Your nights stay yours.Your nights stay yours.

1.1Who’s responsible.

Stub is made by Analogue Industries Limited, in Aotearoa New Zealand (we, us). We’re responsible for the personal information Stub holds. This policy covers the Stub app for iPhone, its account and server, and keepthestub.app.

1.2The law we follow.

We handle personal information under New Zealand’s Privacy Act 2020 and its information privacy principles, wherever you live.

1.3Two words.

A Visit is what your account holds about one time you went to the cinema. A count is a figure made from the Visits of at least 10 people, never one person’s. The terms define both the same way.

1.4Only what’s needed.

Stub collects only what a feature below needs, and this page says what each piece is for and how long it’s kept.

2.1The four nevers.

Stub never sells you, never shows you an ad in the app, never charges you to keep a ticket, and never uses what you keep, or anything else about you alone, to train AI models, or gives, sells or licenses it to anyone who would. The terms make these binding, on us and on anyone who ever owns Stub.

2.2Reading isn’t training.

Apple’s Vision and Apple Intelligence read your ticket on the phone, to fill in the stub. We never use what you keep to build, train or improve a model.

2.3If Stub is sold.

A buyer must first agree in writing to keep these promises, or every account is deleted before the sale completes. You’re told in the app at least 60 days before, with the buyer’s name (terms, clause 15).

3.1Your drawer.

Stubs, photographs, editions and signatures stay on your iPhone and in the iCloud it’s signed in to, however you sign in to Stub. Only you can open it. We can’t. Without iCloud, they stay on the iPhone.

3.2The reader.

Your ticket is read on the phone, by Apple’s Vision and, where the phone has it, Apple Intelligence. The photograph goes nowhere, unless you send us a ticket Stub got wrong.

3.3Your list.

Films you pencil stay on your phone and in your iCloud; only the scrambled tokens below leave it. A Letterboxd watchlist you bring in is read on the phone; nothing else in the file is read, and none of it is sent.

3.4Matching with friends.

When you and a friend on Stub both pencil a film, you’re both told. Your phone and theirs each work out a secret only the two of you share, and send Stub a scrambled token for each film, made with that secret. Stub sees two tokens that are the same, never which film, and nobody but that friend is told. Films pencilled more than six weeks ago aren’t sent. Turn it off on Your list, and your tokens are gone from Stub’s server.

3.5Your calendar.

Only if you turn it on: a film you book in Stub is put in it, and one you booked elsewhere is found there, to offer the ticket when the film ends. It’s read and written on the phone. Nothing is sent.

3.6Where you are.

Only if you allow it, when you first plan a night, to find the cinemas near you. Stub never keeps it. In New Zealand and Australia it’s read on the phone and never sent. Anywhere else, Apple Maps finds the cinemas near you on the phone; in the United States, Stub asks for the square of about 25 km you’re in, with nothing that names you. Without it, the phone’s time zone says which cinemas are yours, and a town you choose stays on the phone.

4.1The film book.

The same file for every phone, downloaded whole, at most twice a day. Nothing is sent with it, so no film of yours leaves the phone.

4.2What’s on.

The coming month’s films and sessions at the cinemas in your region, one file for every phone there, downloaded whole. Nothing you plan is sent with it: all it says is which region’s file it wants.

4.3Booking tickets.

Book tickets opens the cinema’s own page inside Stub. What you do there is between you and the cinema: Stub runs nothing in the page and never reads what you type. When the cinema shows its confirmation, a page that says it is one or the page its site shows when you come back from paying, Stub reads that page alone, on your phone, for your seats and booking number. The page where you type your card is never read. Your seats go on the plan; the number stays on the phone.

4.4Stub’s button in Safari.

When you tap Stub in Safari’s toolbar or share sheet, Safari hands Stub that page’s address, title and words, on your phone, and Stub reads them for a booking. Only the page you tap it on, only when you do.

4.5A cinema’s poster.

When a cinema’s Add to Stub link names one, it’s fetched once, from the cinema, as you keep the stub.

4.6Add to Stub links.

The ticket rides after the # in the address, the part a browser never sends to a server.

5.1Signing in.

Stub asks you to sign in with Apple, Google or your email when it first opens. If our server can’t be reached, Stub opens anyway and asks the next time.

5.2Who you are.

A random account number, the identifier Apple or Google gives you in Stub, the name on your card, and a key that seals the links you send. Stub never sees a password. Kept until you delete the account.

