Howlert Privacy Notice

Effective 30 August 2026 · Data controller/operator: Igor Gerin

This notice describes the controlled Howlert MVP at howlert.com and in the Android application. Howlert helps registered users track movie and series releases. It does not sell personal data and does not use advertising or analytics SDKs.

Data we process

• Account identity and security data: email address, password hash when password sign-in is used, verification/reset state, sessions, security timestamps, chosen locale and timezone. If you choose Sign in with Google, Howlert receives and stores the verified email address and stable Google account identifier needed to authenticate and link the account. Google may also make basic name and profile-picture claims available transiently during credential verification; Howlert does not use or store them. Howlert does not request access to Gmail, Drive, Contacts, Calendar or other Google account content.
• Product data you create: Subscriptions and filters, WatchProgress, notification preferences/history/read state, and configured notification destinations.
• Push/optional channels: an installation-specific FCM token; Telegram chat binding or account email only when you explicitly configure those channels. Provider credentials are not stored in the app.
• Imports: a public Kinopoisk profile reference, selected categories, normalized import records, conservative matching/review choices, ImportSession and optional daily-sync status. Howlert never asks for Kinopoisk/Yandex credentials or cookies and does not invent episode progress from media-level evidence.
• Support: Submission text, public Moderator replies, status and necessary account references. Moderator internal notes are private from users.
• Operations/security: bounded server and provider outcome logs, request IDs, failure codes and timestamps needed to secure, diagnose, back up and operate the service. Logs are designed not to contain passwords, provider credentials, raw FCM tokens, private ReleaseLinks or raw fetched pages.

Why and how data is used

Data is used to authenticate you; present catalogue and account state; match your subscriptions to observed releases; suppress watched notifications when configured; deliver in-app and explicitly enabled external notifications; import/synchronize the public profile categories you selected; answer support requests; prevent abuse; recover failures; and maintain secure backups.

External processors and public sources

Google Identity Services authenticates a Google account only when you choose that sign-in method; Howlert validates the signed Google credential and then issues its own session. Cloudflare Turnstile processes limited browser and network signals during Web registration to distinguish people from automated abuse; Howlert receives the short-lived verification result and uses it only for account security. Firebase Cloud Messaging delivers Android push when enabled. Telegram and configured SMTP infrastructure deliver those optional channels. Generic page/browser execution is performed by the separate Generic Fetch service; Howlert chooses public URLs/instructions and owns validation, parsing and normalized records. Kinopoisk public-profile pages are accessed only when you request import/sync. Howlert's catalogue was initially seeded from a one-time TMDB-derived export and release discovery currently uses configured public Sources including Rezka and KinoGo. Howlert is not affiliated with these services and does not expose source player/stream data.

Sharing and retention

Personal data is shared only with infrastructure/provider systems required for the selected function. It is not sold. Active personal state is retained while your account is active and as needed for the feature. Bounded operational logs and encrypted backups follow the operator's retention procedures. Shared canonical catalogue, Source, SourceUpdate, Release and ReleaseLink records are service data rather than a copy of your private account state.

Account deletion and restoration

An identity-confirmed deletion request (using the current password or linked Google account, as applicable) immediately disables normal access, revokes sessions, stops notifications and user-owned import/sync/background work, and starts a 90-day recovery window. During that period you may explicitly restore the account after identity verification; settings you had independently disabled are not silently re-enabled. After the deadline, Howlert permanently purges personal account, external identity link, destination, notification, Subscription, WatchProgress, import/sync and private support state. Shared canonical catalogue/source/release data is preserved.

Your choices

You can edit Subscriptions and destinations, disable Kinopoisk sync, log out, request deletion/restoration, and contact the operator through the authenticated support flow. Do not place secrets in support messages.

Contact and changes

Use Howlert Support. No public support mailbox is claimed until one is verified. Material notice changes will update the effective date and be presented through an appropriate controlled-release channel.