Last updated: October 2, 2026.
PopSesh is made by MB „Lunarsoft“, a company registered in Lithuania (company code 308150841) at V. Nagevičiaus g. 3, LT-08237 Vilnius. Under the GDPR that makes us the controller of the data described on this page. Write to support@popsesh.com about anything here; we answer within a month.
PopSesh answers one question — what to watch tonight — and is built so that it needs to know as little about you as possible. This page describes the whole of what PopSesh collects, in the app and on this website, in plain words.
PopSesh works without registration, and that is the default. Your taste — likes, ratings, skips, watchlist — is stored on your device. When the app asks our server for recommendations, it sends your recent signals with the request; the server ranks a response and forgets who asked. While you are not signed in, we keep no taste profile of you anywhere. The one thing that does reach us either way is the usage events described further down, and they are filed under a random identifier rather than under you.
The app can also write your taste into a file that you share yourself, to carry it to another copy of PopSesh. The file goes wherever you send it; we never receive it. It holds your likes, ratings and skips, the cards you have already been shown, the moods you liked, your watchlist, the films you watched together and the four favourites on your profile, the days you reached a verdict, your evenings (to the hour), the titles and posters of the films in those lists, and your avatar — not partner names, not your settings — and anyone you give it to can read it.
Signing in with Apple exists for exactly one reason: so your taste can follow you to your next phone. From that moment your app uploads a copy of its saved state to your account. That copy holds what your taste and your lists need on another phone, and nothing else:
The streaming services you selected, hiding what you have seen, the general notifications and analytics switches and the one-time tips stay on the phone. This, too, holds from build 18; a copy uploaded by an earlier test build still carries them until the next upload from build 18 replaces it. A second phone of yours still on an earlier test build and still signed in writes the older form back with its own uploads, for as long as it stays that way.
We store all of it as one opaque record attached to your account and do not read inside it; the ranking still happens from what the app sends with each request.
The account itself is the second thing we keep, and it is what Apple hands us when you agree to share it: an email address and a name. The address is what the account is known by here, and the only way we could write to you about it — if you chose “Hide My Email”, what we hold is Apple’s relay address and not yours. Neither is used for marketing, and neither is shown to anyone else.
Deleting your account in Settings deletes the account and that copy of your taste together, from our live database at once; the backups are covered under “Backups” below. The app first asks you to confirm with Apple, so that we can also tell Apple to withdraw the Sign in with Apple link between you and PopSesh. If you back out of that step, or it cannot be completed, the app still deletes the account when you choose “Delete anyway”, and the link stays until you remove it yourself in your Apple ID settings. Signing out leaves both untouched on the server and leaves your taste on the phone.
To understand whether recommendations are getting better, the app reports product events — a swipe happened, a Match session found its film — under a random identifier created on your device. It is not your name, email, phone number, or advertising ID, and we do not connect it to you or to your account. It is still a pseudonym rather than true anonymity: in principle, records filed under one identifier can be told apart from records filed under another. You can turn this off in Settings → “Share anonymous usage”, and the app keeps working exactly the same.
Match evenings are part of this. When a session is opened, joined, decided or ended, our server reports it, with how long it took and a few counts such as how many cards were swiped. It files the report under the random identifier of the phone that started the session, and only while that phone’s switch is on when the session starts: turning it off takes effect from the next session. The report has no film, no name and no partner in it, and the guest’s phone is not named.
How long we keep them. An event is deleted 12 months after it reaches us. This happens on its own, on a schedule the server keeps — there is nothing to ask for and nothing for us to remember to do. Twelve months is what the only two questions we ask of these events need: whether recommendations got better after we changed how they are ranked, and how many evenings end in a decision. Both are read over a window, and the longest window either one wants is the same season a year earlier. Anything older describes a version of the app that no longer exists.
Those events are filed under that identifier and nothing beside it — no account, no name, no address — which is what keeps them apart from you. It also means we cannot find your rows from an email address, so turning the switch off is the reliable way to stop them. Nothing already sent carries your name or account; the identifier that ties those rows together is kept on your phone.
What we offered you, and what you said back. Beside those events the server keeps a record of the cards it dealt and the verdict you gave each one, together with the figures the ranking was made of. It is what lets us tell a recommendation that worked from one that got lucky. That record is filed under a one-time number for the deck — not for you, not for your device, not for an account: there is no such column in it, and no row names a person or a device. After 30 days the deck number is removed, so cards are no longer tied to each other by a number. That is all that is removed: the hour a card was shown, its place in the deck and the settings of the request it came from (the vibe and length you picked, how many signals the app sent) stay until the rows go after 12 months, like the events, and they can still show which cards were dealt together. They never showed whose deck it was. The same switch stops it: Settings → “Share anonymous usage”, off.
A Match session is two devices and a short code. Sessions live in server memory for at most a day and then disappear; what you swiped in a session is never shown to your partner and never written into your taste. The film you both said yes to is remembered by your devices — and, if you are signed in, inside the account copy described above, with the date to the hour and how long you took to decide to the minute.
