The short version
- MovieShare requires no real name, email address, phone number or account. Friends you connect with see the display name you choose.
- Your Profile, Ratings, Taste Weights, Friend Snapshots, and Friends results are stored locally. To share with a friend, one of you creates an invitation and the other accepts it, forming an encrypted Friend Connection. You can also copy or share records yourself with AI Export. AI Export can include friends you select under labels such as Friend 1, never their names, and always excludes Taste Weights.
- MovieShare does not track you. Records shared with a friend pass through MovieShare's servers encrypted for the friend's phone. The servers keep them for about seven days and cannot read them. They process the delivery metadata needed to route them and limit abuse, such as IP addresses, timing and sizes.
- The app contacts MovieShare's catalog service for public movie data. It sends a random Install ID, region, language, and the public lookup you requested.
- The website uses no cookies, analytics, advertising, tracking pixels, chat widgets, or remotely hosted fonts.
- The closed-beta page links to Google Groups and Google Play. MovieShare does not collect your email for beta enrollment.
Data inventory
| Data | Where | Purpose | Retention |
|---|---|---|---|
| Profile ID and display name | Your phone | Identify your Profile on your phone and to friends you connect with | Until you delete local data or uninstall |
| Ratings, Seen states, and Taste Weights | Your phone | Calculate your recommendations | Until you delete local data or uninstall |
| AI Export of selected movie records | Your phone, then the clipboard or receiving app you choose | When you choose to copy or share it, give an external AI chat your movie titles with the years, Ratings, and Watch Dispositions you select, plus the titles, Ratings, and seen status of friends you select | Temporary attachments expire after 24 hours on the next app launch or share, or when you delete local data. External retention depends on the receiving service. |
| Friend Snapshots and Friends results | Your phone | Calculate group recommendations | Until you delete them, delete all local data, or uninstall |
| Public movie metadata and catalog region | Your phone | Show and rank current movie candidates | Cached locally until refresh or local deletion |
| Random Install ID | Your phone, then transiently in backend memory | Rate limiting and blocking abuse | The raw value is hashed immediately and is not logged |
| Region, language, search text, and public movie IDs | MovieShare backend and TMDB during a request | Return the public movie data you asked for | Not stored or logged by MovieShare |
| Hashed Install ID status and hourly counters | AWS DynamoDB | Apply service limits and operator blocks | Counters expire after about 48 hours; status remains until changed |
| Aggregate service metrics and sanitized errors | AWS CloudWatch | Detect outages and throttling | Error logs are retained for no more than 7 days |
| Encrypted connected Profiles and Friend Recommendations | Sending/receiving phones; ciphertext in private AWS S3 | Sharing with friends you connected | Approximately seven days for current cloud delivery ciphertext; local records remain until removal or local deletion |
| Public keys, opaque connection/routing IDs, status and signed active recommendation registries | AWS DynamoDB | Authorize pairing, delivery, quotas and withdrawal | Pending invitations follow the 24-hour acceptance deadline (an invitation from an older app version that was already accepted can wait up to seven more days for its inviter's approval); active control metadata lasts until disconnect; closed state has a 90-day logical window followed by asynchronous TTL cleanup. Work counters about 48 hours. |
| Private signing/exchange keys and pairing secrets | Device secure storage only | Endpoint authentication and content decryption | Per-connection keys and secrets are removed on Disconnect. The signing identity remains until Delete all data or uninstall. Excluded from Android backup/transfer. |
What the network can still see
Internet services receive normal connection metadata when a request reaches them. AWS CloudFront sees an IP address while routing a catalog request, and TMDB sees connection metadata when it receives a provider request. Poster images load directly from TMDB's image service, so TMDB also receives normal connection data such as your IP address for those image requests.
MovieShare does not load or embed YouTube trailers in the app. If you choose to open a trailer, it opens in YouTube or your browser, and that service receives the usual connection data for your visit.
MovieShare disables CloudFront access logging and does not copy IP addresses, user agents, full URLs, search text, or movie IDs into its own logs. This is why the promise is"personal taste data stays on your phone unless you choose to share it."Friend Connection requests take the same route through CloudFront, so AWS sees the IP address of each one. They deliver shared records as ciphertext, and MovieShare does not hold the keys to decrypt them.
Sharing with friends
A Friend Connection is the only way to share movie records with a friend, and both phones must agree. In Friends, you create a Friend Invitation and show it as a QR code or send it as a link through a messenger. Your friend has 24 hours to accept it, and only one person can accept it. Creating the invitation is your consent: whoever accepts it first connects with you without another confirmation, including someone it was forwarded to, so share it only with the friend you mean. Neither phone sends movie records before acceptance. The pairing secret stays on the phones and in the link fragment, outside HTTP requests, but a messenger or browser can keep the complete link. You can connect with up to 20 friends, and an unaccepted invitation holds one of those places until its 24 hours end.
A connection works in both directions. Connected sharing includes your Profile ID and display name, all Ratings and seen states, Want to See and Skipped, and small public movie descriptors. You can also intentionally recommend a movie to one connected friend. It excludes other friends’ snapshots, search history, settings, Install ID, Taste Weights, scores and private keys. Shared movie references retain their provider and source ID. A connected snapshot holds up to 10,000 movie records. Ranking happens on the receiving phone; there is no friend-history browser.
