Privacy Policy

The controller responsible for data processing on this website is:

Email: hello@ovkinos.de

OV Kinos is a free, ad-free cinema showtime aggregator. We process personal data only to the extent necessary to provide a functional website. We do not sell your data, do not build advertising profiles, and do not share data with third parties beyond the service providers listed below.

• Consent (Art. 6(1)(a) GDPR) — Google Analytics, newsletter, browser geolocation
• Legitimate interest (Art. 6(1)(f) GDPR) — Hosting, error monitoring, security, essential third-party services, approximate city preselection
• Contract performance (Art. 6(1)(b) GDPR) — Newsletter delivery after subscription

Below is a complete list of external services that may process personal data when you use OV Kinos.

When you use the “Find near me” feature, your browser asks for permission to share your GPS coordinates. This is a browser-native consent prompt (not our cookie banner); we never request your position without that click. Coordinates are only used to find cinemas near you: they are sent with your search to our server, which sorts cinemas by distance without storing them, and to Nominatim to show a place name (see above). The location you choose is stored in your browser’s localStorage so the site opens there next time; a GPS position is only reused for 12 hours.

Approximate city: if you have not chosen a city or location, we preselect the nearest city we cover. For this, our server reads the approximate location that Cloudflare derives from your IP address for each request and maps it to one of our cities; only that city (for example “Berlin”) is sent to your browser and shown as approximate. The IP-derived location is not stored, logged or passed on, and nothing is saved on your device unless you choose a city or location yourself. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in showing screenings near you).

We use your browser’s localStorage to store preferences and consent state. This data never leaves your device and is not sent to any server. Session cookies for user accounts are covered in Section 7.

• Consent state and timestamp
• Language preference (EN/DE)
• The city and location you chose (only after you choose them)
• View preferences (list/map/calendar)
• PWA install prompt state

You can optionally create an account to save favorite cinemas and access personalized features. We use passwordless magic link authentication: you enter your email, we send a one-time sign-in link, and a session cookie is set upon verification.

• Session cookie (ov_session): HttpOnly, Secure, SameSite=Lax, 30-day expiry. Used solely to keep you signed in.
• Account data stored: email address, favorite cinema selections, session tokens
• Magic link tokens expire after 15 minutes and are single-use
• You can delete your account and all associated data at any time from your account page

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / provision of a requested service).

If you subscribe to our newsletter, we store your email address, IP address (for abuse prevention), user agent, and confirmation tokens in a Cloudflare D1 database. We use a double opt-in process: you must confirm your subscription via a link sent to your email. Every email contains a one-click unsubscribe link. You can unsubscribe at any time.

You have the following rights regarding your personal data:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time (Art. 7(3))

To exercise your rights, contact us at hello@ovkinos.de.

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Some of our service providers are based in the USA (Google, Cloudflare, Sentry, TMDB). Data transfers to the USA are protected by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework.

• Showtime cache: 1–24 hours (automatically deleted)
• Analytics data (GA4): 14 months
• Error reports (Sentry): 90 days
• Newsletter data: until unsubscription
• Server logs (Cloudflare): 7 days
• Account data: until account deletion

We may update this privacy policy from time to time. The current version is always available at this URL. If we make significant changes, we will reset your consent preference so you can review the new policy.