Legal
Privacy, briefly
Movy stores the minimum needed to hold a balance and a watch history. No marketing profiles, no data sales.
What Movy stores
Account: email address, password hash (bcrypt), credit balance, purchases, watchlist and credit history. Passwords are never stored in plain text.
Session: an HttpOnly cookie named movy_session holds a random token; only its SHA-256 hash is stored server-side. It expires after 30 days or when you sign out.
On your device: playback progress in localStorage under movy:progress:…. It is scoped to the account and device and is not sent to the server.
Payment data
Card and wallet details are handled by Ko-fi, not by Movy. Ko-fi may collect your payment details, email and name under its own privacy policy. Movy receives a payment notification with the amount, currency, Ko-fi transaction reference, message and the email used at checkout, and stores those for reconciliation.
If you pay without a payment code, the checkout email is matched against the account email so the credits can still be applied. Payments are kept for accounting and support.
What third parties load
Pressing play loads an iframe from the player host (streambetter.lat or its backup domain). That embed is a separate origin and may set its own cookies or local storage, including ad and anti-bot measurement. Movy cannot read inside the frame.
Posters and backdrops are loaded from image.tmdb.org, which sees your IP and browser headers as part of the image request. No tracking pixel is added by Movy.
What Movy does not do
- No first-party analytics script in this build.
- No advertising network injected around the player.
- No selling of personal data.
- No marketing emails unless you ask for them.
Server logs and hosting
The host may keep short-lived access logs (IP, path, user agent) for security and capacity. Login and sign-up attempts are rate-limited in memory by IP.
Retention and deletion
Account data lives until you delete the account. The account page has a delete control; it removes the profile, balance, purchases and watchlist. Server backups can retain a copy for a short period. Unused credits are not refunded automatically.
Your choices
Sign out to end the session, clear site data to drop local progress, or delete the account entirely. Blocking third-party cookies can break the player. Under GDPR/CCPA you can ask for a copy or deletion at the address below.
Children
Movy is not directed at children under 13 and does not knowingly collect data from them.
Changes and contact
Material changes will be reflected on this page. Questions go to hello@movy.help. See also the terms and disclaimer.