Privacy Policy

What we collect

• Account basics — when you sign in with Google we receive your name, email address and profile picture. You may also choose a username, and we generate a friend code so people can add you.
• What you track — the titles you follow, which list they're in, your episode progress, your ratings, your private notes and any review you choose to publish, the watch links you save, your watch history, your custom lists, and your settings: notification preferences, calendar filters, home layout, theme and language.
• Where you left off — if you use the extension, the play position of an episode is backed up so another device can resume it. It is stored against the saved link, identified by a one-way hash of the page address, never the address itself.
• Social — your friends and pending requests, titles and lists you send or share, and anyone you block.
• Device — a push token so notifications can reach you, plus the device name, platform and app version shown to you in the sessions list, and whether the account was created and last used on the web or in the app.
• Sign-in failure reports — if signing in fails, the app offers to send a report: the device model, OS, app version and the technical error. It is not attached to an account — it carries an eight-character code you can quote to us, and nothing that identifies you.
• Moderation records — reports you file and reports about you, with a copy of the reported content taken at the time, and, if an account is suspended, when and why (an internal note the reader is not shown).
• Purchases — whether your account has Plus or Ad-free and when it expires, from Google Play via RevenueCat. We never see your card, your address or your billing details.
• Technical data — ordinary web-server request logs, including your IP address, kept to run and secure the service.

How we use it, and on what basis

• To sign you in, keep your lists on every device, and let the app work offline — because that is the service you asked us to provide (performance of a contract).
• To send the notifications you turned on, and only those.
• To build recommendations from what you follow.
• To run the social features you use: showing you to your friends, delivering what you share.
• To keep the service working, to investigate abuse, and to act on reports — our legitimate interest in a service that isn't hostile to the people using it.
• To show ads to free accounts, and to ask for your consent first where the law requires it.
• To meet legal obligations, such as keeping the records tax law requires.

We do not sell your personal data, we do not use your lists or your viewing to target advertising, and we do not profile you for anyone else.

What other people see

Most of WhatsNext is private to you. These are the parts that are not, so there are no surprises:

• A review you mark public appears on that title's page with your name — to anyone using the app, not only your friends. Unpublish it and it goes back to being private.
• Your friends see your name, username and profile picture, and an activity feed of the titles you add.
• A friend code lets someone add you. Give it out as freely, or as carefully, as you like — you can see and change yours in the app.
• A list you share is visible to the people you shared it with, and a co-editor's changes are visible to everyone else on it.
• Your calendar link, if you create one, is a long unguessable address that works without signing in. Anyone you give it to can see your upcoming episodes. You can revoke it at any time.
• Blocking someone hides each of you from the other, everywhere.

The browser extension

The extension is optional, and separate from the apps. To notice that a video is playing it runs on any page you open, including inside embedded players — that is what the browser warns you about when you install it. What that code does is watch for a video element and read the page title.

What actually leaves your browser is much narrower: only when a page matches a title you already follow do we receive the episode you reached, the saved link, and the play position keyed by the hashed address above. Pages that don't match a followed title are never reported anywhere — no browsing history is collected, sent or stored, by us or by anyone else. The extension talks only to our own API, and you can unpair it from the app at any time, which revokes its access at once.

Who else is involved

A short list of providers, each used for one job:

• Google — sign-in.
• Firebase Cloud Messaging (Google) — delivering push notifications to your device.
• Content providers (TVmaze, AniList, Trakt, JustWatch) — titles, artwork, air dates and where to watch. They receive your search terms and title identifiers, never your account.
• MyMemory — translating a title's description into your language when we don't have one. It receives the description text and the language pair; nothing about you.
• Trakt and MyAnimeList — only if you choose to import your library from them. You authorise it yourself, we read what you approved, and nothing is sent back to them.
• Google AdMob (Android and TV) and Google AdSense (this website) — the ads shown to free accounts. See Advertising.
• Google Play and RevenueCat — taking and verifying payment for a subscription.
• Our hosting provider — the servers this all runs on, located in Türkiye.

