Privacy Policy

Version 2026-09-01

This policy explains what personal data Flarepoint Labs collects when you use the Digital Poster app and device, why, and what rights you have. We have tried to keep it plain. If anything is unclear, email hello@flarepointlabs.com.

Who we are

Flarepoint Labs ("we", "us") provides the Digital Poster: a wall-mounted device that shows film poster artwork and trailers, and the app that controls it. For the personal data described here, we are the data controller. Contact us at hello@flarepointlabs.com.

What we collect, and why

Your account

When you create an account we process your email address, and, if you sign in with Google, the account identifier Google returns. Authentication is handled by our processor Supabase; we never see your password. Lawful basis: performance of our contract with you (running your account).

Your posters

We keep a record of each device you own or have access to: a device identifier, its model, firmware version, a coarse country (inferred from your connection, not a precise location), when it was last seen, who it is shared with, and any entitlements. This is what lets you control a poster from anywhere and lets us honour warranty and support. Lawful basis: performance of our contract, and our legitimate interest in securing the service.

What you choose to display

The films and artwork you put on a poster are stored on the device itself. When you control a poster remotely, that information passes through our relay in transit only — we do not store it, log it, or build a profile of what you watch or display. When you browse films, your requests are proxied to TMDB so we can hold the API key server-side; we do not retain a history of your searches tied to you.

Diagnostics (only if you turn them on)

Telemetry is off by default. If you switch it on, the device sends anonymous counts — how often trailers played or failed, and whether it could reach our backend — tagged with a random identifier that regenerates every 30 days and on a factory reset. It contains no titles, no artwork, and nothing that identifies you or your device. Lawful basis: your consent, which you can withdraw at any time in the app.

Diagnostics sharing is a separate choice, also off by default, which only a poster's owner can switch on (in the app, under Diagnostics). While it is on, when something goes wrong with that poster — it loses its internet connection, an update fails, it runs too hot or runs out of space — the poster sends us a report so we can see what happened and help: which problem it was, readings such as temperature, free space and Wi-Fi signal strength, the software version, and its recent activity log. Unlike telemetry, a report is linked to that poster, and so to the account that owns it. The poster removes your Wi-Fi network name and password, and the names of any films you cast and the device you cast to, before it sends anything; a report never contains what you watch or display. Reports are kept for 30 days and then deleted, and are deleted sooner if the poster is reset, changes hands, or its account is closed. Switching sharing off stops any further reports. Lawful basis: your consent, which you can withdraw at any time in the app.

Support

If you contact us, we keep that correspondence to help you and improve the product. Lawful basis: our legitimate interest in supporting customers.

What we do not collect

• Your Wi-Fi password. It is sent to your poster over an encrypted local connection and stored only on the device; it never reaches us.
• A viewing history or a profile of your taste.
• Precise location, contacts, photos, or anything the app does not need.

Third parties

We rely on a small number of providers, who process data on our behalf or provide part of the service:

• Supabase — account sign-in and authentication (EU region).
• Cloudflare — hosting, our backend, and content delivery.
• TMDB — film and TV metadata and artwork. This product uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB.
• YouTube / Google — trailers play through the official YouTube player. Your use of that playback is also subject to the YouTube Terms of Service and the Google Privacy Policy.

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy decisions or standard contractual clauses.

How long we keep it

We keep account and device-registry data for as long as your account is active, and for a reasonable period afterwards to meet legal, warranty and support obligations, then delete or anonymise it. Telemetry is aggregated and not tied to you. Diagnostics reports, sent only if you switch sharing on, are deleted after 30 days.

Your rights

Under UK data protection law you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email hello@flarepointlabs.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to help first.

Security

Traffic is encrypted in transit. Each device holds a unique credential, not a shared password, and account credentials are never stored by us in a form we could read. See our security policy for how to report a vulnerability.

Children

The Digital Poster is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will remove it.

Changes

If we change this policy materially, we will update the version and ask you to review and accept it again in the app before you continue.