ScenePass — Privacy Policy

Last updated: August 25, 2026

ScenePass is an iOS application for watching short-form drama series, published by COVISO GmbH ("we", "us", "our"), a company established in Austria. We treat the privacy of the people who use ScenePass as a design constraint, not an afterthought: the App asks for as little data as it can and keeps what it needs on our own servers. This policy explains what we process, why we process it, who processes it with us, how long we keep it, and the rights you have. Please read it before using the App.

ScenePass requires no registration. There is no sign-up form, no password, and no social or third-party login, and we do not ask for your name, e-mail address, phone number, or date of birth in order to watch.

1. Scope

This policy applies to the ScenePass iOS application and to the servers that deliver its catalogue, hold your Coin balance, and record your unlocks and purchases. It is the policy referenced from the App's Profile tab and from its purchase screens.

It does not cover Apple's own processing of your Apple Account, your payment details, or your App Store purchase history, which Apple carries out as an independent controller under its own privacy policy. It also does not cover websites or services that are not operated by us.

2. Data we collect

We collect the following categories of data, all of which are linked to your ScenePass guest account:

• Guest account identifier (user ID). On first launch the App creates a guest account automatically, keyed to a device-scoped identity. This identifier — not your name or e-mail — is what ties your Coin balance, unlocked episodes, saved series, and viewing progress to you on our servers.
• Device identifier. An installation identifier provided by iOS, together with basic technical request metadata such as app version, iOS version, and device model. We use it to keep your guest account attached to this installation and to diagnose faults.
• Usage data (product interaction). In-app events such as which screens you open, which series and episodes you play, when an episode gate or the Coin Shop is shown, and which purchase or unlock steps you complete. These events describe your use of ScenePass itself.
• Purchase history. For each in-app purchase we record the product identifier, the App Store transaction identifier, the price and currency reported by the store, and the Coins granted. We never receive or store your card number, and we never see your Apple Account credentials — Apple processes the payment.
• Coarse location. An approximate region derived from the IP address of your connection (typically country level). We use it to operate the service — for example to serve media, to show store prices in the right currency context, and to detect abuse. The App does not request access to iOS location services and does not collect precise or GPS location.
• Marketing attribution token. If you arrived from one of our promotions, the App performs a single check on first launch for a ScenePass attribution token — a click identifier carried by the link you tapped or placed on the clipboard by that link. iOS displays a system paste notice if the clipboard is read. Anything that is not a ScenePass token is ignored and never stored, and the check is not repeated. The token lets the App open the advertised series directly and lets us measure whether a campaign worked.

We do not collect your contacts, photos, calendar, microphone or camera input, health data, precise location, or your activity in other companies' apps and websites. We do not request the iOS advertising identifier (IDFA) and we do not show third-party advertising inside the App.

3. How we use data

• Providing the service. Creating and maintaining your guest account, streaming episodes, keeping your place in a series, maintaining your Saved list and viewing reminders, and applying the Coin balance, episode prices, and unlocks that our servers record for you.
• Purchases and Coin grants. Verifying each transaction with Apple through our purchase infrastructure before Coins are credited, honouring subscription grants and daily refill claims, and restoring purchases when you ask us to.
• Improving the product. Understanding, in aggregate, which series and features are used and where people get stuck, so we can improve the catalogue, pricing presentation, and app performance.
• Security and abuse prevention. Detecting and preventing fraud, payment abuse, attempts to obtain locked content without unlocking it, and other activity that threatens the service or other users.
• Marketing measurement. Attributing an install and, where relevant, a subsequent purchase to the campaign that produced it, so that we do not pay for advertising that does not work.
• Support and legal compliance. Answering your requests, keeping the accounting and tax records the law requires of us, and responding to lawful requests from authorities.

Where the GDPR applies, we rely on the performance of our contract with you for operating the App and delivering purchases, on our legitimate interests for security, abuse prevention, product analytics, and campaign measurement, on your consent where we ask for it (for example for push notifications), and on our legal obligations for financial records.

4. Sharing and disclosure

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We disclose data only to the processors that run parts of the service for us, each of which receives only what its function requires:

• Apple — App Store distribution, payment processing, subscription management, and refunds. Apple provides us with transaction data and receipt validation results; we do not receive your payment credentials.
• Adapty — in-app purchase infrastructure, receipt verification, and paywall configuration, using your guest account identifier and transaction data.
• Amplitude — product analytics, receiving your guest account identifier, device identifier, in-app interaction events, purchase events, and the IP-derived coarse region.
• Our marketing attribution partner — when a purchase follows an attributed install, our server may send a conversion postback containing the click identifier, the purchase status, and the revenue amount and currency. These postbacks carry no device identifiers and no advertising identifier.
• Our hosting and content-delivery providers — operating the servers and delivering media, processing connection metadata and stored account records on our instructions.

