Privacy Policy

Last updated: July 19, 2026

Effective date: July 19, 2026

Originally published June 6, 2026; major revision July 10, 2026.

1. Overview

This Privacy Policy describes how Hey Oscar Inc. ("Oscar", "we", "our") collects, uses, discloses, and protects your personal information when you use the Oscar mobile application or its web version available at heyoscar.ca (collectively, the "Application"), and when you visit our website heyoscar.ca (the "Site").

The Site uses fonts hosted by Google (Google Fonts) and is hosted by Vercel: when you visit, these providers process technical data strictly necessary to serve the pages (IP address, browser type). The Site does not use any advertising cookies or marketing trackers.

Oscar is a mood-based film and television series recommendation companion, primarily intended for audiences in Quebec and Canada. We are committed to protecting your privacy in accordance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

By using the Application, you consent to the practices described in this policy.

2. Privacy Officer

In accordance with Law 25, we have designated a person responsible for the protection of personal information within our organization:

• Title: Privacy Officer, Hey Oscar Inc.
• Email: info@heyoscar.ca
• Mailing address: Montreal, Quebec, Canada

You may contact this person for any questions, access requests, correction requests, or complaints regarding your personal information.

3. Information We Collect

3.1 Information You Provide

Account information

• email address;
• display name;
• authentication identifier (including via Apple or Google);
• profile photo (optional).

Personalization information

• preferred genres;
• selected or favourite films and series;
• onboarding questionnaire responses;
• emotional and mood preferences;
• viewing platforms used;
• personal list ("My List");
• liked or disliked films or series;
• recommendation history.

Contextual information

• declared mood;
• available time;
• session-specific temporary preferences.

Content you generate

• messages exchanged with Oscar Chat;
• open-ended responses, notes, or comments voluntarily submitted.

3.2 Automatically Collected Information

• Usage data: in-app interactions, recommendations viewed, features used, language. PostHog is used to measure Application usage (event statistics linked to a technical identifier).
• Technical data: device type, operating system, technical identifiers, diagnostic data and crash reports. Sentry is used for crash reporting and diagnostics.
• Advertising identifiers: for non-subscribed accounts only, the device's advertising identifier may be used to serve advertising (see section 13).

3.3 Information from Third Parties

• When you sign in via Apple or Google, we receive the basic information authorized by those services (identifier, email address).

We do not collect precise location data, contacts, photos, or microphone access unless explicitly indicated in the Application.

4. Purposes of Collection

We use your personal information for the following purposes:

• Creating and managing your account;
• Personalizing your film and series recommendations based on your mood and preferences;
• Maintaining your personal list and Application state;
• Operating social and community features (see section 9);
• Serving advertising to non-subscribed accounts (see section 13);
• Improving and debugging the Application;
• Ensuring security and preventing fraud;
• Communicating with you about the service;
• Fulfilling our legal obligations.

We collect only the information necessary for these purposes. We send promotional emails only with your consent, and every message includes an unsubscribe mechanism, in accordance with Canada's Anti-Spam Legislation (CASL) and, for recipients in the United States, the CAN-SPAM Act: clear sender identity, a non-deceptive subject line, our postal address, and opt-outs honoured within 10 business days.

5. Basis of Consent

We collect and use your personal information based on your consent, which you grant by creating an account and using the Application. You may withdraw your consent at any time (see section 10), which may limit your access to certain features.

6. Disclosure to Third Parties and Service Providers

We do not sell your personal information. We do, however, engage third-party service providers who act as subcontractors on our behalf:

Each provider has access only to the information necessary to perform its task and is bound by confidentiality and security obligations.

Subscription purchases (Oscar+) are processed by the Apple App Store or Google Play. We do not receive your full payment information (card number, etc.); this data is managed directly by the relevant platform.

7. Transfer of Information Outside Quebec

Some of our providers (notably Supabase, TMDB, OMDB, Trakt, JustWatch, Google, Anthropic, Sentry, and PostHog) host or process data outside Quebec, primarily in the United States.

In accordance with Law 25, before transferring your information outside Quebec, we conduct a privacy impact assessment to ensure that your information receives adequate protection. By using the Application, you acknowledge that your information may be processed abroad and may be subject to local laws.

8. Automated Processing, Recommendations, and Oscar Chat

Oscar uses an internally developed recommendation and ranking algorithm. This algorithm matches your responses (mood, genres, preferences, selected films) with keywords and combines them with metadata and ratings from third-party sources (section 15) to suggest relevant films and series. The recommendations themselves do not use any third-party artificial intelligence service and do not analyze any data beyond what you provide in the Application.