5.3Your email.

Signing in with your email, we send a six-figure code to it and keep the code ten minutes. Your account keeps the address you signed in with (if you hid yours from Apple, the private address Apple gives us), or one you add, in the first run or on Your card › Email notifications, with a code sent to it, so we can write to you about your account. Kept until you delete the account.

5.4News.

A new account gets news from Stub by email now and then, as the sign-in says: what’s on at the cinema, what’s new in Stub, and offers. We keep your address, the words the sign-in said, the day, and which of the three you want. Turn each off on Your card › Email notifications, or all of it with the link in any news, and no more is sent. An account made before 26 October 2026 gets news only if it said yes. An offer may be paid for by the cinema or business it’s from, and says it’s an offer; it never gets your address. Never sold or shared.

5.5Your friends.

Your two account numbers and the day you met, made when one of you keeps the other’s half or says “I’m in”. Kept until either of you takes the other off.

5.6On their way.

A half, a plan or a reply: the film, the cinema, when, from whom and to whom. Kept until their phone takes it, or 30 days.

5.7A plan with friends.

The night as whoever made it last said it (the film, cinema, time, room, poster and booking page), each answer (in, can’t make it, or another night), who’s booking, and the seats each of you booked, so the others can book next to you. Anyone with the plan’s link sees the night; only those on it see the rest. Gone when the film’s over.

5.8Drawers kept together.

Who’s in a drawer, and its name. A Visit filed in it goes to the others as its film, cinema, time, room and viewing, never its seat, price, booking reference or photograph, and each phone keeps it in its own iCloud.

5.9Your Visits.

For each ticket you keep while signed in: the film, the cinema, the session’s time, the format, which viewing it was, the price and whether Stub read it or you wrote it, how many seats and how many were there, which of your friends were there, and the festival or plan when there was one. Never its photograph, its seat, its booking reference, or the names you write for people who aren’t on Stub. They’re kept under a random number of their own, apart from your name and email, so they can come with you and be counted. Throw a stub away and it goes from your account too. Kept until you throw it away or delete the account.

5.10Friends you say were there.

When you say a friend on Stub was there, we learn it from you, not from them. This policy covers every account, so every friend can read here what that keeps: that they were there, on your Visit.

5.11A seat in the first run.

If you open Stub from TestFlight during its first run, Apple’s signed word that your copy came from TestFlight goes to our server, which checks it and gives your account the next seat: its number and when. We keep the seat, never Apple’s word. How many seats are taken, and how many today, is on keepthestub.app/beta, with nobody in it. Kept until you delete the account.

5.12What you send us.

Send it to us, under a ticket Stub turned away or misread, sends the photograph, what Stub read and what it made of it, or only the ticket’s layout. Send logs, on Your card, sends Stub’s version, the iPhone’s model and iOS, and what Stub noted since it opened, with anything you write. Never your stubs, photographs or email, and neither says who sent it. Kept until we’ve fixed it, or 180 days.

5.13On the workshop table.

What you write on keepthestub.app/workshop, ideas and notes, is public, under the name on your card and the day. How many want an idea is shown, never who. Signing in there takes your email and its code, and that browser keeps the sign-in until you sign out. Take down what you wrote any time. Kept until you take it down or delete the account.

5.14Your phones.

Each phone’s notification token, so a Visit arriving can say so, and a scrambled copy of its sign-in. Kept until that phone signs out, or turns off From friends in Your card › Push notifications.

5.15How Stub is doing.

We count how Stub is used from what your account already keeps: how many accounts, how many keep a ticket each week, how many go with friends, how many close. A week’s numbers are kept as they were once it’s over. Numbers only, never who.

5.16How you use the app.

Each time you use Stub, a note of it is sent the next time you open it: the day and hour, how long, how you opened it, the screens in order, and what you did, such as keeping a ticket or sharing a card. Nothing that says who: no account, no phone’s id. We keep only counts made from it, for 400 days.

6.1Only for these.

We use what we hold only:

1. to run Stub for you, and to deliver what you send to other people;
2. to write to you about your account, and to send the news you haven’t turned off;
3. to make counts;
4. to share your own Visits with a cinema you link, once Stub offers it, until you unlink it;
5. to keep Stub, and the people who use it, safe, and to find and fix faults; and
6. to comply with the law.

6.2Nothing else without asking.

