Privacy Policy

Data collection

Visto does not collect personal data. The app stores your archive on your device and has no Visto account system, advertising SDKs, or tracking. The iPhone app sends the anonymous usage statistics described under “Usage analytics”, which do not identify you.

There is no Visto server backend. There are no Visto accounts, subscriptions, social profiles, advertising identifiers, or remote activity logs.

Your watch archive

The shows, films, episodes, dates, ratings, reviews, watchlist entries, settings, and cached metadata you add to Visto are stored locally on your device.

Visto does not send this archive to Pedro Lanhoso or to any Visto-controlled service, and usage statistics never include it.

Optional platform sync

On iPhone, if you enable iCloud sync, Visto stores app data in your own private iCloud database using Apple's CloudKit service. On Android, if you enable Google Drive sync, Visto stores a journal in the app's private Google Drive app-data area. These services are governed by Apple's and Google's terms and privacy policies.

Pedro Lanhoso does not operate these services and does not have access to your private iCloud database or Google Drive app data. iCloud and Google Drive sync are separate and do not sync directly with each other.

Usage analytics

The iPhone app sends anonymous usage statistics to PostHog, a product analytics service. The data is stored on PostHog's servers in the United States.

What is sent. Events for when the app is installed, updated, opened or sent to the background; when you mark a film or episodes as watched, with the number of episodes and whether a film was a rewatch or rated; when you create a list or add a title to one, with whether the title is a film or a series; when you finish onboarding; and when a catalog provider becomes ready to use. Events also include which catalog provider you selected and whether it is set up, but never your credentials.

Device and app context. Device model and type, operating system version, app version and build, language and region, time zone, screen size, and whether the device is on Wi-Fi or cellular.

A random identifier. Each install gets a random identifier that is not linked to your name, email address, Apple Account or advertising identifier. No person profiles are created.

What is not sent. Titles, catalog IDs, list names, ratings, reviews, notes, your watch history and your iCloud data are never sent. The app uses no advertising identifiers, does no cross-app or cross-website tracking, and makes no session recordings or crash reports. Location is not derived from your IP address.

You can turn this off at any time in Settings → My Data → “Share anonymous usage data”. Deleting all your data also resets the random identifier. The Android app does not currently send usage statistics.

Catalog providers

Visto lets you choose a metadata catalog. TMDB and TheTVDB cover films and TV and use credentials you obtain under each provider's terms. TVmaze is available without a key for TV only. Provider access, accounts, and any provider charges are separate from Visto.

When you search or load title details, Visto sends the request to the catalog you selected. Visto does not send that provider your local watch history, ratings, reviews, watchlist, or iCloud data. Each provider handles requests under its own policy: TMDB, TheTVDB, or TVmaze.

This product uses the TMDB API but is not endorsed or certified by TMDB. TV data provided by TVmaze.

JSON export

Visto can create a JSON export of your archive locally on your device. The export leaves the app only when you explicitly choose to save or share it through your platform's sharing controls.

Shared links

Sharing a list or watch-history selection creates a link containing the selected data. Anyone with the complete link can read and forward that copy. The snapshot is decoded in the recipient's browser; the part after the # is not sent to the website server.

Included posters load directly from the permitted catalog image providers. Those providers receive an image request, including the recipient's IP address, but not the shared link as a referrer. The snapshot remains readable when images cannot load.

Website analytics

This site sends basic page-visit and click signals to Google Analytics without analytics cookies. Google receives browser/device information and the IP address used to send the request. If you allow analytics cookies, they measure returning visits for up to six months. Advertising, form contents, app records and account IDs are excluded. Choose Basic only to keep measurement without analytics cookies, or change your choice at any time in Privacy choices.

Shared-link pages do not load analytics. How Google uses website data.

Children's privacy

Visto does not knowingly collect personal data from anyone, including children. The anonymous usage statistics described above do not identify anyone.

Changes

If this policy changes, the effective date above will be updated. Material changes will be reflected on this page.

Contact

For privacy questions, contact support@visto.watch.