Privacy

This page explains what information Marvo collects, how it’s used, and the third-party services Marvo relies on to operate.

What Marvo collects

To make a pick, Marvo stores the following on your account:

• Account information — your email address and authentication state, managed through our auth provider (Supabase). We do not store your password directly.
• Streaming services — which platforms you’ve told Marvo you subscribe to.
• Watch history and library — titles you import (e.g., from Netflix, Prime Video, or Kaleidescape CSV exports), plus titles you’ve added to your watchlist or marked as owned.
• Household context — named viewer profiles you set up (for example, “Me,” “Partner,” “Kids”) along with whether each is a minor.
• Session inputs — the mood, who’s watching, and how much time you have, captured each time you ask for a pick.
• Pick history and feedback — the recommendations Marvo has surfaced to you and any quality feedback you provide.
• Taste profile — a derived persona Marvo builds from your watch history to anchor future recommendations.
• Curiosity signals — which title pages you open and what you search for inside Marvo. We use these to recommend better picks. We keep them for 30 days, then delete them. Deleting your account clears them immediately.

What Marvo does not collect

• We do not track your browsing behavior outside Marvo.
• We do not sell your personal information, and we do not share it with advertisers. We do not run ads in Marvo, and partners cannot pay to influence the picks we recommend to you.
• We do not store payment information ourselves — if you subscribe to a paid plan, our payment processor handles that information directly.

How Marvo uses your information

The information above is used to build the prompt sent to our recommendation engine each time you ask for a pick. That includes:

• Selecting candidate titles available on your subscriptions.
• Filtering by household context (e.g., tightening the content rating when a minor is in the room).
• Personalizing the pick to your taste profile and recent feedback.
• Training and improving the recommendation models that power Marvo’s picks.

If you join with a friend’s invite code, we note which account invited you. The person who invited you sees only how many friends joined, never who.

Aggregated and de-identified information

We may de-identify the activity captured above — for example, watch history, mood selections, and ratings — and combine it with information from other users into aggregate datasets. These aggregates are designed not to be reasonably linkable to you or your household, and we treat them as non-personal information.

Marvo may use, license, or share these aggregated and de-identified insights for lawful business purposes, such as helping studios, streamers, and creative partners understand which genres, moods, or formats audiences are gravitating toward. Any partner that receives this information is contractually prohibited from attempting to re-identify users or combining it with other data to do so.

Aggregated insights are about trends, never individuals. Marvo does not sell your personal information and does not let partners pay to influence the picks you see.

You can opt out of being included in these aggregates at any time from your account settings.

Third-party services

Marvo relies on the following third parties to operate. Each receives some portion of your personal information as described below and has its own privacy practices.

• Supabase — database and authentication. Supabase stores all account data, watch history, household context, and session records on Marvo’s behalf.
• Anthropic — the large language model that generates each recommendation. The prompt sent to Anthropic includes the session inputs, your active services, recent watch history, and taste profile. No directly identifying information (email address, real name, or postal address) is included in the prompt.
• Vercel — hosting and serverless functions. Vercel processes every request Marvo receives and retains standard server logs (IP address, request path, response code, timestamp).
• Resend — transactional email. Marvo sends Resend your email address to deliver account-related messages such as password reset links, welcome emails, and deletion confirmations. Resend is also used to deliver Group Vote invites to friends a host invites via email.
• Apple Push Notification service and Google Firebase Cloud Messaging — push notifications. If you allow notifications in the Marvo app, your device gives Marvo a push token, and Marvo sends that token with each notification’s content (its text and the screen it opens) to Apple (on iPhone) or Google (on Android) to deliver it. Firebase is used only to deliver notifications; Marvo does not use Firebase analytics.
• Twilio — transactional SMS. When a Marvo user starts a Group Vote and adds a friend by phone number, Marvo sends Twilio that phone number and a one-time voting-link message body so the friend receives an SMS invite. See the SMS messaging section below for the full opt-in, frequency, and opt-out flow.
• Sentry — error tracking. When something breaks, Marvo sends Sentry the error message, stack trace, and the page or route where it happened. If you’re signed in, the report is tagged with your account id so we can correlate it with your session, but it does not include your watch history, household, or any pick content. Sentry retains its own copy of error events on its retention schedule, even after you delete your Marvo account; if you need that copy purged, email us and we’ll request a manual purge from Sentry. In Kids mode, error reports carry only the parent’s account id and no kid information.
• PostHog — product analytics. Marvo sends PostHog event names (such as onboarding_completed, pick_revealed, pick_marked_watched) plus your account id once you sign in, and small per-event properties like the mood you picked or which alternative you swapped to. Marvo does not send PostHog your watch history, household details, the pick title or its body content, or the email on your account. In Kids mode, product analytics is turned off: no events and no session recording.
• Google Cloud (BigQuery) — hosts our internal analytics warehouse, which holds account and usage data for understanding how Marvo is used, and which receives no kid profile or kids history data.

