providers to run Sidequel. They process data only to provide their service.
| Provider | What for | Where |
|---|---|---|
| Oracle Cloud | Our server and database | Frankfurt, Germany (EU) |
| Cloudflare | Storing and serving uploaded images, database backups, our domain's DNS and email forwarding | Global network |
| Resend | Sending account emails (verification and password reset codes) | United States |
| Let's Encrypt | HTTPS certificates (no user data) | United States |
Content loaded from other services
Some things you see in Sidequel load directly from other companies' servers. When that happens, your device connects to them and they receive your IP address and normal browser or device information:
- TMDB (The Movie Database): movie posters and images. Movie searches go through our server, so TMDB never sees what you search for.
- GIPHY: the GIFs in the GIF picker and in posts. GIF searches go through our server.
- Google Fonts: the app's typefaces.
Their own privacy policies apply to that connection.
Transfers outside the EU
Some providers above are based in the United States or run global networks. Where personal data leaves the European Economic Area, we rely on the safeguards the GDPR provides for this, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, where applicable.
We don't sell your data and we don't share it with advertisers. We disclose data to authorities only when the law requires it.
6. How long we keep it
- Your account and content: for as long as you keep your account. Content you delete is deleted right away (an unsent message becomes "message deleted" with its text removed).
- When you delete your account: your account is hidden immediately and you are logged out everywhere. If you log in again within 30 days, the deletion is cancelled. After 30 days we permanently delete your account, profile, Sidequels, comments, likes, favorites, follows, notifications and uploaded images. Your conversations are deleted too, for both participants.
- Backups: deleted data can remain in our backups for up to 30 more days, until those backups expire. We don't restore deleted accounts from backups.
- Notifications: 90 days.
- Login sessions: a session ends after 30 days without use, or when you log out.
- Security counters: a few hours. Verification codes: 15 minutes to 24 hours.
- Technical logs: rotated automatically and kept only for a short time.
- Reports: a report about someone's content, and the copy of that content, may be kept after the content or the account is deleted, for as long as we need it to keep Sidequel safe (for example to handle repeated abuse). Reports you filed are deleted together with your account.
- Suspended accounts are kept, hidden, so that a suspension can be reviewed or reversed.
7. Storage on your device
The app stores your login tokens on your device (in secure storage on phones, in the browser's storage on the web) and keeps a cache of images so they load faster. These are strictly necessary for the app to work. We don't use cookies for analytics or advertising.
8. Security
All connections use HTTPS. Passwords, session tokens and email codes are stored only as hashes. Our database is not reachable from the internet, and backups are kept in private storage. Changing your password logs you out on all your other devices. No system is perfectly secure, so please use a strong password that you don't use anywhere else. If a breach affects your data, we will inform you and the authorities as the law requires.
9. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it, also in a machine-readable format (portability);
- correct it (you can edit your profile, posts and comments in the app);
- delete it (Profile → ⋯ → Delete account);
- restrict or object to certain processing;
- complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority (dpa.gr); you can also contact the authority where you live.
To use any of these rights, email privacy@sidequel.app from the email address of your account. We'll answer within one month.
10. Age
Sidequel is for people aged 16 and over. If you are under 16, please don't create an account. If we learn that an account belongs to someone under 16, we will delete it.
11. Changes
If we change this policy, we'll update the date at the top. If the change is important, we'll also tell you in the app or by email before it takes effect.