When you share a film or series with the Share button, you get a link to a page about that title. There is one link per title, the same for everybody who shares it: our server makes it the first time anyone shares that title and hands the same one to everyone after. The row behind a link holds a random code (the end of the link), which title it points to, the month the link was first made, and how many times its web page has been opened. Links made before this version of the page were made one per share rather than one per title; they keep working as they were, and their dates were rounded to the month too. There is no name, device or account in that row, and nothing in it says who shared. How many people did is not recorded either, except that the older one-per-share links of a title add up to the number of shares made before this version of the page. Because the link belongs to the title and not to a person, these rows are kept for as long as the links work; there are at most as many of them as there are titles.
If you share a card while “Share anonymous usage” is on, the app also reports that a card was shared and whether it was a film or a series, under the random identifier described above. The link’s row does not carry that identifier. The web page a link opens loads its poster from TMDB’s image servers and, when the title has one, a YouTube trailer embed, so those two see the visitor’s IP address.
There are four kinds. Only the first two come from our server; the last two are set on your phone.
The app asks permission the first time one of these could matter — when a session starts, when you switch on the weekly deck, when you mark a film for tonight, or, with PopSesh Plus, when you save a film that is not out yet — and never at launch.
To send the first two we have to store where to send them. The address Apple issues to your phone — the device token — sits in one row with six other things: the same random identifier the analytics events use, when the row was last refreshed, whether you asked for the weekly deck, when it last went out, whether you share anonymous usage, and a one-way code of a secret kept on your phone that proves the row is yours, so nobody else can rewrite it. No account, no name, no session beside it. The row goes away when Apple tells us the token is dead, which is what happens when the app is deleted or reinstalled, and in any case after 90 days in which the app has not registered it again. Turning notifications off for PopSesh in iOS Settings removes it too: the next time you open the app it sees the switch is off and takes the row down.
Separately from the app, our website has one page with a form on it: popsesh.com/founders. If you fill it in, we store your email address, the time you left it, and a fixed label saying it came from that page, and nothing else. There is no name beside it, no device, no account, and no link to anything you have done in the app: it is a list of addresses and nothing more.
What it is for. One message, sent once, on the day PopSesh reaches the App Store, containing a code for a free year of PopSesh Plus. It is not a newsletter, and no second message will come from it. We ask for it on the basis of your consent, which is the tick box on that page, and you can withdraw it at any time.
How long. The address is deleted as soon as the codes are sent, and in any case 12 months after you leave it, on the same kind of schedule the server keeps for everything else here. Write to support@popsesh.com and we will remove it sooner, on the day you ask. A deleted address can survive in our database backups until they age out; see “Backups” below.
There is a second form on this website, and it is not ours. A Match guest opening an invitation on an Android phone is offered “Save me a seat”, which opens a form hosted by Tally — a third party, under their privacy policy and not this one. What you type there reaches them first. The form asks for an email address and nothing else, and the address is the only thing we take out of it: it is a list of people to write to once, if and when PopSesh runs on Android. We read the answers in Tally and do not copy them anywhere else. To be taken off it, write to support@popsesh.com and we will remove you on the day you ask.
We back up the whole database every night, and every copy is encrypted as it is made; the key that opens them is not on any of our servers. The copies on our own server are kept for about two weeks. A second copy goes to another machine, in Finland, and is kept for about a month. Old copies are removed by the next successful backup, so if backups stop for a while, the last ones stay until they start again. Backups are used for nothing but restoring the service after a failure.
So when something is deleted — an account, an address, an old event — it leaves the live database at once, but it can remain in a backup until that backup ages out: about two weeks on our server and about a month in Finland.
Film and series information is supplied by TMDB. This product uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB. Streaming availability data comes from JustWatch via TMDB.
Our server and database run on a hosting provider’s machine in the European Union, in the Netherlands (Amsterdam). The encrypted backup copy sits on a second machine, also with a hosting provider in the European Union, in Finland. Apple delivers the notifications and handles Sign in with Apple. Tally hosts the Android waiting-list form.
Film information is fetched from TMDB by our server, so TMDB sees our server’s requests and not your phone. Pictures are different: your phone loads posters, cast photos and streaming-service logos straight from TMDB’s public image servers, which see its IP address, as any image host does. If your network blocks that host, the app asks our server to fetch the picture instead. When you play a trailer, it plays in YouTube’s embedded player (youtube-nocookie.com), and YouTube sees that request.
“Reset taste data” in Settings erases everything the app knows about your taste. “Delete account” removes your account and the copy of that state we hold for it. Deleting the app removes its data from your phone, with a few deliberate exceptions kept in the system keychain, which outlives the app: the random analytics identifier, so that a reinstall is not counted as a new person; a random secret that ties this phone’s notification registration to this phone, so that nobody else can redirect it; and, if you had signed in, the sign-in token of that account (or, after a sign-out the keychain refused to carry out, the token with a mark that has it deleted at the next launch). None of them is your taste: after a delete-and-reinstall the app starts empty, and your taste comes back only if you sign in to your account again.
The GDPR gives people in the EU and the UK a set of rights over their data. We answer these requests from anybody who writes in, wherever they are.
The taste on your device needs no request from anyone: it never left the phone, and deleting the app deletes it. For everything above, write to support@popsesh.com.
PopSesh is made for a general audience and is not directed to children under 16. We do not knowingly collect personal data from anyone under 16; if you believe a child has given us some, write to support@popsesh.com and we will delete it.
MB „Lunarsoft“, V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania. Questions and requests about this policy: support@popsesh.com. If you believe we have handled your data wrongly, you may also complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (vdai.lrv.lt).