Privacy policy

Last updated 2 November 2026

The short version

Spud has no accounts. Your swipes, watchlist and interests are stored on your device, not in an account. To find shows, the app sends requests through our server, which keeps short-lived logs to help prevent abuse. If you opt in, we also collect crash reports and usage counts, but never which shows you swipe on.

What's stored on your device

• Your swipes, and the taste profile Spud builds from them.
• Your watchlist, chosen genres, languages and streaming services, and settings.
• Temporary copies of show details and images, which expire after 30 days.

We can't access what's stored on your device. If your phone backs up to your Apple or Google account, that backup may include this data. It's controlled by you and your backup provider, and we can't access it either.

What leaves your device

Requests for show information. To find shows, the app sends requests through our server, which runs on Cloudflare, and on to TMDB. These can include the genres, languages and streaming services you picked, shows you've kept (to find similar ones), and your region, which comes from your device settings. Requests aren't linked to an account or a name. Our server doesn't pass your IP address on to TMDB.

Server logs. To detect and stop abuse and fix problems, our server keeps logs of these requests. Logs include the request details above, the time, whether the request passed app verification, and your IP address. We use them only for those purposes, and Cloudflare deletes them automatically within 7 days. We don't use them to build a profile of you. Our server also counts requests by IP address for short periods, to limit excessive use.

App verification. To stop other software from using our server, the app uses Firebase App Check, which asks Apple or Google to confirm that requests come from a genuine copy of Spud on a real device. This happens whether or not you opt in to usage data, because the app can't load shows without it. It doesn't send your swipes, watchlist or interests, and it isn't used for advertising.

Poster images. Your device downloads posters directly from TMDB, which can see your IP address when it does.

Links you open. Trailers open on YouTube, and streaming and show links open on external sites. Their own privacy policies apply once you leave Spud.

Crash reports and usage data, only if you opt in

This is off unless you turn it on, and you can turn it off at any time in Settings. If you opt in, Spud uses Google Firebase to collect:

• Usage counts, such as onboarding completions and numbers of swipes, and how often the app is used.
• Crash reports, including crash details, device model, operating system version, and available memory and disk space.
• Random identifiers that Firebase creates for your installation of the app, so it can tell installations apart. These don't reveal your name, but they aren't fully anonymous.

Firebase also processes your IP address when it receives this data. Spud never sends which shows you swipe on or keep, and it doesn't use an advertising ID. We use this data to find bugs and see how the app is doing, and never for advertising. Google keeps Crashlytics crash data for 90 days. See Firebase's privacy information.

This website

spud.watch has no cookies, analytics or trackers, and the swipe demo on the homepage stores nothing. It's hosted on Firebase Hosting, which retains visitors' IP addresses for a few months to detect abuse and provide usage analysis.

Who we share data with

We don't sell your data. The services involved are Cloudflare, TMDB, Google Firebase and Apple, as described above, and they may process data in countries other than your own.

Deleting your data

Use Settings > Delete all data in the app, or delete the app. Both remove what's stored in the app on your device. A copy in your phone's backup is managed by Apple or Google, and can remain until that backup is replaced or you delete it. Server logs delete themselves within 7 days. We hold no copy of your swipes or watchlist, so we can't restore anything for you.

Turning off data sharing stops further collection. To ask about data already collected, email us. We don't hold your name or email, so we may need help identifying what relates to you.

Children

Spud isn't directed at children under 13, and we don't knowingly collect personal information from them.

Changes

If this policy changes, we'll update this page and the date at the top.

Contact

Questions or requests: hello@spud.watch