Privacy Policy

What stays on your iPhone

• Your movie library — saved showings, their completed history, and estimated durations.
• Favorite theaters and any theater details you entered yourself.
• Timing corrections you make to a showing, and the timeline they produce.
• Your statistics, calculated on the device from the showings you have kept.
• Your settings, including whether reminders are switched on, and a display name if you set one.

There is no library sync: this collection is not uploaded to an account or copied between your devices. While a showing is actively tracked, the timing it runs on does reach our server — that is described below. Your library and favorite theaters stay on the device after you sign out, and they are deliberately kept if you delete your account. You remove saved showings yourself, in the app.

Deleting the app removes the copy it holds. Copies you made yourself are not affected: app data captured in a device or iCloud backup you have configured is a separate copy outside the app.

Account sign-in

How Much Longer? needs a verified account to finish setup and track a showing, and it offers two ways to get one: Sign in with Apple, or an email-and-password account whose email address you have confirmed.

Sign in with Apple. Apple provides an account identifier and an email address, which may be Apple’s private relay address rather than your real one. Your Apple password never enters the app. Supabase Auth runs the sign-in and holds your session; the app hands it the identity token and a one-time nonce from Apple — not your name. Our backend also stores your Apple account identifier and encrypted credentials that let us ask Apple to revoke the sign-in later. That is what makes a real account deletion possible for an Apple-linked account.

Email and password. The email address and password you type are sent to Supabase Auth over an encrypted connection for the operation you asked for — signing up, signing in, or setting a new password after a recovery link. The app does not keep or log your password. Supabase Auth processes the credential and stores what it needs to run the account, and it sends the confirmation and recovery emails on our behalf. You cannot sign in with an email account until the address is confirmed.

Whichever method you use, session tokens are stored in the iOS Keychain on your device, and a display name you set stays on your device. During confirmation and password recovery the app also keeps a verification value and a recovery flag in the Keychain until the email-link flow is finished; neither contains your password. A recovery session cannot be used as a normal sign-in; it works only for choosing your new password.

Tracking a showing

Starting a tracked showing asks our server for permission, because tracking is what the free showing and the subscription cover. The server keeps records tied to your account: session and reservation identifiers, the ledger for one free in-app tracked movie per UTC calendar month, and the entitlement decisions that allowed or refused tracking.

A Live Activity is available only with a current Plus subscription. The app registers an encrypted push token with our server, along with activity identifiers, phase times, and revision numbers, and updates reach your iPhone through Apple’s push service. The push payload does not carry the film title, the theater name, or your location. That does not make these records anonymous — they are attached to your account, and we describe them that way.

All of these times are estimates, and whether an update arrives depends on your connection and on iOS.

Subscriptions and purchases

Each verified account includes one free in-app tracked movie per UTC calendar month. Additional tracked movies in that month, Live Activity, and full Stats need Plus. Eligible customers may see one calendar month free on the yearly plan when Apple confirms the offer and eligibility; the monthly plan has no introductory trial. Apple shows the price and terms that apply before purchase and processes the payment — the app never receives your card or bank details.

RevenueCat verifies your purchase, subscription, and restore status and reports it back to us, linked to your verified account identifier. It also provides subscription reporting, so we can see how the subscription is performing overall. Apple and RevenueCat keep their own records under their own policies.

Movie search and posters

When you search for a movie, the search query is sent to our API, which looks it up in our shared current US in-theaters catalog and returns results — posters, runtimes, and reported budgets where available. If no results are found, you add the title and runtime manually instead. The title and runtime saved to a showing become part of the library stored on this iPhone.

Our catalog is maintained by a background worker that reads publicly available data from sites including Rotten Tomatoes, IMDb, Box Office Mojo, and The Numbers. That worker uses Apify, which runs the collection jobs on its own infrastructure under its own policy. Your search terms are not passed to Apify — the worker runs on a fixed schedule and is not triggered by searches.

Search queries are sent to our API only and are not recorded in body logs. When a poster is displayed, your device loads it directly from the external image host that serves it; that host receives ordinary network request information such as your IP address and the request path.

Tracking still sends the session identifiers and timing schedule described above to our server. The server does not need the movie title, theater name, or location for Live Activity updates.

