App Privacy Policy

Information you provide and store

Saved titles, viewing progress and playback preferences are stored on your device. If you choose to import a test video, the app copies the selected file into its private device storage. This import feature does not upload that video to us. The current app is free to use and does not collect credit-card information or provide purchases or active push notifications. Square is not integrated into this app version. If a payment service is introduced, we will update this policy to explain that service before collecting payment information.

If you contact us, we receive your email address and the information you include so we can respond and handle support or privacy requests. Please do not send passwords or payment details.

Your shared viewer account and household profiles

When you choose email/password or Google sign-in, Google Firebase Authentication processes your sign-in credentials and account information. Candy Box receives your verified email address, account identifier and available display name to provide your viewer account. Passwords are handled by Firebase, not stored in the Candy Box database. ChatGPT sign-in remains available for existing accounts. These sign-in methods do not grant access to private filmmaker or staff records. Read Firebase privacy information.

The updated apps require a free account to watch. Earlier test builds remain on the previous playback service during the update rollout. We use the same website sign-in identity for viewer and filmmaker access, but viewer registration does not grant access to private filmmaker records. Our current sign-in provider is ChatGPT. We receive your account identifier, email and available display name; we never receive your sign-in password.

We store viewer preferences, separate optional marketing and rewards enrollment choices and dated consent records. Household profiles store a first name and whether the profile is for kids. A nickname may be used. We do not ask for a child’s email or date of birth. A parent PIN protects access to adult profiles; we store a salted hash, not the PIN itself.

Device sessions remain signed in for up to six months unless revoked. Phone and Apple TV session credentials use operating-system secure storage; other TV apps use their platform’s app storage. Our server stores session hashes. Connection codes expire after ten minutes. Short-lived request counters help prevent sign-in abuse.

At Account and profiles, you can change opt-ins, manage profiles, reset your parent PIN after website sign-in, or delete your viewer profile and revoke all viewing sessions. This deletes viewer profiles and consent records, but does not delete your identity-provider account or separately retained filmmaker agreements and financial records. Contact us for requests concerning those records.

Rewards enrollment is optional. Verified watch-time accrual is not active in this release, and local playback positions are not used to award merchandise.

Streaming and service information

The app contacts our catalog service to retrieve titles and playback links and uses Bunny Stream to deliver video. Our hosting and delivery providers receive technical information such as your IP address, requested media, request time and device or network information. We use service information to deliver playback, diagnose problems, secure services and prevent misuse. Viewing a streamed video necessarily sends a request to the video provider; local viewing history is distinct from those service records.

Google advertising and privacy choices

The app includes Google Mobile Ads (AdMob) and Google’s User Messaging Platform for privacy choices. This test version requests Google demonstration ads and requests non-personalized advertising. Test ads do not generate advertising revenue. Non-personalized does not mean no information is processed.

Google’s advertising SDK may collect or share IP addresses, device and advertising identifiers, app or ad interactions, and diagnostic information for ad delivery, measurement and fraud prevention. An IP address may indicate approximate location. The current app does not request precise GPS location, microphone or contacts access.

Where available, the app presents Google’s privacy message and checks whether ad requests are permitted. You can revisit available choices through Profile → Advertising → Ad privacy options. You can also use your device’s advertising-ID and privacy controls. Withdrawing consent does not undo earlier lawful processing. If advertising cannot initialize, you can continue watching.

Read Google’s Privacy Policy and how Google uses information from apps that use its services. Advertising partners and options shown in a consent message may depend on the configured service and region.

Sharing and external services

Information is processed by providers that support hosting, streaming, advertising and communications. We may disclose information when required by law or necessary to protect the safety, rights or security of our users and services. Opening an external film page, trailer or website subjects that visit to the destination’s privacy practices. We do not upload your locally imported videos or send your local saved-title list to advertisers through the app’s own features.

Retention, deletion and your rights

Use Profile → Clear device data to remove the app’s saved titles, watch history and imported test files from the device. This does not erase independent records held by Google or other service providers. Device backups may retain copies according to your operating-system settings.

We retain support correspondence and service records as needed to provide support, operate and secure the service, resolve disputes and meet applicable obligations. Provider retention is governed by the provider’s applicable policies; we do not promise that clearing local data deletes provider records.

Depending on your location, you may have rights to access, correct or delete personal information, restrict or object to processing, withdraw consent, or request a portable copy. Contact us using the address below. We may need information to verify a request and will respond as required by applicable law. You may also contact your local privacy regulator. Where consent is required, we rely on that consent; other processing supports requested services, legitimate operational and security needs, or legal obligations.

Children, security and international processing

An adult must create and manage the household account. Kids profiles are limited to publisher-approved titles and do not request advertising in this release. Use a first name or nickname for each profile and do not enter additional personal information about children. If you believe a child has provided information to us, contact us so we can investigate and address it.

Services may process information in the United States and other countries where providers operate. We use secure network connections for catalog and video delivery, but no system or transmission is guaranteed to be completely secure.

Updates and contact

We will update this page when our app’s practices change, including before introducing materially different account, advertising or payment features. The effective date identifies the current policy.

Avail Entertainment LLC · Candy Box Films / Avail
Privacy and support: jj@availfilms.com