Privacy Policy

We collect only what Sooperfan needs to run the rewards and community experience:

• Account information — your mobile number, which you verify with a one-time code sent by SMS to sign in; a display name; a profile photo if you upload one; your preferred app language and the film genres and languages you pick as interests; and, if you choose to add one, an email address. We use a third-party SMS provider to deliver verification codes.
• Guest use — when you first open the app we create an anonymous account so you can look around before signing in. It holds an account id and your in-app activity, but no phone number or name until you sign in.
• Profile and activity — points balance, streaks, completed challenges and quiz answers, prize-draw entries, referrals (including, on Android, the referral code carried by the install link that brought you to the app), and notification preferences.
• Community content — what you add in the Cinema section: films you mark as watched, your ratings and reactions, lists you build, posts and comments. Your display name and this content are visible to other Sooperfan users (see Section 5).
• Task submissions — links or social handles you submit to prove you completed a fan challenge (for example, a link to a post you shared about a film).
• Connected social accounts — where you choose to connect a social platform to verify a task, the identifiers that platform returns to us (see Section 6).
• Prize fulfilment details — if you win, the details needed to deliver your prize: for a physical prize, your name, postal address and phone number; for an experience or screening, a contact name and phone number, the names of any guests you bring, and your preferred date; for a digital prize, an email address. We ask for these only when you claim a prize.
• Device and usage data — device model, operating system, app version, language, IP address, crash logs, and in-app actions, plus a push notification token if you enable notifications. For a small sample of sessions we record an anonymised replay of how the app's screens were used, to find and fix problems; text you type and images are masked in these recordings.
• Share-link visits — when anyone opens a Sooperfan share link, we record the visit to count it and to stop fake clicks from earning the sharer points: the IP address and network, country, browser and device details (such as screen size, time zone, graphics hardware and language settings), and a device fingerprint derived from them, plus a first-party cookie on the share-link site that lasts up to 180 days. This applies to people who open a link without having Sooperfan.
• Communications — messages you send us for support, reports about other users’ content, or other requests.
• Cookies and local storage — used on the website for sign-in, security, and basic analytics, and on the share-link site as described above.

We do not collect your precise location, contacts, photos (other than a profile photo you choose to upload), or advertising identifiers.

• To create and operate your account and the points, challenge, and prize-draw features.
• To verify task completion and award points fairly, and to prevent fraud and abuse.
• To run the Cinema community: show your lists, ratings and posts to other users, and act on reports and blocks.
• To run prize draws and deliver prizes to winners.
• To send service messages and, where you opt in, notifications about new tasks and confirmed points.
• To improve, secure, and troubleshoot the app.
• To comply with legal obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

Under the DPDP Act we process your personal data on the basis of the consent you give when you sign up and enable features, or for certain legitimate uses permitted by law. You may withdraw consent at any time (see Section 8); withdrawing it may limit features that depend on that data. Where users are in regions with other laws, we also rely on the corresponding bases under those laws.

We do not sell your personal data. We share it only with:

• Service providers (Data Processors) bound to use it only on our instructions. Today these are:
  • Convex — database, backend, and sign-in infrastructure.
  • Twilio — delivery of SMS verification codes.
  • OneSignal — push notification delivery (your device token and account id; no name or number).
  • PostHog — product analytics and masked session replays (in-app actions, device type, OS, app version; tied to an account id, not your name or number).
  • Sentry — crash and error reporting (stack traces, device/OS info, an account id).
  • Vercel — website hosting and content delivery.
  • Cloudflare — hosting for share links (including the visit data described in Section 1) and for the film catalogue the app browses.
  • OpenAI — helps draft quiz questions. Only quiz topics are sent; no personal data.
  • The Movie Database (TMDB) — film titles, artwork and ratings shown in the app. We request film data only; no personal data is sent to TMDB. This product uses the TMDB API but is not endorsed or certified by TMDB.
• Other users — your display name and community content are visible to other Sooperfan users, as described in Section 5.
• Prize fulfilment — when you win, the delivery or booking details you gave us are shared with the courier, venue, or film partner who provides that prize, only as needed to deliver it.
• Film and promotional partners in aggregate or anonymised form, except where you have explicitly opted in to share more.
• Authorities, where required by law or to protect rights and safety.

If Redacted Studios is ever involved in a merger, acquisition, or transfer of its business or assets, your personal data may be transferred as part of that transaction, subject to this policy.

The Cinema section of Sooperfan is a shared space. Your display name, the films you mark as watched, your ratings, your public lists, and your posts and comments can be seen by other users. Do not include personal details you would not want public.

You can report content or a person, and block a person, from their list or profile in the app. Blocking hides you from each other across the community; you can undo it under Profile → Settings → Blocked people. Reports are reviewed by our team, and content that breaks our Terms of Service is removed. We keep records of reports and blocks so we can act on them.

Many challenges involve public social platforms (such as following or sharing film content). When you complete these, you interact with those platforms under their terms and privacy policies, which we do not control. If you connect a social account to Sooperfan, we receive only the limited identifiers needed to confirm the task, and we never post on your behalf without your action.

We keep your personal data for as long as your account is active and as needed to provide Sooperfan. After you delete your account we delete or anonymise the associated data within 30 days, except where we must retain limited records for security, fraud-prevention, tax, prize-audit, or legal-compliance reasons — in which case we keep only what is necessary and for no longer than required. Prize fulfilment details are kept for as long as needed to deliver the prize and to answer any audit of the draw.

As a Data Principal under the DPDP Act you may:

• access and obtain a summary of the personal data we hold about you;
• correct or update inaccurate data;
• request erasure of your data and withdraw consent;
• nominate another person to exercise your rights in case of death or incapacity;
• raise a grievance with our Grievance Officer and, if unresolved, with the Data Protection Board of India.

Users in the EU/UK (GDPR) and California (CCPA/CPRA) have corresponding rights, including access, correction, deletion, portability, and the right to opt out of any sale or sharing of personal information; we honour these requests for those users.

Notifications can be switched off at any time in your device settings. To exercise any other right, email privacy@redacted-studios.com. We aim to respond within 30 days.

You can delete your Sooperfan account and the personal data associated with it at any time:

• In the app — open Profile → Settings → Delete my account and confirm.
• On the web — use our account and data deletion page to submit a request without installing the app.

We will delete your account and associated personal data within 30 days, subject to the limited retention described in Section 7. We will also instruct our processors to delete data we shared with them.

Sooperfan is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. This threshold also reflects the DPDP Act’s protections for children and the rules governing prize promotions.

We use reasonable technical and organisational safeguards — encryption in transit, access controls, secure on-device storage for prize details, and monitoring — to protect your data. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We will notify affected users of any significant breach as required by law.

Redacted Studios is incorporated in Singapore and may process data on infrastructure located outside India. Where we transfer personal data internationally, we do so consistent with the DPDP Act and applicable transfer requirements, with safeguards appropriate to the data.

We may update this policy and will revise the “Last updated” date above; material changes will be notified in-app or by email. For privacy questions, to exercise your rights, or to reach our Grievance Officer:

• Grievance Officer — privacy@redacted-studios.com. We acknowledge grievances within 24 hours and resolve them within 15 days.
• Privacy and data requests — privacy@redacted-studios.com
• Postal — Redacted Studios Pte. Ltd., 139 Cecil Street, #03-10, YSY Building, Singapore 069539