The Oscar Chat feature (conversational companion) uses the Claude artificial intelligence model, provided by Anthropic. Messages you exchange with Oscar Chat are transmitted to Anthropic (United States) to generate responses. Under Anthropic's commercial terms, these messages are not used by Anthropic to train its models. Your messages may be retained by Oscar to support the operation and improvement of the feature, and may enrich your preference profile (for example, a genre or actor you mention). Oscar Chat is optional: a notice reminds you of how it works the first time you use it, and you can use the Application without ever using it. Avoid sharing sensitive information in it.

These recommendations are provided for entertainment purposes and do not result in any decision producing a legal effect or significantly affecting you. You may request information about the data used to generate a recommendation by contacting our Privacy Officer (section 2).

9. Information Visible to Other Users

Some Oscar features are social. Here is what other users can see:

• Community feed: the activity you post there (rated films, reactions, comments), your display name, and your cinema profile type are visible to other users of the Application.
• Detailed profile and followers: your detailed profile includes your recent viewing history (films watched and the ratings you gave them, series in progress) as well as statistics about your tastes. It can be set to "public" or "followers only" in the settings. By accepting a follow request, you give that person access to this detailed profile; you can withdraw that access at any time by removing the follower or changing your visibility setting. Posts you make in the community feed remain visible to everyone, regardless of this setting.
• Couple, Family, and Group modes: when you join a shared session, other members see your display name, your compatibility scores with the suggested films, and certain aggregate statistics about your tastes. Your detailed answers and your date of birth are never shared.
• Oscar Score and friend leaderboards: if you use these features, your compatibility score and progress may be shown to the friends involved.

Child profiles do not participate in the community feed and are not visible to other users. We recommend not posting sensitive personal information (yours or anyone else's) in the social areas of the Application.

10. Your Rights

In accordance with Law 25 and PIPEDA, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate, incomplete, or ambiguous information;
• Withdraw your consent to the processing of your information;
• Request deletion of your account and your information;
• Obtain your information in a structured, commonly used technological format (portability);
• File a complaint with the Commission d'accès à l'information du Québec (CAI).

To exercise these rights, contact our Privacy Officer (section 2). We will respond within the timeframes required by law (generally 30 days).

11. Retention of Information

We retain your personal information for as long as your account is active or as necessary for the purposes described. You may delete your account at any time, directly within the Application: destruction of the associated personal information begins immediately and is completed within 30 days at the latest. When information is no longer needed, we destroy or anonymize it securely (for example, group session answers are deleted within 24 hours after the session ends). After a prolonged period of inactivity, we may also delete or anonymize an account, after sending notice to the associated email address.

12. Security

We implement reasonable security measures — technical, physical, and administrative — to protect your information, including encryption in transit, secure authentication, and restricted access. No system is infallible; we cannot guarantee absolute security.

In the event of a privacy incident presenting a risk of serious harm, we will notify you and the Commission d'accès à l'information in accordance with Law 25.

13. Cookies, Tracking Technologies, and Advertising

The Application may use local storage technologies and technical identifiers to ensure its operation and measure its use. Oscar uses Sentry for diagnostics and crash detection, and PostHog for usage statistics. The web version of the Application and the Site use only cookies and local storage strictly necessary for operation (login session, language preference).

Advertising. Accounts not subscribed to Oscar+ may be shown advertising served by Google AdMob. No advertising is shown on child profiles or directed at minors. Oscar+ subscribers see no advertising. You can limit ad personalization in your device settings (iOS: "Allow Tracking"; Android: reset or delete the advertising identifier).

14. Family Profiles and Minors

14.1 General Model

Oscar allows the creation of family profiles so that each household member receives recommendations tailored to their unique profile. To protect children's privacy, we apply the following model:

• The account holder must be at least 14 years old. Account creation is reserved for persons aged 14 and over.
• Profiles for children under 14 are created and managed by a parent or guardian within their own account. Children under 14 do not create accounts independently and hold no login credentials of their own.
• To create a profile for a child, the parent or guardian must check an explicit consent box confirming they hold parental authority and consent to the creation of the profile and the collection of its associated information; this consent is timestamped and retained, and the profile cannot be created without it.

We limit the collection of information relating to minor profiles to what is strictly necessary for household recommendations: first name or nickname, age, avatar (emoji and colour), themes to avoid, favourite genres, titles marked as watched or added to their personal list, and in-app progress (XP, quests). This information is used exclusively to personalize the child's recommendations and to avoid suggesting a title they've already seen — never for marketing purposes, and never shared or made public. We do not collect a full date of birth, address, photo, contacts, or advertising identifier for a child's profile. In accordance with Law 25, the privacy settings of a minor's profile are set to the highest level of protection by default, and we do not use a minor's information for marketing purposes. No advertising is displayed on a child's profile, in accordance with Quebec's Consumer Protection Act, which prohibits commercial advertising directed at children. A child's profile does not participate in the community feed and is not visible to any other user (see section 9).