We may also disclose data where we are legally required to do so — to comply with applicable law or a binding request from a court, regulator, or law-enforcement authority — or where it is necessary to establish, exercise, or defend legal claims, or to protect the rights and safety of users and the public. If our business or a part of it is reorganised or transferred, data may be transferred as part of that transaction, and this policy will continue to apply to it.

5. Security

We apply reasonable technical and organisational measures appropriate to the data we hold: encrypted transport (HTTPS) between the App and our servers, access to production systems restricted to the people who need it, server-side authority over Coin balances and unlocks so that a modified client cannot mint value, and independent server-side verification of every purchase. Media for a locked episode is not delivered to the App until our server authorises it.

No system can be guaranteed absolutely secure. If a breach affects your data and the law requires notification, we will notify you and the competent authority as required.

6. Your rights

Because our company is established in Austria, the GDPR applies to our processing. You can exercise the following rights at any time, free of charge in ordinary cases:

• Access — ask what data we hold about your guest account and receive a copy.
• Correction — have inaccurate data corrected.
• Deletion — ask us to delete your guest account and its records, subject to records we must retain by law.
• Restriction and objection — ask us to restrict processing, or object to processing based on our legitimate interests.
• Data portability — receive the data you provided in a structured, commonly used format.
• Withdrawal of consent — withdraw a consent you gave us at any time. Withdrawal does not affect processing that already took place lawfully before it.
• Complaint — lodge a complaint with a data protection supervisory authority, including the authority of your country of residence and the Austrian data protection authority (Datenschutzbehörde).

Because ScenePass has no login, we identify your account from information only you are likely to have — the device you used and the approximate dates of your install and purchases. Please include those details when you write to us, so that we do not act on the wrong account. We will never ask you for a password, because there is none.

7. Retention and deletion

We keep things for as long as they are needed, and no longer:

• Account and entitlement records (guest account identifier, Coin balance, unlocked episodes, Saved list, progress) are kept for as long as the guest account exists, so that your Coins and unlocks remain available to you. They are deleted when you ask us to delete the account.
• Purchase and payment records are kept for as long as the account exists and, after that, for the period we are required to retain accounting and tax documentation under Austrian law. These records survive an account deletion request for that reason.
• Analytics and diagnostic data are retained under the retention settings and policies of the processors named in section 4 and are deleted or de-identified in line with them.
• On-device data stays on your device until you remove it. In the App, Profile → "Clear local data…" wipes all local data including the guest identity; a fresh guest account is created on the next launch.

Clearing local data does not by itself erase the server-side records of the previous account. To have those deleted, contact us at the address in section 12.

8. International transfers

Our servers are operated in the European Union / European Economic Area. Some of the processors named in section 4 are established outside the EEA or process data there. Where data leaves the EEA, we rely on an appropriate transfer safeguard — an adequacy decision of the European Commission, or the European Commission's standard contractual clauses together with supplementary measures where needed. You can ask us which safeguard applies to a specific processor.

9. Children

ScenePass is not directed at children under 13, and we do not knowingly collect data from them. The App is rated for teenage and adult audiences on the App Store. If you are below the age of majority in your country, you may use ScenePass and make purchases only with the consent and supervision of a parent or legal guardian, who is responsible for purchases made on their device. If we learn that we hold data from a child under 13, we delete it promptly; a parent or guardian can contact us using section 12 to request this.

10. Changes to this policy

We may update this policy as the App changes or the law requires. The current version is always published on this page with the "Last updated" date at the top, and the App links to it. Where a change is material, we will give notice in the App before it takes effect. Continuing to use ScenePass after a change takes effect means the updated policy applies to you.

11. Auto-renewable subscriptions

ScenePass offers auto-renewable weekly subscriptions and one-time Coin packs, purchased only through Apple In-App Purchase:

• Price. The title, duration, Coin grant, and price of every product are shown in the App, in your local currency as reported by the App Store, before you confirm a purchase.
• Payment. Payment is charged to your Apple Account when you confirm the purchase.
• Renewal. A subscription renews automatically for a further week unless it is cancelled at least 24 hours before the end of the current period. Your Apple Account is charged for the renewal within 24 hours before the current period ends.
• Introductory pricing. Where an introductory price is offered, it applies to the first week only; renewals are charged at the standard weekly price shown in the App.
• Cancellation. You can manage or cancel a subscription in your App Store account settings on your device (Settings → your Apple Account → Subscriptions). Cancelling stops future renewals; the period you already paid for runs to its end.
• Data involved. For subscriptions we process the same purchase data described in section 2 — product identifier, transaction identifier, price, currency, and the Coins granted, linked to your guest account.

Refunds for App Store purchases are handled by Apple. See the Terms of Use for the full purchase, refund, and Coin terms.

12. Contact

For any question about this policy, or to exercise a right under section 6, write to us. If you contact us by e-mail, we use your message and address only to handle your request.

Data controller: COVISO GmbH
Pertholzer Strasse 56, 2821 Ofenbach, Lower Austria, Austria
Phone: +43 676 115 60 46
E-mail: lchristoph@covisosoft.com
Support: legal.scenepassapp.com/support