Privacy Policy

This Privacy Policy describes what data the kino.is website (hereinafter — the “Site”, “we”) processes, for what purposes and on what grounds, as well as what rights the user has.

1. What data we process

• Account data: email address, name/login, encrypted password, profile image (avatar) — uploaded by you or received from the service through which you signed in;
• Data from the service through which you signed in: when signing in via Telegram, VK ID, Google, Yandex ID, Facebook or Apple, we receive from the chosen service your identifier in it, your name and profile image, and also — if the service provides them and you consented in its dialog — your email address, gender and date of birth. When signing in via Apple, you may hide your real address: in that case we receive an Apple relay address, and our emails go through it, while your real address remains unknown to us. We do not request your phone number, friends list, messages or the contents of your accounts in these services. The gender and date of birth received are written only into empty fields of the profile and never overwrite what you have specified; any of them can be changed or erased in the settings. The linking of such an account can be disabled in the settings;
• Phone number, if you have chosen to save it: it is added only when you press the “Share number” button in our Telegram bot and is received already verified from Telegram itself. It is needed to restore access to your account if you lose Telegram. We do not call it or send advertising to it; the number can be deleted in the profile settings with one click;
• Passkeys, if you have added them: the public key, its identifier, the device type (“iPhone”, “Windows Hello”) and the dates of creation and last sign-in. Your fingerprint and face scan are not transmitted to us and never leave the device — the verification is performed by the device itself, and only a signature is sent to us. Any key can be deleted in the settings;
• Profile (all optional): country, city, date of birth, gender, favourite genres and the streaming services you use. You fill in these fields yourself, and some of them may be pre-filled from the data of the service through which you signed in (see the previous item). They can be changed or erased at any time in the profile settings; they are used to tailor recommendations more accurately, to show the showtimes listings for your city and correct age ratings;
• User data: ratings, lists, watched marks, reviews, friends, favourite cinemas, data you have imported from other services;
• Technical data: IP address, country and city derived from the IP address, network operator (ASN) and its name, browser information, server logs;
• Device information: device type and model (when the browser reports it), operating system and its version, browser and its version, screen resolution and window size, pixel density, colour depth, number of processor cores, memory size, touch support, language and time zone, network connection type, dark theme and reduced motion mode;
• Visit data: anonymised visitor and session identifier, pages viewed and path through the site, referral source and UTM tags, engagement time and scroll depth, clicks on ticket purchase links;
• Location: approximate — based on the IP address; precise — only with your explicit permission in the browser, when you click “Refine location” (used to show the nearest cinemas and showtimes). We store the history of transmitted locations: for authorised users — in the profile, for unauthorised users — under the anonymised visitor identifier, in order to transfer it to the profile if you register;
• Cookies and local storage: sign-in session, choice of interface language and country, visitor identifier, service preferences.

2. Purposes of processing

• registration and operation of the account, sign-in and security;
• personalisation: lists, ratings, recommendations, geo-dependent content (tickets, streaming services, premieres), selection of the nearest cinemas;
• sending service emails (email confirmation, access recovery, notifications);
• correct display of the site on your device and fixing layout errors;
• measuring traffic and service quality, detecting bots and abuse;
• weighting of ratings: votes from verified accounts are counted with greater weight than guest votes — this protects the ratings from manipulation.

3. Cookies

We use strictly necessary and functional cookies: the session identifier (sign-in), the choice of language and country, the anonymised visitor identifier for traffic counting. You can restrict cookies in your browser settings, however some functions (for example, signing in) may become unavailable. For more details, see the Cookie Policy.

3.1. Precise location and how to disable it

Precise location is never requested automatically: the browser will ask for permission only after you click the location refinement button, and you have the right to refuse. The site will continue to work — the region will be determined approximately by the IP address or selected manually. A previously granted permission can be revoked in the browser settings for the kino.is site; the stored location history can be deleted upon request (see section 6).

4. Sharing with third parties

We do not sell personal data. Data may be processed by our service providers solely for the operation of the Site:

• Cloudflare — CDN, request routing and protection against attacks; processes the IP address and connection parameters;
• Google Analytics 4 — traffic measurement; the script is loaded on the Site's pages and sets its own cookies. It can be disabled with blockers and browser extensions, as well as via cookie settings;
• online chat service — support widget; it is loaded on the Site's pages and processes the conversation you start in it;
• Brevo — delivery of service emails (email confirmation, access recovery, notifications);
• Gravatar — if you do not have your own avatar, we check once whether one exists in this service for your address. The request is made by our server, not your browser, and it is not the address itself that is transmitted but its hash; the image found is stored by us, and thereafter the page only accesses our own storage;
• Telegram, VK ID, Google, Yandex ID, Facebook (Meta), Apple — signing in to the Site via a third-party account, if you use one. Such a service learns that you are signing in to kino.is; before transmitting data it shows you a consent dialog with a list of that data, and the scope of the transfer is determined by that consent and by your account settings in the service. Processing on its side is governed by its policy;
• ticket sales partners and streaming services — when you follow a “Buy ticket” or “Watch” link, you are taken to the partner's website, and further processing is governed by its policy. The data of your purchase itself is not transmitted to us.

Determination of the approximate location from the IP address is performed on our server using a local database — the IP address is not transmitted anywhere for this purpose.

Data may be disclosed upon a justified request from authorised bodies in the manner prescribed by law.

5. Storage and retention periods

Passwords are stored solely as a cryptographic hash and are not available in plain form. We apply reasonable organisational and technical protection measures. Specific retention periods:

• visit events (pages, sources, engagement) — 90 days, after which they are deleted; only anonymised daily totals remain (how many visitors from a country, from what device type) without any link to a visitor;
• IP address in visit events — 30 days, then it is zeroed out; the country, city and network operator are derived from it at the moment of recording, so the link between the event and a specific subscriber disappears;
• device information — 90 days;
• account sign-in log (time, sign-in method, country/city, device) — 180 days, used for account security; the IP address in it is zeroed out after 30 days; if the account is deleted, the log is deleted together with it;
• location history without an account — 180 days from the last request;
• account data and the ratings, lists, reviews and locations associated with it — for as long as the account exists; they are deleted together with it.

6. Your rights

• obtain information about the data processed and a copy of it;
• correct inaccurate data in the profile settings;
• delete your account and the data associated with it — yourself and immediately, see Deletion of user data;
• delete the stored location history without deleting your account;
• object to processing for analytics purposes;
• withdraw consent (including the permission to access your location — in the browser settings) and unsubscribe from service emails.

To exercise your rights, write to [email protected].

7. Children

The Site is not intended for persons who have not reached the age at which, under applicable law, independent consent to data processing is permitted. We do not knowingly collect such data.

8. Changes

The Policy may be updated. The current version is always available on this page; the update date is indicated below.