Privacy Policy

Last updated: 28 September 2026

Content is made by Postal Media. This policy covers Content on iPhone, iPad, Mac and Apple TV, and on Android. It describes exactly what the app does with information. It was written from an audit of the app's own source code rather than from a template, and it is meant to be checked against the app's behaviour. Where the two versions differ, it says so.

The short version

Content has no account and no login, and it does not send us your library, your notes, your ratings, or anything else you put into it. There is no advertising, no analytics of ours, no crash reporting, and no tracking.

Your library lives on your device. On Apple devices it is also kept in your own iCloud account if you leave syncing on. On Android it may be included in your phone's own backup to your Google account. We cannot read any of these.

What does leave your device is the questions Content has to ask other people's catalogues, such as what a film is, what a book is called, or where a show is streaming. Those questions, and the two small jobs our own service does, are described in full below.

What we collect

We keep no user records. There is no sign-up, no password, and no database of people or libraries. We have no way to see what is in your library.

We do run one small service, at content.postalmedia.io. It is a pair of short programs hosted by Vercel, with no database and no storage of its own. It has two jobs, and it keeps nothing from either of them:

• Game searches. The game catalogue we use, IGDB, requires a private key that cannot safely be shipped inside an app. So the app sends a game search to our service, which adds the key, passes the search to IGDB and returns the answer unchanged. It sees your search text and nothing else from the app.
• Shared links. When you share a title, the link points to a page on our service. That page is built entirely from what is written in the link itself (see Sharing a title), and it looks nothing up and saves nothing.

Vercel keeps a log of each request to our service for one day, and then deletes it. An entry records the time, the address that was asked for, and the device's standard browser identification. As with any website, Vercel also sees the IP address the request came from. For a game search, the words you searched for travel inside the request rather than in its address, so they are not in the log. For a shared link, the address is the link itself, so the title and the sender's name are in the log for that day. We look at these logs only to fix problems with the service. We do not use them to identify anyone, and we never copy them or combine them with anything else.

The Apple version of the app contains no analytics, telemetry, crash-reporting, attribution or advertising software. Apart from Apple's own frameworks, its only outside code is YouTubePlayerKit, an open-source player for trailers (see Trailers). The Android version includes Google's ML Kit for the scanner, which reports usage metrics to Google (see Google ML Kit). Neither version reads or creates an advertising identifier, a vendor identifier, or any per-install token.

What leaves your device

Searches

Content does not hold a catalogue of its own. When you search, the text you type is sent to the services that do, so they can answer:

One search can reach several of these at once. A search set to All (the default on iPhone and iPad), or the Search tab on Android, asks every kind of catalogue you have switched on. To reach only one, choose that kind first, or search from its shelf in your library.

A search can also be a description, such as "90s comedies" or "films by Nolan". On iPhones and iPads with Apple Intelligence, the app lets Apple's on-device model read what you typed. That happens on the device, and nothing is sent to Apple for it. On Android, the app interprets descriptions with its own rules, also on the device. Either way, what is then sent to the catalogues is an ordinary search.

Older game entries, saved before the app moved to IGDB, may still fetch their details and images from RAWG. If the game service is ever unavailable, the app falls back to RAWG for searches too, with your search text and our RAWG key.

Opening a title

Opening a title's page sends that title's catalogue ID (not your search text, and not your notes) to the service it came from, to fetch its description, cast, artwork and seasons. Pictures are downloaded from those services' image servers, and from Apple, the Cover Art Archive, RAWG, YouTube and Steam for some artwork.

To show where something is streaming, the app asks TMDB, whose streaming information comes from JustWatch. To make a button that opens the title itself rather than a search, it may also ask:

• Wikidata, run by the Wikimedia Foundation, with the title's TMDB or IMDb number.
• The public websites of Prime Video, Disney+ and Crave, with the title's name.
• Apple's iTunes Search, with a show's name, to find its page in the Apple TV app.

For music, links between services (such as an Apple Music album opened in Spotify) are resolved through Odesli.

A podcast's episodes are read from its own feed, which is downloaded directly from wherever the podcast is published. That publisher sees the request, as it would from any podcast app.

Trailers

On iPhone, iPad and Mac, trailers play inside the app in YouTube's own embedded player. YouTube (Google) receives that request, may set its own cookies inside the player, and applies Google's privacy policy to it. On Apple TV and Android, a trailer opens in the YouTube app or website instead.

The scanner

You can photograph a cover, a barcode or a shelf of spines to find what to add. The photo is read on your device and never uploaded. On Apple devices it is read by Apple's Vision framework, and on Android by Google's ML Kit. Both run entirely on the phone. What leaves the device is only what the scanner read: the words on a spine, or a barcode's number. Those are sent as ordinary searches to the services above.

Importing from other apps

When you import an export from Sequel, Letterboxd, IMDb, Sofa, Goodreads or Discogs, the file is read on your device and is not uploaded anywhere. To find each entry, the app looks up its title, its ID or its ISBN with the services above, exactly as if you had searched for it.

