Privacy Policy
StreamTonight is built around a simple privacy stance: we collect the absolute minimum data required for the app to work, and nothing else. No ads. No account creation. The only third-party measurement in the apps is TikTok's install-attribution SDK, described in Section 4. We don't know who you are, and we have no interest in finding out.
This policy explains, plainly, what we store on our servers, what we store on your device, and what you can do about it. If anything here is unclear, email support@streamtonight.app and we'll either clarify or fix the policy.
1. Who runs StreamTonight
StreamTonight is operated by Matthew Mason, doing business as StreamTonight, a sole-proprietor business registered in Washington State (UBI pending issuance ~May 12, 2026). Address available on request. Contact: support@streamtonight.app.
2. What we store on our servers
The StreamTonight backend (hosted on Railway in the United States) stores the following per app install:
Per-install identifier
A stable identifier derived from your device:
- iOS:
identifierForVendor— a UUID Apple gives apps from the same vendor; resets if you uninstall every StreamTonight app from the device. - Android:
ANDROID_ID— a device + signing-key identifier; stable across uninstall + reinstall on the same device.
We use this only to associate your selected services, favorites, and title ratings with your install. It is not linked to your name, email, address, phone number, or any external account. (Before September 28, 2026 it was also used to track the 7-day free trial; see "Legacy trial and subscription records" below.)
Push notification token
An APNs token (iOS) or FCM token (Android) issued by Apple / Google to your specific app install, so we can send the daily summary push at the time you choose. The token is a random string with no personally identifiable information; uninstalling the app revokes it on Apple's / Google's side.
Selected streaming services
The list of services you toggled on in Settings (e.g., Netflix, Max, Hulu, etc.) so the backend can filter the nightly content list to only what you can actually watch.
Favorite show list
The TMDB IDs of shows and movies you've hearted, so we can tell you when their next episode airs and notify you on premiere day. Favorites also live on your device — the server copy is for cross-device-restore (if we ever ship that) and for the next-episode-air-date lookup.
Notification preferences
Your chosen notification time, your timezone (so we fire at your local time, not the server's), and whether you've paused notifications. Standard product-functionality data.
Title ratings
When you give a show or movie a 👍 or 👎, we store that vote with your per-install identifier (one vote per install per title, so re-voting replaces your earlier vote). Votes are combined into anonymous community totals shown in the app; individual votes are not shown to anyone.
Legacy trial and subscription records
Before September 28, 2026, StreamTonight offered a free trial and paid subscriptions. For installs from that period we stored whether you were in a free trial, subscribed, in grace period, or expired, plus a reference to your Apple / Google subscription transaction so we could verify it with Apple's or Google's APIs. We no longer collect this information, but records created before that date are retained on our servers as legacy data. We never saw your credit card, billing address, or Apple ID / Google account. You can ask us to delete your install's records anytime (see Section 6).
3. What we DON'T store
- No name, email, phone number, or password. We don't have an account system.
- No browsing or watching history. We don't integrate with any streaming service's API. We can't see what you actually watch.
- No location data. We use your device timezone (e.g., "America/Los_Angeles") for notification scheduling, but no GPS, no IP geolocation, no precise location.
- No advertising IDs on our servers. Our backend never receives your IDFA or Google Advertising ID. (The TikTok Business SDK in the Android app can read the Google Advertising ID and send it directly to TikTok for install attribution — see Section 4. The iOS app does not request App Tracking Transparency permission, so the SDK cannot access your IDFA.)
- No in-app analytics beyond install attribution. Apart from the TikTok Business SDK described in Section 4, the iOS and Android apps ship no analytics SDKs — no Google Analytics, no Firebase Analytics, no Mixpanel, no Amplitude, no Sentry session replay, no Crashlytics with PII. (Our marketing website at streamtonight.app uses a TikTok Pixel for ad-attribution measurement — see Section 4. That pixel is web-only and never loads inside the app.)
- No ads or other third-party trackers in the app. No Facebook Pixel, no AdMob, no AppsFlyer, no Adjust inside the app itself.
- No data sold to third parties, ever. We don't sell your data because we don't have data worth selling.
4. Third parties we DO use (carefully)
A few service providers are necessarily involved in making the app work. Here's the complete list:
Apple Push Notification service (APNs)
Used to deliver iOS push notifications. Apple sees your push token. We don't share anything else with Apple beyond the notification payload itself (which is the night's content list).
Firebase Cloud Messaging (FCM) — Google
Used to deliver Android push notifications. Google sees your FCM token and the notification payload. The Firebase project is configured to use the minimum scope necessary for messaging.
