Privacy

CineAthens doesn't know who you are, and doesn't need to. Here is what happens to the little that passes through it.

Who is responsible

The controller is CineAthens (tsopanakis.com). For anything about your data, write to hello@cineathens.gr.

No accounts, ads or cookies

There are no accounts and no ads; CineAthens sets no cookies and runs no visitor analytics of its own.

On your device

Your place, your favourite cinemas, your preferences and the theme (light or dark) are kept in your browser (its local storage) or in the app, on your device; they go when you clear the site's data or remove the app. The language is in the page's address.

Your location

Your device's location is used only when you ask for it, and your browser or phone asks your permission first. For the distances it is sent with the request rounded to a grid of about one kilometre, never more exactly, and it isn't put in the address you see or share.

What the servers keep

Cloudflare, which delivers the site, sees each request and your IP address, as any server must, and keeps details of the requests in its analytics for a few days, among them the address asked for, which may carry your place on the one-kilometre grid. Our own server (on Google Cloud) keeps no request log, and its logs name only the page, never your IP address or your place.

Errors

When something breaks, the apps and the server send an error report to Sentry (in the EU): what broke, on what device or browser; nothing that says who or where you are.

Trailers

YouTube's privacy-enhanced player (youtube-nocookie.com) loads only when you press play on a trailer; once it plays, YouTube may store data on your device.

On what grounds

Running the service: legitimate interest (GDPR Art. 6(1)(f)). Your device's location only with your consent, which you give and take back in your browser's or phone's permissions.

For how long

Cloudflare's analytics: a few days. Error reports: up to 90 days. Nothing else about visitors is kept.

Who else handles it

Cloudflare (delivering the site), Google Cloud (the server, Frankfurt), Supabase (the database, Frankfurt; it holds the programmes, not you), Sentry (error reports, EU). The films' images are TMDB's, but we serve them from our own servers, as we do the fonts and the map. Cloudflare and YouTube are American companies and may handle requests outside the EU, under the EU–US Data Privacy Framework. The programmes are from the cinemas, the films' details from the cinemas and TMDB.

Your rights

You may ask to see or erase data about you, object to its processing, and complain to the Hellenic Data Protection Authority (www.dpa.gr). As nothing that identifies you is kept, there is usually nothing to give or erase.

For anything you'd like to ask: hello@cineathens.gr