Marvo also reads from a number of third-party data sources — title metadata, ratings, awards, and streaming availability — to populate what you see on each title page. None of your personal information is sent to those sources. They are listed in full on the credits page.

SMS messaging (Group Vote)

Marvo’s Group Vote feature lets a user invite friends to vote on what to watch tonight. When the host adds a friend by phone number, Marvo sends that friend a one-time text message containing a private voting link. This section describes how that flow works.

How recipients opt in

Consent for Group Vote SMS is collected through Marvo’s web app. When a host adds a friend by phone number, the host sees an in-app notice immediately above the “Send vote link” button:

By sending, you confirm each invitee has agreed to receive a one-time SMS from Marvo on your behalf. Recipients can reply STOP at any time.

By tapping “Send vote link,” the host attests that each invited recipient has agreed in advance to receive the message. Marvo never sends SMS to anyone who was not explicitly named by a host inside the app. Marvo does not buy, rent, or share phone-number lists, and recipients are never enrolled in any recurring or marketing campaign.

What recipients receive

Each invited friend receives a single SMS containing the host’s display name, a secure one-time voting link, and a STOP-to-opt-out footer. A representative message:

Ryan started a Group Vote on Marvo. Open the link to vote: https://marvo.app/vote/… Reply STOP to opt out.

Messages are strictly transactional — no marketing, promotional offers, or broadcast content. Each link is bound to one round and one recipient, expires when the round closes, and can only be used once.

Frequency

One message per recipient per round. A typical host creates one to three rounds per week with up to four invitees per round. No scheduled or recurring sends.

Opt-out

Recipients can reply STOP to any Group Vote SMS at any time. Opt-outs are persisted on Marvo’s servers and honored across every future Group Vote round from every host, with no exceptions. To opt back in later, reply START. For questions about your opt-out status, email hello@marvo.app.

Carrier disclaimer

Message and data rates may apply. Marvo does not charge for sending Group Vote invites, but your wireless carrier may charge you for receiving SMS depending on your plan. Marvo is not responsible for delays or non-delivery caused by your wireless carrier.

Security

Marvo uses reasonable technical and organizational measures to protect your data, including encryption in transit (TLS) and storage on Supabase-managed infrastructure with encryption at rest. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Cookies and local storage

Marvo uses session cookies and local browser storage to keep you signed in and to remember your in-flow choices (the current mood, time, and who’s watching). Marvo also uses PostHog for first-party product analytics (see above); PostHog sets a small device id in local storage to recognize the same browser across visits. Marvo does not run advertising trackers.

When you view a trailer inside Marvo, the video loads directly from YouTube (youtube.com/embed). YouTube’s own cookie and privacy policies apply to that embed; Marvo does not control what YouTube sets in your browser during playback.

Data retention

Account data is retained while your account exists. You can delete your account at any time from the account settings; once deleted, your account record and associated history are removed within 30 days, except where we are legally required to retain certain logs.

Kids history, when a parent has turned on remembering, is kept as described under “Remember what your kid watches”: each title for 18 months after its last activity, and all of it after 18 months with no activity or as soon as remembering is turned off.

Aggregated and de-identified insights produced before your account was deleted may be retained, because they are designed not to be reasonably linkable to you and your individual record has already been removed.

Your rights

You can export your data, correct it, or request deletion. Email us at privacy@marvo.app and we’ll respond within a reasonable timeframe.

Parents can see, download or delete everything Marvo keeps about their kid profiles, and turn remembering off, from Profile › Household › the kid’s settings, or by emailing privacy@marvo.app.

US state privacy rights

Residents of California, Colorado, Connecticut, Utah, Virginia, and other states with active privacy laws may have the right to: know what personal data we collect, access or correct that data, request deletion, and opt out of the sale or sharing of personal data. We do not sell personal data.

To submit a request, email privacy@marvo.app. We will respond within 45 days, as permitted by applicable law. If we decline your request, you may appeal by replying to our response and we will provide a written explanation within 30 days.

Kid profiles and children’s privacy

Marvo accounts are for people 13 and older. We do not knowingly let anyone under 13 create an account, and we do not knowingly collect personal information from a child.

A parent or guardian who is an adult account holder may add a kid profile for a child in their household. The parent enters it, not the child: a first name or nickname (we ask parents not to enter a last name), the birth year (never a full date of birth), a color, the shows they pick as favorites or block, and settings such as kinds of watch, services and bedtime. We use this only to pick titles that fit the child’s age and the parent’s rules.

