Privacy Policy

Last updated: November 9, 2026

1. Who We Are

Refract ("we", "our", "us") is a cross-media tracking application operated by Refract, a company established in France (registration in progress), 56 Boulevard de Strasbourg, 75010 Paris, France. We are the data controller for the personal data described in this policy.

This Privacy Policy explains how we collect, use, and protect your information when you use the Refract mobile application and website (getrefract.app).

2. Information We Collect

Account Information

When you create an account with an e-mail address and password, or sign in with Google or Apple, we collect your e-mail address and, for Google and Apple, the display name and profile photo they provide. We also collect the username you choose during onboarding.

User-Generated Content

Imports

When you import your history from another service, the file you upload is processed in memory and is not stored; the entries it contains become part of your library.

Automatic Backups (Google Drive and Dropbox)

Automatic backups are off unless you turn them on. If you connect Google Drive or Dropbox, Refract regularly saves a copy of your data export to your own account and keeps the most recent copies there. To do this we store an access authorization for that account, encrypted, and use it only to create, list, download and delete the backup files Refract has created. In Google Drive we only request access to files created by Refract (the "drive.file" permission); in Dropbox we only use a dedicated app folder (Apps/Refract). We do not read, list or modify any other file in your account. You can disconnect at any time from the app's settings, which deletes the stored authorization, and you can also revoke Refract's access from your Google or Dropbox account settings. Backup files stay in your account until you delete them, under Google's or Dropbox's own privacy policy.

Refract's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Trakt

Trakt sync is off unless you connect your Trakt account. When you do, you sign in on Trakt's own page and approve Refract there; Refract never sees your Trakt password. We then store your Trakt username and an access authorization for your account, encrypted, and use it only to sync what you choose between Refract and Trakt (for example your watch history, ratings or watchlist), in the directions you choose. Items received from Trakt become part of your Refract library, like any other entry. You can disconnect Trakt at any time from the app's settings, which deletes the stored authorization and stops all access to your Trakt account; you can also revoke Refract's access from your Trakt account settings. Disconnecting does not delete what was already synced: you can remove those entries yourself, or delete your Refract account to remove everything, and you can ask us to delete your data at any time (see Contact Us). Your data on Trakt is governed by the Trakt Privacy Policy. Refract uses Trakt but is not endorsed or certified by Trakt.

AI Features

Some features send text you write or search for (for example comments, reviews, list descriptions and search requests) to AI model providers, to translate it, moderate it or generate recommendations. These providers are contractually prohibited from using it to train their models.

Feedback and Bug Reports

When you submit feedback or a bug report through the app, we collect your message, your Refract username, your e-mail address, technical information about your device (model, OS version, app version), and any screenshots you attach. These reports are delivered to the tools our team uses to receive and manage them, and are processed to detect duplicates and route them to the right place.

Discord Community Server

We run a community server on Discord, outside the app. Posts in its public forums are read by our bot to detect duplicate reports and archived; Discord's own privacy policy applies to your use of Discord. To request deletion of archived posts, contact us.

Crash Reports

Crash reports and error logs are collected through Sentry. They include device information (OS version, app version, stack traces) and your account identifier, so that we can investigate a problem you report.

Technical Logs

We keep request logs and sign-in events (IP address, device type, timestamps) for security and performance.

Subscriptions

If you subscribe to Refract Pro, Apple or Google process the payment. We receive your subscription status through RevenueCat; we never receive your payment card details.

Streaming Availability

Your selected streaming country preferences are stored to display relevant platform availability. This data comes from TMDB/JustWatch and does not involve your personal viewing habits on those platforms.

3. How and Why We Use Your Information

Legal Bases

4. Data Sharing

We do not sell or share your personal information for advertising. We share data only with the providers we need to run the service:

Calendar Subscription Links

Calendar sync is off unless you turn it on. When you do, we issue you a personal calendar link. That link is a bearer secret: anyone who has it can read the releases in that calendar (which shows what you watch) without signing in to Refract. If you subscribe to it, your calendar provider (for example Google, Apple or Microsoft) fetches it on its own schedule and stores its contents on their servers under their own privacy policy. You choose what the calendar contains, you can disable it at any time, and you can reset the link, which makes the previous one stop working immediately.

5. Data Storage & Security

Your data is stored on Google Cloud. Feedback and bug report content is additionally processed on a dedicated server hosted by Hetzner in Germany, and archived in the documentation tools our team uses. Data is encrypted in transit. Access to these systems is restricted to the Refract team. We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, or destruction.

6. Data Retention

7. International Data Transfers

Refract is established in France. Some of the service providers we work with are located outside the European Economic Area, which means your personal data may be transferred outside the EEA.

Where that is the case, we transfer personal data on the basis of an adequacy decision of the European Commission, a provider's certification under the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission, as applicable to each provider. You can request further information about the safeguards applying to a specific transfer by contacting us using the details in the Contact Us section.

For users in Brazil, data is transferred to France and to the providers above under the safeguards of LGPD article 33, including the standard contractual clauses approved by the ANPD.

8. Your Rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. You can delete your account and export your data directly from the app's settings. You may lodge a complaint with your supervisory authority: in France, the CNIL (cnil.fr).

Brazil

Under the LGPD you may also request confirmation of processing, anonymisation or blocking of unnecessary data, and information about the entities we share data with, and you may petition the ANPD. Our data protection contact (encarregado) is privacy@getrefract.app.

California

California residents have the right to know, delete and correct their personal information, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising these rights. We have not sold or shared personal information in the preceding 12 months. Requests: privacy@getrefract.app, directly or through an authorised agent; we verify requests against your account.

9. Automated Decisions

We do not make decisions with legal or similarly significant effects by automated means alone. Our only automated measure is an anti-spam limit that stops an account from sending follow requests to many people in a short time; it has no other effect and you can contact us to have it reviewed.

10. Children's Privacy

Refract is not intended for children under 15. We do not knowingly collect information from children under 15.

11. Website

The public information pages on getrefract.app do not embed third-party analytics scripts.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days in advance through the app or by e-mail.

13. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at:

privacy@getrefract.app

Refract, 56 Boulevard de Strasbourg, 75010 Paris, France