We may also disclose data where the law requires it, or where it is genuinely necessary to protect someone's safety.

And if WhatsNext is ever passed to another operator — handed on, or merged into something else — the data described here would move with it, under this same policy, and we'd tell you in the app before that happened.

Advertising

Free accounts see ads. In the Android and TV apps they are served by Google AdMob; in the web app, by Google AdSense. Either way the ad network receives device-level information — in the apps your advertising identifier, in the browser cookies or similar storage set by Google — along with approximate location derived from your IP address and how the ad performed. Neither receives your WhatsNext account, your lists or what you watch.

Where the law requires consent (the EEA, the UK and Switzerland), we ask before any ad request, using Google's own consent form. You can change or withdraw that choice at any time. In the apps you can reset or delete your advertising identifier in your device settings; in a browser you can clear or block these cookies in the browser's settings, and Google's own controls are at My Ad Center and Ads Settings. A WhatsNext Plus or Ad-free purchase removes ads entirely — on a paid account the browser never loads the ad script at all.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising at Google's Ads Settings, or opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info.

Affiliate links

Some of the provider links under "Available on" are affiliate links: if you subscribe, rent or buy after following one, we may earn a commission at no extra cost to you. Links that earn a commission are labelled as such in the app, next to the link.

Which providers appear, and in what order, comes from the content providers' own data — never from what pays us. The links you save yourself under "Watching on" are never modified. Following an affiliate link tells the programme that a click came from WhatsNext; it does not tell them who you are, and we receive only aggregate reports, never a list of who clicked or what they bought.

Cookies and local storage

WhatsNext uses as little of this as it can. Signing in on the web keeps a token in your browser's local storage so you stay signed in between visits, and the app keeps its own copy of your data on your device so it works offline; neither is a tracking cookie, and the site sets no analytics cookies of its own. Cookies do get set in one place — advertising: on a free web account Google AdSense may set them as described under Advertising, and a Plus or Ad-free account never loads that script, so they are never set at all. You can clear or block cookies and site storage in your browser's settings; blocking the sign-in storage will simply sign you out.

Storage, security and where it lives

Your data sits on our server in Türkiye and travels over HTTPS. The app keeps its own copy on your device so it works with no connection at all. Access to the server is limited to the developer and to the moderators of the management panel, whose actions are recorded.

Some of the providers above — Google among them — process data outside Türkiye and the EEA, under their own safeguards for international transfers. We take reasonable measures to protect what we hold, but no system can be promised perfectly secure.

How long we keep it

• Your account and everything in it — for as long as the account exists.
• Request logs — up to 90 days, then deleted.
• Sign-in failure reports — kept while the problem is open; they hold no account data either way.
• Moderation records — kept after a case is closed, because a report that vanishes when the content does is no use to the next moderator.
• Purchase records — held by Google Play, not by us; tax law requires transaction records be retained.

You can delete your account at any time from Settings → Account → Delete account, which removes it and your data from our servers. If you no longer have the app installed, Delete your account explains how to ask us and sets out exactly what goes and what stays. Deleting your account does not cancel a subscription — cancel that in the Play Store first.

Children

WhatsNext isn't for children under 13, or under the minimum age where you live if that is higher, and we don't knowingly collect their data. If you believe a child has an account, write to us and we'll remove it.

Your rights

Most of what you'd want to do, you can do yourself: see and edit everything in the app, export your library to a file, unpublish a review, revoke a device or the extension, or delete the account outright.

Depending on where you live — under the GDPR in the EEA, the KVKK in Türkiye, or comparable laws elsewhere — you also have the right to ask for a copy of your data, to correct it, to have it erased, to restrict or object to processing, to withdraw a consent you gave, and to complain to your data protection authority. Write to support@thenextus.com.tr and we'll answer within 30 days. There is no charge, and asking costs you nothing else.

Changes

If this policy changes, the date at the top changes with it, and for anything material we'll say so in the app before it takes effect.

Contact

Questions about your privacy, or a request about your data? Email support@thenextus.com.tr.