Privacy Policy

Our Commitment to Privacy

At Eellu, we believe social media should bring joy, not anxiety about your data. We've built Eellu with privacy as a core principle. Simply put: we don't sell your data, we don't show ads, and we collect only what the service needs to work.

What We Don't Do

• No ad tracking: We don't track your behavior to build advertising profiles. We do record what you view in the app to improve recommendations, as described below.
• No ads: We don't show advertisements, so we have no reason to collect data for ad targeting.
• No data selling: We never sell your information to third parties.
• No personalization algorithms: Your feed is chronological, not manipulated by algorithms designed to maximize engagement.

Information You Provide

When you use Eellu, you may choose to provide:

• Account information: Email address and username to create your account.
• Profile information: Optional profile picture and display name.
• Content: Posts about media you're enjoying (movies, TV, books, etc.).

This information is used solely to provide the Eellu service and is never shared with third parties for marketing or advertising purposes.

Device Permissions

The Eellu app may request the following permissions, all of which are optional:

• Camera & Photos: Only used when you choose to upload something — a profile picture, a poster or collection banner, a photo attached to feedback, or a video reel. We never access your camera roll on our own.
• Contacts: Only used if you choose to find friends. Your device sends us phone numbers from your contacts so we can check which of them already have Eellu accounts. We use them for that check and nothing else — they are never stored on our servers, never used to message anyone, and never shared.

Data Security

We use industry-standard security measures to protect your account information. All data transmission is encrypted using HTTPS. We don't store sensitive information like passwords in plain text.

Your Rights

You have full control over your data:

• Access: You can view all the data associated with your account at any time.
• Deletion: You can request deletion of your account and its associated data at any time from Profile → Privacy & Data. We review and confirm the request, then erase your data within 30 days.
• Export: You can request a copy of your data.

Categories of Personal Information We Collect

• Identifiers: email address, username, display name, and (if provided) phone number.
• Account & profile data: profile picture, and — for age assurance only — your birth month and year (never the exact day).
• User content: posts, ratings, collections, comments within watch parties, uploaded photos/videos, and feedback you submit.
• Social graph & activity: who you follow, your likes, quiz/challenge scores, and watch-party participation.
• Technical data: device/push tokens, IP address and user-agent associated with sessions, used for security and to deliver notifications.
• Usage activity: which items you view, tap or play and where they appeared in a list, grouped by app session. We use this to decide what to recommend and to understand which features are used — never to build an advertising profile, and never sold or shared.

How We Use Your Information

We use personal information only to operate the service: creating and securing your account, showing you content from people you follow, delivering notifications you opt into, enforcing our minor-safety and age requirements, responding to feedback and reports, and meeting legal obligations. We do not use your data for advertising, profiling, or sale.

Service Providers We Share Data With

We do not sell or share your personal information for cross-context behavioral advertising. We rely on a small set of processors to run the service, each handling only what they need to:

• Sign-in providers: Google and Apple (only if you choose to sign in with them).
• Infrastructure: our self-hosted servers and database (Hetzner / Dokploy), Upstash (caching and job queue), and Cloudflare R2 and Stream (image and video hosting).
• Media catalog lookups: TMDB, Google Books, The New York Times Books, Deezer, and Podcast Index — used to fetch movie/TV/book/music/podcast details. These are outbound lookups and do not receive your personal data.
• Feature configuration: Statsig (mobile app only). We send only a random device identifier and derived true/false flags (e.g. adult vs. minor) — never your name, email, or date of birth.
• Messaging: Expo (push notifications, receives your device push token), Resend (transactional email), and Twilio (SMS one-time codes, receives the phone number you ask us to verify).
• Content safety: Google (Gemini API) receives still frames and the caption of reels you upload, to check them against our Terms before they are published. It does not receive your name, email, or date of birth, and it is not permitted to use this content to train its models.
• Error monitoring: Sentry, which receives crash and error reports from the app and our servers. These can include your account identifier and technical details of what the app was doing when something failed.

Data Retention

We keep your personal information for as long as your account is active. When you delete your account (or request deletion), we suspend the account immediately and permanently erase your data from our systems, including uploaded images and videos, within 30 days. Some records may be retained where required for legal, security, or audit purposes, for the minimum period necessary — for example proof that we honoured your request, and a non-reversible marker preventing a previously removed account from being recreated.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know, access, delete, and correct the personal information we hold about you, and to opt out of the sale or sharing of your personal information. We do not discriminate against you for exercising these rights.

• In the app: open Profile → Privacy & Data to request a copy of your data, deletion, or a correction, and to set your “Do Not Sell or Share” preference.
• By email: contact privacy@eellu.com. We verify requests using your account login.
• Do Not Sell or Share: see our Do Not Sell or Share My Personal Information page. We also honor Global Privacy Control (GPC) browser signals as an opt-out.

Children's Privacy

Eellu is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

Changes to This Policy

If we make changes to this privacy policy, we will notify you by updating the date at the top of this page. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this privacy policy or our practices, please contact us at privacy@eellu.com