Privacy Policy
StreamTonight is built around a simple privacy stance: we collect the absolute minimum data required for the app to work, and nothing else. No analytics SDKs. No third-party trackers. No account creation. We don't know who you are, and we have no interest in finding out.
This policy explains, plainly, what we store on our servers, what we store on your device, and what you can do about it. If anything here is unclear, email support@streamtonight.app and we'll either clarify or fix the policy.
1. Who runs StreamTonight
StreamTonight is operated by Matthew Mason, doing business as StreamTonight, a sole-proprietor business registered in Washington State (UBI pending issuance ~May 12, 2026). Address available on request. Contact: support@streamtonight.app.
2. What we store on our servers
The StreamTonight backend (hosted on Railway in the United States) stores the following per app install:
Per-install identifier
A stable identifier derived from your device:
- iOS:
identifierForVendor— a UUID Apple gives apps from the same vendor; resets if you uninstall every StreamTonight app from the device. - Android:
ANDROID_ID— a device + signing-key identifier; stable across uninstall + reinstall on the same device.
We use this only to remember whether your 7-day free trial has started (so reinstalling doesn't reset the clock), and to associate your selected services + favorites with your install. It is not linked to your name, email, address, phone number, or any external account.
Push notification token
An APNs token (iOS) or FCM token (Android) issued by Apple / Google to your specific app install, so we can send the daily summary push at the time you choose. The token is a random string with no personally identifiable information; uninstalling the app revokes it on Apple's / Google's side.
Selected streaming services
The list of services you toggled on in Settings (e.g., Netflix, Max, Hulu, etc.) so the backend can filter the nightly content list to only what you can actually watch.
Favorite show list
The TMDB IDs of shows and movies you've hearted, so we can tell you when their next episode airs and notify you on premiere day. Favorites also live on your device — the server copy is for cross-device-restore (if we ever ship that) and for the next-episode-air-date lookup.
Notification preferences
Your chosen notification time, your timezone (so we fire at your local time, not the server's), and whether you've paused notifications. Standard product-functionality data.
Subscription state
Whether you're in a free trial, subscribed, in grace period, or subscription is expired. Plus a hashed reference to your Apple / Google subscription transaction, so we can verify your subscription is real with Apple's or Google's APIs. We do not see your credit card, your billing address, or your Apple ID / Google account.
3. What we DON'T store
- No name, email, phone number, or password. We don't have an account system.
- No browsing or watching history. We don't integrate with any streaming service's API. We can't see what you actually watch.
- No location data. We use your device timezone (e.g., "America/Los_Angeles") for notification scheduling, but no GPS, no IP geolocation, no precise location.
- No advertising IDs. No IDFA on iOS, no Google Advertising ID on Android.
- No analytics SDKs in the app. The iOS and Android apps themselves ship zero analytics SDKs — no Google Analytics, no Firebase Analytics, no Mixpanel, no Amplitude, no Sentry session replay, no Crashlytics with PII. (Our marketing website at streamtonight.app uses a TikTok Pixel for ad-attribution measurement — see Section 4. That pixel is web-only and never loads inside the app.)
- No third-party trackers in the app. No Facebook Pixel, no AdMob, no AppsFlyer, no Adjust inside the app itself.
- No data sold to third parties, ever. We don't sell your data because we don't have data worth selling.
4. Third parties we DO use (carefully)
A few service providers are necessarily involved in making the app work. Here's the complete list:
Apple Push Notification service (APNs)
Used to deliver iOS push notifications. Apple sees your push token. We don't share anything else with Apple beyond the notification payload itself (which is the night's content list).
Firebase Cloud Messaging (FCM) — Google
Used to deliver Android push notifications. Google sees your FCM token and the notification payload. The Firebase project is configured to use the minimum scope necessary for messaging.
The Movie Database (TMDB)
We query TMDB's public API to fetch episode lists, premiere dates, and metadata. TMDB doesn't know about you — we make those queries from our backend, not from your device.