Reminders when a show comes back

If you ask to be reminded when a show's next season starts, the app checks that show's schedule with TMDB now and then, including in the background, so the reminder can move when the date does. Each check sends the show's TMDB ID and nothing else. The reminder itself is scheduled on your device.

Sharing a title

A title you share goes out as a link. Everything the link shows is written into the link itself: the title, its kind, its year, its catalogue ID, the address of its poster, and the name you gave as the sender. Anyone you send it to, and anyone they pass it on to, can read those. Opening the link loads a page from our service that simply displays them. Messaging apps fetch that page to draw the preview card. We do not store links or keep a record of who shared what, beyond the one-day log described above.

What every request carries

The requests above carry what is described and nothing else we add: no account, no device identifier, no advertising identifier, and none of your library. Wikidata, Open Library and MusicBrainz ask every app to say who made it. For them, the app names itself and gives our support address. As with any request to any website, the service on the other end also sees your IP address and your device's standard browser identification. Each of these services has its own privacy policy, and we do not control what they do with what they receive.

iCloud (iPhone, iPad, Mac, Apple TV)

If Sync Personal Library to iCloud is on, your library, lists and their items are mirrored to your own private iCloud database using Apple's CloudKit. It is on by default, and can be turned off in Settings on iPhone, iPad and Mac. This is your iCloud account, not ours. Apple gives developers no access to a person's private iCloud data, so we cannot read it. Turning the setting off stops the mirroring entirely, from the next time the app is opened.

Shared Libraries are the only feature that deliberately shows your data to other people. When you create one and invite someone, that library and its items are shared through Apple's iCloud sharing with the people you invite, and with nobody else. If you have set a display name, it goes with the items you add, so members can see who added what. Your personal library, your private notes and your own star ratings are not part of a Shared Library. Leaving or deleting a Shared Library removes your access to it.

Your Google backup (Android)

If your phone backs up its apps to your Google account, Android includes Content's data (your library, lists and settings) in that backup, so a new phone can restore it. That backup belongs to your Google account and is handled under Google's terms. We have no access to it. You can turn it off in your phone's own backup settings.

Google ML Kit (Android)

The Android scanner reads photos with Google's ML Kit, which runs on the phone. The photo and the text it reads are not sent to Google. ML Kit does report to Google how it is performing and being used: information about the device, the app and the scanner's performance, which Google uses to maintain and improve it. Google describes exactly what is collected on its ML Kit data disclosure page. This is sent only when you use the scanner.

Nothing else

The app does not phone home, check in, or report on how you use it.

What stays on your device

Your library, lists, notes, ratings, the dates you started and finished things, who recommended them, and any reminders you set are all stored on your device. Pictures and the details the app has fetched are cached on the device, so it works offline and does not ask the same question twice.

The app's daily backups are kept on your device only. It never uploads them to us or anywhere else.

Permissions the app asks for

Content asks for permissions only when you use the feature that needs one, never at launch. Refusing any of them leaves the rest of the app working.

On iPhone, iPad and Mac:

• Camera, for the scanner. The photo stays on your device. A photo you choose instead comes through the system's own photo picker or from Files, and the app sees only the photo you pick.
• Apple Music, so you can search Apple's album catalogue. The app only ever searches. It does not read your music library or what you listen to.
• Calendar (add events only), so a reminder you set can go into your calendar. The app can add events, but it cannot read what is already in your calendar.
• Notifications, so a reminder can tell you when something is out or a show is back. These are scheduled and delivered on your device, and the reminder text never leaves it.

On Android, the app asks only for Notifications, for the same reminders. Photos are taken with your camera app or chosen through the system's photo picker. Calendar events are handed to your calendar app to save. Neither needs a permission, and the app sees only the one photo you take or pick.

On Apple TV, the app checks which streaming apps are installed, so it can offer to open a title in one you actually have. This is a yes-or-no check against a fixed list of streaming services, and nothing about it is recorded or sent anywhere.

Files you export

Everything you export is created on your device and goes wherever you send it. We never receive a copy.

• CSV and PDF exports contain each item's title, description, genre, who recommended it, the date you finished it, and your star rating. They deliberately do not include your private notes.
• Library transfer files (.contentlibrary) and backups are meant to move or restore your whole library, and are complete to match: they include your notes, dates and ratings. Treat one as a copy of your library, because that is what it is.
• Shared list files (.content) and plain-text lists contain titles and basic catalogue details, and the name you gave as the sender. They have no notes, dates or ratings.

Your choices

Because we hold nothing about you, there is nothing of yours on our side to request, correct or delete. What the app keeps is yours to manage. Erase All Data and Reset App in Settings removes everything from the device, and from your iCloud too if syncing is on. Deleting the app removes it from the device. If you have a question about the one-day logs described above, or anything else in this policy, write to us.

Children

Content is a general-audience app. It does not knowingly collect information from anyone, of any age.

Changes to this policy

When the app changes what it does with information, this policy changes with it and the date at the top moves. The current version is always at this address.

Contact

Questions about this policy, or about anything the app does with information, can go to the person responsible for privacy at Postal Media: help@postalmedia.io

Postal Media is a business name registered in Nova Scotia, Canada.