Privacy Policy

1. Overview

Oluma ("we", "us", "our") is a film discovery and AI recommendation platform. This policy explains what information we collect, how we use it, and your rights regarding that information. By using Oluma you agree to the practices described here.

2. Information We Collect

We collect information you provide directly:

• Account information — username and password (hashed) when you register.
• Watchlist & history — films you save or mark as watched.
• Gameplay data — challenge answers, scores, and streaks.
• AI chat messages — queries you send to the Ask AI feature.

We also collect limited technical data automatically:

• Browser type, device type, and general location (country/region).
• Pages visited and features used, for improving the product.

3. How We Use Your Information

• To provide and personalise the Oluma experience (recommendations, watchlist sync).
• To operate the gamification system (XP, streaks, leaderboards).
• To process your AI queries and return relevant results.
• To improve our service through aggregate, anonymised usage analytics.
• To communicate service-related updates (no marketing without consent).

4. Third-Party Services

Oluma integrates with the following third-party services. Each has its own privacy policy:

• OpenAI — powers the Ask AI chat feature. Queries are sent to OpenAI's API; their data retention policies apply.
• Tavily — used for real-time film news searches within the AI feature.

5. Data Retention

Account data is retained for as long as your account is active. Watchlist and history data is deleted within 30 days of account deletion. AI chat messages are not permanently stored — they are used only to generate the response and then discarded.

6. Cookies & Local Storage

Oluma uses browser local storage to persist your session token, sidebar preference, and watchlist state. No third-party tracking cookies are set. We do not use advertising networks or sell data to any third party.

7. Your Rights

Depending on your jurisdiction (including UK/EU GDPR), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Object to or restrict certain processing activities.

To exercise any of these rights, delete your account from the Profile page or contact us directly.

8. Security

Passwords are stored as bcrypt hashes. All data is transmitted over HTTPS. We take reasonable technical precautions to protect your information, but no system is completely secure.

9. Children

Oluma is not directed at children under 13. We do not knowingly collect data from anyone under 13.

10. Changes to This Policy

We may update this policy from time to time. Significant changes will be indicated by the "last updated" date at the top of this page.