Location and maps

Location is used only when you ask — when you search for theaters near you, or when you open directions. Apple Maps receives that search or directions request, and your location when you choose to share it. You can search by ZIP code or type a theater name instead. The app does not track your location in the background.

Entering a theater by hand does not authorize location access later. iOS asks separately, and you can change that permission at any time in Settings.

Keeping the service running

Our API sees the network address a request comes from and uses it to limit abuse. Our application database does not store that address; it keeps short-lived usage counters used to detect and limit abusive request patterns.

We log status codes, counts, and durations so we can tell whether the service is working. Those logs use fixed fields and exclude raw sign-in tokens, account identifiers, and request bodies.

Our API and background worker run on Render. Public API requests pass through Cloudflare at Render’s edge, where Cloudflare processes the network address, user agent, and request routing and security metadata for delivery, routing, abuse prevention, and security. HML has no advertising integration in this Cloudflare path.

Authentication and the database run on Supabase. Supabase Auth logging is active and can record events including sign-up, sign-in, password changes, email verification, token refresh, and sign-out. Those log entries may include a user ID, IP address, user agent, and provider metadata. When a log includes a user ID, it is linked to that account and is not anonymous. Render and Supabase each keep their own access and security logs on their own terms.

How long things are kept

• Tracking and reservation records stay with your account until the account is deleted. They are not removed automatically after a few days.
• Expired and completed Live Activity push records become eligible for scheduled cleanup after seven days. Cleanup runs in batches, so actual removal can lag behind that point.
• Completed account-deletion receipts become eligible after a configured 30 days. A deletion still pending, or one that failed, can be kept longer so it can be finished.
• Expired rate-limit counters become eligible after one day.
• Supabase logs — Auth and infrastructure logs are retained up to 7 days.
• Supabase database backups — Supabase keeps regular backups of the database under its own backup schedule. Supabase’s backup lifecycle governs when those copies age out; we do not claim that every downstream system reflects a deletion at exactly seven days.
• Render server logs are kept under Render’s retention policy.
• Cloudflare and other provider records follow each provider’s own retention under their policies.
• Support email is kept as long as it takes to answer you and handle any follow-up. There is no guaranteed automatic deletion time for the mailbox.

Deleting your account

Settings › Account › Delete Account starts a real deletion. It removes your RevenueCat customer record and deletes your data from our backend and from Supabase Auth. If the account is linked to Apple, deletion also revokes the Apple sign-in credentials we hold, and it may ask you to authorize with Apple again if those credentials are not available. An account created with email alone has no Apple revocation step. The app shows you when a step is pending or being retried — signing out successfully on your device is not the same thing as deletion.

Two things it deliberately does not do. It does not cancel an Apple subscription: manage or cancel that in your Apple account subscription settings. And it does not erase your local library — your movie history and favorite theaters stay on your iPhone, and you remove saved showings yourself.

For a privacy request, or if an in-app deletion will not complete, email support@howmuchlongerapp.com.

What you control

• Reminders are optional and off until you turn them on. iOS owns the permission and you can change it at any time in Settings.
• Location permission is yours to grant, refuse, or withdraw in iOS Settings.
• You can stop tracking a showing, and delete a showing or a saved movie, at any time.
• Subscriptions are managed and cancelled in your Apple account settings.
• You can sign out, or delete your account.
• Manual movie and theater entry are choices. Location is requested only when you choose a nearby search.

What the app does not do

• It does not sell your personal data.
• It does not track you across other apps or websites, and it contains no advertising integrations.
• It does not sync your movie library or your statistics to an account.
• It does not send marketing email or newsletters. Confirmation and password recovery messages are transactional account email.

Other companies involved

• Apple — sign-in if you choose Sign in with Apple, push delivery, Maps, and payment. Apple’s privacy policy
• Supabase — authentication, the confirmation and recovery emails, and the database behind tracking. Supabase’s privacy policy
• RevenueCat — purchase and subscription verification. RevenueCat’s privacy policy
• Render — API hosting and background workers. Render’s privacy policy
• Cloudflare — delivery and security at the API edge. Cloudflare’s privacy policy
• Apify — infrastructure for the background worker that collects public movie data to maintain our catalog. Apify’s privacy policy

Changes to this policy

If what is described here changes, this page is updated and the date at the top changes with it.

Contact

How Much Longer? is operated by John Greco. Questions about privacy, or a request about your data? Email support@howmuchlongerapp.com.