The parent or guardian may at any time access, modify, or delete a child's profile and associated information by contacting our Privacy Officer (section 2) or directly within the Application.

We do not knowingly collect information from a child under 14 outside the parent-managed profile model. If you believe a child has provided us with information without parental supervision, please contact us so we can delete it.

14.2 United States Residents — Children's Online Privacy Protection Act (COPPA)

If you reside in the United States, this subsection describes how we comply with the Children's Online Privacy Protection Act (COPPA) and its implementing rule (16 C.F.R. Part 312) when a profile is created for a child under 13.

Strictly internal use. A child's profile information is used exclusively to personalize the recommendations for that child within the household. It is never disclosed to third parties for marketing purposes, never made public, and never used for targeted or behavioural advertising.

Your rights as a parent or guardian. You may at any time, directly within the Application or by contacting our Privacy Officer (section 2) and noting that your request relates to COPPA: review the personal information collected about your child's profile; refuse to permit our further collection of information; and require deletion of the profile and its associated information. We respond to such requests within a reasonable time, generally under 30 days.

If we learn that a child's profile was created without the consent measures described in section 14.1 (for example, following a false declaration), we delete the information concerned as soon as reasonably possible.

15. California Residents (CCPA/CPRA)

If you reside in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), grants you the additional rights described below.

Categories of personal information. In the preceding 12 months, we have collected the categories of personal information described in section 3 (identifiers, personalization information, usage and technical data, and, for non-subscribed accounts, advertising identifiers). We have not sold or disclosed sensitive personal information, and we never sell or share the information of child profiles.

"Sharing" for advertising purposes. If we enable personalized advertising through Google AdMob for non-subscribed accounts (see section 13), this may constitute a "share" of personal information under the CCPA/CPRA's broad definition, even absent a sale in the traditional sense. You may opt out at any time by disabling ad personalization in your device settings, by subscribing to Oscar+ (which removes advertising entirely), or by contacting us (section 2) to disable this sharing for your account.

Your rights. In addition to the rights described in section 10, you have the right to: know what personal information is collected, used, disclosed, or sold/shared about you; request deletion of your personal information; correct inaccurate information; limit the use of sensitive personal information; opt out of sale or sharing; and not be discriminated against for exercising these rights.

To exercise any of these rights, contact our Privacy Officer (section 2) and note that your request relates to the CCPA/CPRA. We will verify your identity before acting on the request and will respond within the timeframes required by law (generally 45 days, extendable by an additional 45 days).

16. EEA, UK, and Swiss Residents (GDPR)

If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and the equivalent UK and Swiss laws grant you the additional rights and protections described below.

Legal bases for processing. In addition to consent (section 5), we process certain information on the basis of the performance of our contract with you (providing the service), our legitimate interests (security, fraud prevention, service improvement) balanced against your rights, and compliance with our legal obligations.

Transfers outside the EEA. Several of our providers process information in the United States (see the table in section 6). When we transfer your information outside the EEA, we rely on the European Commission's Standard Contractual Clauses or another transfer mechanism recognized under the GDPR.

Your rights. In addition to the rights described in section 10, you have the right to: object to processing based on our legitimate interests; request restriction of processing; and lodge a complaint with the supervisory authority of your country of residence (for example, the CNIL in France or the Information Commissioner's Office in the UK), in addition to or instead of the Commission d'accès à l'information du Québec.

Automated decisions. As described in section 8, our recommendations produce no legal effect concerning you and are not subject to any decision based solely on automated processing within the meaning of Article 22 of the GDPR.

Advertising consent. When personalized advertising is enabled for non-subscribed accounts located in the EEA, the UK, or Switzerland, it will only be enabled after obtaining your prior, explicit consent, through a consent management mechanism compliant with Google's EU User Consent Policy. You will be able to withdraw this consent at any time in the Application's settings.

To exercise your rights or for any GDPR-related question, contact our Privacy Officer (section 2).

17. Third-Party Data Sources

Film and series data is sourced from The Movie Database (TMDB). Oscar uses the TMDB API but is neither endorsed nor certified by TMDB. Additional scores come from OMDB (IMDB, Rotten Tomatoes, Metacritic) and Trakt.tv; streaming links and available languages may come from JustWatch; trailers are played through the embedded YouTube player.

18. Changes to This Policy

We may update this policy from time to time. Any significant changes will be communicated to you within the Application or by email at least 30 days before they take effect, where required by law. The "last updated" date at the top of the document indicates the version in effect.

19. Contact Us

For any questions regarding this policy or your personal information:

• Privacy Officer: Hey Oscar Inc.
• Email: info@heyoscar.ca
• Address: Montreal, Quebec, Canada

You may also file a complaint with the Commission d'accès à l'information du Québec: www.cai.gouv.qc.ca