Your phone encrypts the contents for your friend's phone. The encrypted records travel through CloudFront and an AWS Lambda function to a private S3 bucket, with control records in DynamoDB, and the service cannot decrypt them. Encryption does not provide anonymity: AWS processes source IP addresses, and the relay sees public authentication/exchange keys, opaque connection IDs, relationships between them, the separate Install ID abuse header, status, revisions, publication times, sizes, ciphertext digests, signatures and random active recommendation IDs/counts. App request/body and access logs are disabled. MovieShare uses this metadata only to deliver records, enforce limits and block abuse; it has no analytics or advertising. A malicious service can withhold an update; peer signatures do not prove that it returned the latest state.
Connecting, syncing, Send and Unsend need the internet. Saved Friend Snapshots and received recommendations work offline. Routine synchronization runs on app opening, foreground return or manual Sync, with no polling, background worker or guaranteed closing upload. Changes made later wait for another trigger. Send and Unsend are explicit foreground actions; offline actions remain pending. Sent means service acceptance, without delivery or read receipts. Read state is local to the receiver. In the upcoming Inbox preview, Mark as read keeps the suggestion visible and does not report reading to the sender.
Only current encrypted delivery copies are kept in private, non-versioned S3 with approximately seven-day lifecycle cleanup. Deletion is asynchronous. Pending invitation access ends at its 24-hour deadline, or for an accepted invitation from an older app version at its seven-day approval deadline, and storage cleanup follows asynchronously; active routing and signed current recommendation registries survive inactivity until disconnect. Closed state has a 90-day logical window. Afterward the API returns only retired status; physical TTL cleanup follows asynchronously. A connection-slot index of public authentication keys and opaque IDs enforces the 20-connection allowance. Indexes with only pending invitations expire after about eight days; active indexes last until closure, and abandoned pending slots are reclaimed on return. Encrypted pairing previews are removed once the phone they were sent to first shares its own records, or when the connection closes; previews for invitations from older app versions also end at their approval deadline. Temporary work counters expire after about 48 hours. Local history has no seven-day expiry.
Missing or expired ciphertext never disconnects a friend or deletes cached snapshots. A missed delivery waits for the sender to reopen and republish. Either friend can disconnect, clearing this friendship’s snapshots and both inbox directions on the local phone immediately; after service acceptance, the peer clears them at its next successful check. Unsend reaches the peer in the same way and its signed registry survives ciphertext expiry. Independent Ratings or saves deliberately made by the recipient and external copies remain.
Delete all data destroys local records and connection keys. While online, MovieShare attempts remote disconnection first and reports failure. Offline deletion cannot notify friends afterward, who may retain the last shared copy. Reinstalling or losing keys requires fresh pairing; this delivery service is not a cloud backup, recovery service or multi-device account.
AI Export
AI Export appears in Settings as Send to your AI Chat. Using it is your voluntary, manual decision, much like taking a screenshot of your lists: MovieShare never sends anything by itself and never runs it automatically. It prepares an offline snapshot of your recorded movie titles. You choose whether to add Ratings, Want to See, Won't See, and release years, and the app remembers that choice on your phone. You review a summary and a warning before each Copy or Share, then paste or share it yourself. It excludes names, identifiers, timestamps, search history, Taste Weights, and match scores. You choose the receiving app and submit the prompt there.
You may also add saved friends so the AI can suggest movies to watch together. Each friend you select is sent as Friend 1, Friend 2, and so on, with the movie titles, Ratings, and seen status from their Friend Snapshot, plus release years when you include them. Their names and Profile IDs are never sent. Only include friends who agree, because their records leave MovieShare too. Friend selection starts empty every time you open the screen.
Copy places the prompt in your device's clipboard. Share hands the prompt or a text file to the app you select. MovieShare does not contact an AI service to send these records. The receiving app may upload them under its own policies. Excluding names and identifiers does not guarantee anonymity. The receiving service may associate the records with your account or other information it holds.
The receiving app or AI service may store, use, or further share the records under its own policies. MovieShare does not control or accept responsibility for that service's privacy practices or where your data goes. Review its privacy policy before sending. The export never enters MovieShare's backend and the external conversation never synchronizes back. MovieShare remains responsible for its own handling of your data.
Large exports use temporary text attachments in private app cache. Attachments are removed after 24 hours on the next app launch or share, and Delete all data removes them immediately. Deleting MovieShare data cannot delete external copies or your clipboard.
Your controls
Settings lets you change your local display name and catalog region, clear poster memory, or delete all local MovieShare data. Delete all regenerates both random identifiers and returns the app to Onboarding. Operating-system cloud backup is disabled for the private database and Install ID. Uninstalling may permanently erase your history.
Children and policy changes
MovieShare is a general movie-discovery tool and is not directed to children. It does not knowingly collect personal information from children because it does not provide accounts or direct the app to children. Friend Connections and AI Export must not be used to send a child's personal information.
Material policy changes will appear on this page with a new effective date. If a future feature changes where personal data is processed, it requires a privacy review before release.