Unless the parent turns on “Remember what your kid watches” (below), we do not keep a record of what a child watches, taps or searches in Kids mode. We never send anything about a child to an AI provider, and we never use it for advertising, sell it, or share it with third parties other than the service providers that run Marvo for us (listed above).

Remember what your kid watches (optional, off unless you turn it on)

The household owner can choose to let Marvo remember what a kid watches, so Kids mode can put the shows that kid loves first and avoid repeats. It is off by default, it is never required, and Kids mode works fully without it.

How you turn it on. Only the household owner can turn it on, and only after confirming they are the child’s parent or legal guardian. In the Marvo app for iPhone and iPad, on a device with Face ID or Touch ID, the owner confirms right there by entering the household’s grown-ups passcode, which Face ID or Touch ID can fill in for them. Everywhere else, we email the owner a notice explaining what we keep, and the owner confirms by signing in and opening that email’s link. Either way, nothing is collected until the owner confirms. We keep a record of that consent: which account gave it, when, which version of the notice it covered, and whether it was confirmed with the grown-ups passcode or from the email.

Face ID, Touch ID, and fingerprint or face unlock. If a grown-up turns on Face ID or Touch ID (on an iPhone or iPad) or fingerprint or face unlock (on an Android phone or tablet) for the grown-ups passcode, the passcode is kept on that device only: in the secure Keychain on an iPhone or iPad, or encrypted with a key held by the Android Keystore on Android. It is released only by a face or fingerprint set up on that device, never by the device’s own PIN, pattern or password, and adding a new face or fingerprint turns it off until the passcode is typed again. It is not included in device backups. Marvo never receives a face or a fingerprint: the device checks it and hands Marvo only the passcode, which Marvo checks exactly like a typed one. Anyone whose face or fingerprint is set up on that device can use it, so turn it on only on your own device. Signing out of Marvo on that device removes it.

What we keep, for each title the kid watches:

• the days the kid pressed Watch (dates only, no times)
• whether the kid watched it again on a later day
• whether the kid tapped “Loved it” or “Not for me,” whether a kid or a parent tapped it, and the date
• whether the parent has looked at it

We also keep the date of the last activity, so we know when to delete everything, and any “More of this” or “Less of this” choices the owner makes about topics Marvo has noticed (for example “animals”). Those choices only change the order of shows the kid is already allowed.

What we never keep: searches, anything typed, voice, location, device identifiers, or anything watched in Together mode on the TV.

How we use it. Marvo works out what the kid seems to be into, for example “animals” or “short episodes,” and uses that only to order shows the kid is already allowed to see. It never unlocks a show the kid’s age or the parent’s rules would otherwise block. This taste picture is worked out fresh each time and is not stored. Children under 5 don’t get the “Loved it” and “Not for me” buttons.

Shared devices. Marvo knows which kid profile was on, not which child was holding the device. A parent can move or remove any item.

Who sees it. Only the household owner, in Kid settings. Other adults in the household do not see it. It is never sent to an AI provider, an advertiser, or our analytics tools, and it is not included in the data we use to understand how Marvo is used overall.

Your choices. From Kid settings, the owner can see the history, delete any item or all of it, download it, or turn remembering off at any time. Turning it off deletes the history right away. Every email we send about it also has a link to turn it off.

How long we keep it:

• each title, 18 months after its last activity
• everything, after 18 months with no activity
• all of it at once, if remembering is turned off, the kid profile is deleted, the household is dissolved, or the household changes owner

Deleted history is removed from our systems right away. Copies in our database backups are deleted automatically within 30 days.

Consent records. After remembering is turned off, we keep the consent record (which account, when, which notice version, and a coded reference to the kid, with no name or birth year) for 2 years, to show we had permission.

If we change this. If we ever want to keep a new kind of information about kids, we will pause remembering and ask the owner again. Nothing new is collected without a fresh yes. For other changes to this section we email the owner.

The parent can see, change or delete each kid profile at any time from Profile › Household. When you delete a child profile, we delete it from our systems right away. Copies in our database backups are deleted automatically within 30 days, and if we ever restore a backup, we delete the profile again before the service is back in use. Questions: privacy@marvo.app.

International users

Marvo is operated from the United States and is intended for residents of the United States during the beta. If you access Marvo from outside the United States, you do so on your own initiative and are responsible for compliance with local law. Your data will be processed and stored in the United States and in regions managed by our infrastructure providers.

Changes

If we materially change this policy, we’ll update the “Last updated” date at the top and surface a notice in the app before the change takes effect.

Governing law

This policy is governed by the laws of the State of Utah, United States. Strata Ventures LLC d/b/a Marvo operates the service.

Contact

Questions? privacy@marvo.app.