MCU App

MCU App is a personal fan project, not a commercial product. This policy explains what data is collected when you use the app, why it is collected, and what rights you have over it under the General Data Protection Regulation (GDPR).

What data we collect

When you create an account and use MCU App, the following data is stored:

Google account data — if you sign in with Google: your display name, email address, and profile photo URL, provided by Google OAuth.
Watch history — which MCU titles you have marked as watched, and when.
Badges and collections — which badge and collection milestones you have earned.
App preferences — settings such as default view, sort order, and leaderboard visibility.

No payment information, precise location data, or sensitive personal data is collected.

Why we collect it

Authentication — to identify you when you sign in and to keep your account secure.
Core functionality — to save and sync your watch history and settings across devices.
Leaderboard — your username and watch count may be shown publicly on the leaderboard if you have not opted out in Settings.

The legal basis for processing this data is legitimate interests (providing the core service you signed up for) and, where applicable, your consent (e.g. leaderboard visibility).

Data storage and retention

All user data is stored in Google Cloud Firestore, hosted in the EU (europe-west) region. Data is retained for as long as your account exists. If you delete your account (via Settings → Danger Zone), all associated data is permanently erased from Firestore within seconds.

Temporary copies of your watch history and preferences may be cached in your browser's localStorage for faster loading. These are also removed when you delete your account or clear your browser storage.

You can also track titles without an account. That progress is stored only in your browser's localStorage on that device: it is not sent to us, and it is not counted in global stats or leaderboards. If you later sign up or log in, it is copied into your account and removed from the device; when you log in to an existing account you are asked first.

Third-party services

MCU App uses the following third-party services that may process your data:

Google Firebase (Authentication + Firestore) — handles sign-in and stores all user data. Firebase Privacy Policy.
The Movie Database (TMDB) — poster images are loaded directly from TMDB's CDN. Your IP address may be visible to TMDB when images load. No personal account data is sent to TMDB. TMDB Privacy Policy.
Vercel — the app is hosted on Vercel, which may log standard server access logs (IP address, user agent, request path). Vercel Privacy Policy.

No advertising networks or social media trackers are used. The only analytics is Vercel Web Analytics, which is cookieless: it records a page view and its referrer, stores nothing on your device, and does not build a profile of you or follow you across sites.

Cookies and local storage

MCU App does not use advertising or analytics cookies. The only cookies set are functional cookies required by Google Firebase to maintain your authenticated session. These are strictly necessary and do not require your consent under GDPR. Vercel Web Analytics sets no cookie of any kind, which is why it needs no consent either.

In addition, the app stores data in your browser's localStorage to cache your watch history and settings for performance, and, when you are signed out, to hold the progress you track without an account. This data never leaves your device except to sync with Firestore when you are signed in.

Your rights under GDPR

If you are in the European Economic Area, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — delete your account and all data at any time via Settings → Danger Zone → Delete my account.
Restriction — ask us to limit how your data is used.
Portability — request your data in a machine-readable format.
Objection — object to processing based on legitimate interests.

To exercise any of these rights, contact us using the details below.

Contact

For privacy-related requests or questions, reach out via LinkedIn. We aim to respond within 30 days.