We won’t use it for any other purpose without asking you first, and never to sell you, show you an ad in the app or train AI.

7.1Apple.

Sign in with Apple, iCloud, notifications and the App Store are Apple’s, under Apple’s own privacy policy.

7.2Google.

Only if you sign in with Google: Google’s own page asks, under Google’s privacy policy, and tells us who you are and your address. Nothing else of your Google account.

7.3Resend.

It sends the sign-in code to your email for us, and keeps a record of the message for a short time. Nothing else.

7.4Our server.

It runs on Vercel, with its store at Upstash and a copy of the numbers at Neon, all in Sydney, Australia. They hold it for us and use it for nothing else.

7.5Our email.

What you write to support@keepthestub.app is held in our mail, which Google hosts for us. We use it only to answer you.

7.6Who may buy counts.

Cinemas, film distributors, and other businesses and organisations in the film industry or beyond it may buy counts made from everyone’s Visits: how many came with someone, how often, from which plans, what a night costs. Never a count of fewer than 10 people, never who, never one person’s Visits. No one who receives counts can reach the Visits they’re made from, and we design each release so counts can’t be combined or subtracted to find fewer than 10 people. Each buyer first signs a licence: never to try to identify anyone, never to use counts in generative AI or in any model that profiles, targets or predicts a person, never to sell or pass the counts themselves on (they may show figures from them in their own products), and to delete them when it ends. They may use counts in their own reports and forecasts. Break it, and their access ends, they delete every count, and we say so here.

7.7Everyone on Stub.

Seen on Stub shows how many people kept a ticket to a film this week, by country, from everyone’s Visits. Only from 10 people up, never who, and a stub you throw away or an account you close is out of it within a day.

7.8A cinema you link.

Only if you link one yourself, once Stub offers it: your own Visits at that cinema, until you unlink it. The friends you went with reach it as a number, unless they’ve linked it too. It may use them only for your membership there and the messages you said yes to. The cinema pays Stub one yearly fee to offer linking, the same however many people link: nothing is paid for you.

7.9When the law requires it.

We give what we hold to a court, the police or another authority only when the law requires it, or to prevent a serious threat to someone’s life or health, and only what’s needed.

7.10Nobody else.

No advertising in the app, no tracking, no data brokers. Nothing that names you is sold or shared.

8.1In Sydney.

What your account keeps is held on our server in Sydney, Australia (clause 7.4). Apple, Google and Resend may handle what they process for us outside New Zealand.

8.2Kept apart, and sealed.

Everything between Stub and our server travels encrypted. Your Visits are kept under a number of their own, apart from your name and email, and each phone’s sign-in only as a scrambled copy. Stub never sees a password.

8.3The copies.

The copy of the numbers at Neon, and the backup we keep each week, hold only counts, never anything that says who. Deleting an account leaves nothing of it in them.

8.4If something goes wrong.

If what we hold is ever exposed in a way that could seriously harm you, we tell you, and New Zealand’s Privacy Commissioner, as soon as we can.

9.1Delete it.

Your card › Account › Delete account. Everything above goes at once, your Visits, what you sent us and your news with it, and Stub’s sign-in is revoked at Apple. Your drawer stays as it is. What stays is a count: an account closed, about how long it was open and how many Visits it kept, and why, if you say. Never who. Words you write there are kept a year, apart from the count.

9.2See it, and correct it.

Wherever you live, you can ask to see what we hold about you, and to have it corrected. Write to us, and we answer within 20 working days, as New Zealand’s Privacy Act requires.

9.3Take it with you.

Your stubs, as a spreadsheet, at Your card › Advanced › Export as a spreadsheet, and the films you’ve pencilled at Your card › Advanced › Export your list.

9.4Only what you send.

A ticket Stub read wrong reaches us only when you tap Send it to us, and logs only when you tap Send logs; each says what goes before it goes. The phone’s crash reports reach us only if you share them with app developers in Settings.

9.5Complaints.

Write to us first. If we get it wrong, you can complain to New Zealand’s Privacy Commissioner.

9.6Your age.

Stub is for people 16 and older. If we learn an account belongs to someone younger, we close it and delete what it holds.

9.7The terms.

What using Stub agrees to is on the terms page.

10.1Dated, every time.

This policy was last changed on 3 November 2026. If what Stub keeps changes, this page changes first, with the date. A change in how we use what we already hold applies to it only if you say yes.