The Movie Database (TMDB)
We query TMDB's public API to fetch episode lists, premiere dates, and metadata. TMDB doesn't know about you — we make those queries from our backend, not from your device.
Streaming-availability APIs
We query third-party APIs (currently RapidAPI's Streaming Availability) to check which services have which content. These queries happen from our backend, not from your device.
Railway (hosting)
Our backend runs on Railway, a US-based platform-as-a-service. Railway sees the same data the backend itself processes (per-install ID, services, favorites, ratings, push token).
TikTok Business SDK (in-app install attribution)
The iOS and Android apps include the TikTok Business SDK so that paid TikTok app-install ads can be attributed to the installs they produce. The SDK reports standard app events (install, launch, and retention) directly to TikTok, along with the device information TikTok's SDK uses to attribute them. On iOS, install attribution uses Apple's SKAdNetwork and the app does not request tracking permission, so no IDFA is available to the SDK. On Android, the SDK can read the Google Advertising ID; you can reset or delete that ID in your device's system settings. The SDK does not receive your selected services, favorites, ratings, or anything else you do inside the app. TikTok's handling of this data is governed by TikTok's own privacy policy.
TikTok Pixel + TikTok Events API (marketing-website ad attribution)
When we run TikTok ads pointing at streamtonight.app, we need to know whether those ads actually result in people installing the app — otherwise we're spending money blindly. To measure that, we use two TikTok products together:
-
TikTok Pixel — a small piece of JavaScript loaded on the marketing pages
at
streamtonight.app(the landing page, About, Privacy, Terms, Support, and 404 pages). The Pixel records two things: (1) the fact that a page was loaded, and (2) the fact that someone clicked the iOS App Store or Google Play download button. It does NOT load inside the iOS or Android apps themselves — the apps remain pixel-free. - TikTok Events API — until September 28, 2026, our backend sent TikTok a server-side signal when a user converted from the 7-day free trial into a paid subscriber, tagged with a SHA-256 hash of the per-install identifier described in Section 2 (never the raw identifier). Because StreamTonight no longer has paid subscriptions, we no longer send these events.
What TikTok DOES NOT receive from us: your name, email, phone number, address, payment information, App Store / Google Play account details, list of selected streaming services, favorite shows, notification preferences, IP address (we don't collect it), location, or anything you do inside the app. The Pixel sees only what page on streamtonight.app you loaded and whether you clicked a download button.
Why we accept the tradeoff: running paid TikTok ads without measuring whether they actually work is a fast way to waste money. The Pixel + Events API combination lets us see our true cost per install, so we know whether each ad campaign was worth the spend. Without it we'd have to guess. The Pixel and the in-app TikTok Business SDK are the only third-party measurement products anywhere in the StreamTonight stack.
What you can do about it: any standard ad-blocker or privacy browser extension blocks the TikTok Pixel on web. Inside the apps, the Pixel never loads; for the TikTok Business SDK, see the advertising-ID controls described above. Questions? Email support@streamtonight.app.
5. How long we keep your data
As long as your app install is active. If you uninstall the app, your push token gets revoked by Apple/Google automatically, and your install record stops being useful. We periodically prune records that haven't checked in for 90+ days. You can also explicitly delete your data anytime by emailing support@streamtonight.app with the request.
6. Your rights
Depending on where you live, you may have rights under GDPR (EU/UK), CCPA (California), or similar laws. Regardless of jurisdiction, you can:
- Access your data — email us and we'll send you everything we have associated with your install.
- Delete your data — email us and we'll delete the install record. (Or just uninstall the app; we'll prune within 90 days.)
- Correct data — for selected services and favorites, you can change them in-app. For other data, email us.
- Object to processing — by uninstalling, since the entire data set exists only to make the app work for you.
7. Children
StreamTonight is not directed at children under 13 (16 in the EU). We don't knowingly collect data from children. If you believe a child has used the app, please contact us and we'll delete the install record.
8. Security
The backend uses HTTPS for all communication. The per-install database is hosted on Railway's managed infrastructure. We use industry-standard practices for an indie app of our size, but we don't claim to be SOC2-audited. If you're a security researcher and find an issue, please email support@streamtonight.app with details.
9. Changes to this policy
If we change what we collect or how, we'll update this page and bump the "Last updated" date. Material changes will be announced in the app.
10. Contact
support@streamtonight.app
Mail goes to a real human (Matt). Reasonable response time: a few days.