Streaming-availability APIs
We query third-party APIs (currently RapidAPI's Streaming Availability) to check which services have which content. These queries happen from our backend, not from your device.
Railway (hosting)
Our backend runs on Railway, a US-based platform-as-a-service. Railway sees the same data the backend itself processes (per-install ID, services, favorites, push token).
Google Play Billing / Apple StoreKit (subscriptions)
Subscription billing is handled entirely by Google Play (Android) or Apple (iOS). They process payment and tell us only whether your subscription is active. We don't receive your payment information.
TikTok Pixel + TikTok Events API (marketing-website ad attribution)
When we run TikTok ads pointing at streamtonight.app, we need to know whether those ads actually result in people installing the app — otherwise we're spending money blindly. To measure that, we use two TikTok products together:
-
TikTok Pixel — a small piece of JavaScript loaded on the marketing pages
at
streamtonight.app(the landing page, About, Privacy, Terms, Support, and 404 pages). The Pixel records two things: (1) the fact that a page was loaded, and (2) the fact that someone clicked the iOS App Store or Google Play download button. It does NOT load inside the iOS or Android apps themselves — the apps remain pixel-free. -
TikTok Events API — a server-side signal we send from our backend to TikTok
when a user converts from the 7-day free trial into a paid subscriber. We share a SHA-256 hash of
your per-install identifier (the same
identifierForVendor/ANDROID_IDdescribed in Section 2) so TikTok can match the conversion back to the ad click that led to it. TikTok does NOT receive your raw identifier — only the hash.
What TikTok DOES NOT receive from us: your name, email, phone number, address, payment information, App Store / Google Play account details, list of selected streaming services, favorite shows, notification preferences, IP address (we don't collect it), location, or anything you do inside the app. The Pixel sees only what page on streamtonight.app you loaded; the Events API sees only that a conversion happened, tagged by your hashed install identifier.
Why we accept the tradeoff: running paid TikTok ads without measuring whether they actually work is a fast way to waste money. The Pixel + Events API combination lets us see our true cost per install and cost per paid subscriber, so we know whether each ad campaign was worth the spend. Without it we'd have to guess. This is the only third-party measurement product anywhere in the StreamTonight stack — the app itself remains zero-tracker.
What you can do about it: any standard ad-blocker or privacy browser extension blocks the TikTok Pixel on web. Inside the apps, there is nothing to block because the apps don't load the Pixel. If you want your conversion specifically excluded from the server-side Events API stream, email support@streamtonight.app with the request — we can suppress your install's hashed identifier from future Subscribe events.
5. How long we keep your data
As long as your app install is active. If you uninstall the app, your push token gets revoked by Apple/Google automatically, and your install record stops being useful. We periodically prune records that haven't checked in for 90+ days. You can also explicitly delete your data anytime by emailing support@streamtonight.app with the request.
6. Your rights
Depending on where you live, you may have rights under GDPR (EU/UK), CCPA (California), or similar laws. Regardless of jurisdiction, you can:
- Access your data — email us and we'll send you everything we have associated with your install.
- Delete your data — email us and we'll delete the install record. (Or just uninstall the app; we'll prune within 90 days.)
- Correct data — for selected services and favorites, you can change them in-app. For other data, email us.
- Object to processing — by uninstalling, since the entire data set exists only to make the app work for you.
7. Children
StreamTonight is not directed at children under 13 (16 in the EU). We don't knowingly collect data from children. If you believe a child has used the app, please contact us and we'll delete the install record.
8. Security
The backend uses HTTPS for all communication. The per-install database is hosted on Railway's managed infrastructure. We use industry-standard practices for an indie app of our size, but we don't claim to be SOC2-audited. If you're a security researcher and find an issue, please email support@streamtonight.app with details.
9. Changes to this policy
If we change what we collect or how, we'll update this page and bump the "Last updated" date. Material changes will be announced in the app.
10. Contact
support@streamtonight.app
Mail goes to a real human (Matt). Reasonable response time: a few days.