1. Controller

The controller for this processing is Giner Aaron, at the address above. The same controller operates Ginius Hub, which signs you in here, and the other apps it signs you in to.

2. Signing in

TicketWatch has no password of its own and never sees yours. You sign in at Ginius Hub, which sends this app a one-time code over the server's internal network and answers it with two things: your account number and the name you chose. Nothing else about you is passed, in either direction.

Those two are kept here in a row of this app's own, so that the films you are watching have something to belong to. The row is created the first time you open TicketWatch and not before — having an account at the Hub does not create anything here until you actually arrive.

3. What TicketWatch stores about you

• Your account here: your Ginius Hub account number, a copy of your name refreshed each time you sign in, when you first arrived and when you were last seen.
• Your watchlist: which films you are waiting for, at which cinemas, the date you asked not to be alerted before, whether alerts are on, and any note you added.
• Your search watches: the text you asked to be watched for, at which cinemas, and which of the two kinds of alert you asked for — tickets going on sale, a matching film appearing in the catalogue, or both. Alongside each one we keep the list of films it currently matches and, for each of those, whether tickets were on sale at the last check and whether you have already been told. The text you typed is stored as you typed it, because it is quoted back to you in the alert.
• The state of each entry: whether tickets were on sale at the last check, at how many cinemas, the earliest showtime found, when tickets first appeared, when the entry was last checked and when you were alerted about it.
• Your notifications: the alerts raised for you, their text, and whether you have read them.
• Devices you turned phone notifications on for: for each one, the address your browser's push service gave us, the two public keys that browser generated so we can encrypt to it, the browser's self-reported name, and when it was added and last sent to. See section 9.

The film catalogue itself — the chains, their cinemas, the films and which showtimes are on sale — is not about you. It is crawled once for everybody who uses this installation and looks identical to all of them.

Nothing is collected automatically: no location, no device sensors, no contacts, no analytics or tracking services, no advertising networks, no profiling and no automated decision-making.

4. Cookies

TicketWatch sets one cookie of its own, session. It holds your account number here and the moment it was issued, signed so it cannot be altered, and it lasts a year or until you sign out. A second cookie, auth_seen, exists for thirty seconds at the end of a sign-in and only so that a browser refusing cookies can be told so instead of being bounced back and forth. Both are sent over HTTPS only and neither is readable by scripts.

Ginius Hub sets its own cookie on its own address, described in its policy. Signing out ends the session everywhere: the Hub tells this app over the server's internal network, and the cookie above stops being accepted on every device you used it on, not only the one you signed out from. Your account name and its number are all that is ever sent between them.

Your device additionally remembers, locally, which tab you last had open and which provider you were looking at. Those values never leave your device. So that the installed app works offline, the browser also keeps a local cache of the program files — not of your content.

5. Third-party content: film posters

Film posters and cinema images are shown straight from the cinema chain's own image servers — cineplexx.at and burgkino.at — rather than copied onto this one. Your browser therefore connects to those servers when a poster is displayed, and your IP address and browser headers reach them as part of that request. They are not asked to set cookies, and no identifier of yours is passed to them — but the connection itself is real and cannot be hidden from them.

Everything else on the page comes from this server, the typefaces included. The chain's data — showtimes, availability, cinemas — is fetched by the server on its own schedule and never by your browser, so browsing TicketWatch does not tell any cinema chain which films you are watching.

6. Access logs and IP addresses

Every request is logged on the server, including the IP address of the device making it, the time, the address requested, the method and the response status. They exist for running the service, for finding faults and for fending off abuse. The legal basis is the legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). The logs are not joined with your account and expire with the usual system rotation.

7. Purposes and legal bases

Your watchlist, your search watches and the alerts raised from them are processed for one purpose: to tell you when tickets for a film you chose go on sale, and — if you asked for it — when a film matching text you chose turns up in the catalogue at all. That is the service you asked for, so the basis is performance of that arrangement (Art. 6(1)(b) GDPR). For log data, the legitimate interest set out in section 6 applies.

8. Notifications by e-mail

If the operator has configured an e-mail address or a webhook for this installation, alerts are also sent there. That address belongs to the operator rather than to individual accounts, so an alert raised for you — carrying your account name, the film, the cinemas, and the text of the search watch where it was one that raised the alert — is visible to them. In-app notifications are always written; these outbound channels are optional and are off unless configured.

9. Phone notifications

You can ask TicketWatch to notify you on a phone or computer even when the app is closed. It is off until you turn it on, per device, in the settings menu — turning it on here does not turn it on anywhere else, and your browser asks your permission before anything is stored.

When you turn it on, your browser creates a subscription at its own maker's push service — Google's for Chrome, Mozilla's for Firefox, Apple's for Safari — and gives us the address of it. Sending you a notification means handing that message to that service, which delivers it to your device. Unlike the posters in section 5, which your own browser fetches, this is something this server sends to a third party on your behalf — and those services are operated outside the EU.

What they can and cannot see is worth stating plainly. The content is encrypted before it leaves this server, to keys only your browser holds, so the push service carries the notification without being able to read the film, the cinema or your name. What it necessarily does learn is that this server sent a message to that device, and when. That is inherent to how the delivery works and cannot be avoided while the feature is on.

The legal basis is your consent (Art. 6(1)(a) GDPR), given by the browser's permission prompt and by the switch itself. You can withdraw it at any time by turning the switch off, which deletes that device's subscription here immediately; revoking the permission in your browser's own settings has the same effect, and we drop the subscription the first time the push service tells us it is gone.

10. Retention and deletion

Your data is kept for as long as your account exists. Deleting your account at Ginius Hub instructs this app to remove everything it holds for you — your account row here, your entire watchlist, your search watches and what they matched, every notification raised for you and every device subscription — and it is removed in full, immediately, with no recovery. Removing a single film from your watchlist deletes that entry and its cinema choices at once, and removing a search watch deletes it together with the record of the films it had matched. The crawled catalogue is not yours and is unaffected either way.

You can also ask for anything here to be removed at the address above.

11. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection under Arts. 15–21 GDPR, exercisable at the address above. You may also complain to a supervisory authority — in Austria, the Datenschutzbehörde.

12. Where it runs

TicketWatch runs on a single self-hosted machine in Austria, together with its PostgreSQL database. Nothing is stored with a hosting provider, an analytics service or a cloud platform. Two things do leave it, both described above: the poster requests your own browser makes to the cinema chain's image servers (section 5), and — only if you switch phone notifications on — the encrypted notifications handed to your browser maker's push service, which is operated outside the EU (section 9).