Privacy Policy

Updated October 15, 2026

Nights is a private movie-ticket collection for iPhone developed by Jake Standley. It turns supported AMC confirmation emails into ticket records stored on your device. Optional friend connections, ticket sharing, and email forwarding use a Nights-operated server hosted by Render. Connecting Gmail alone continues to parse your confirmations on your device.

Gmail access

When you choose to connect Gmail, Google grants Nights read-only access to your mailbox through the gmail.readonly permission. This technical permission can read mailbox content. Nights limits its own searches to supported AMC confirmation-email senders and retrieves matching messages so it can identify and parse your tickets.

Nights cannot send, edit, or delete your email. Connecting Gmail is optional, but automatic ticket import does not work without it.

Information processed and retained

For supported confirmations, Nights may process and retain:

Movie title, showtime, theatre, auditorium, presentation format, and seats
Confirmation or order identifiers
Gmail message identifiers and synchronization checkpoints
Import and repair metadata for confirmations that need attention
AMC entry-code image URLs or tokens and a cached entry-code image for offline access
Limited ticket metadata such as A-List or Entourage indicators when present in the confirmation

Matching message content is processed by the app on your iPhone. Nights retains the parsed information above rather than a browsable copy of your mailbox.

Where information goes

Nights communicates with:

Google Sign-In and the Gmail API, to authenticate you and retrieve supported confirmation emails
AMC-hosted image services, to download the entry-code image referenced by a confirmation for offline use
Apple services required by iOS, Sign in with Apple, and TestFlight, when you sign in, install, or test the app
Postmark, when you forward confirmation emails to your Nights forwarding address, to receive and deliver those emails to the Nights server
The Nights server hosted by Render, when you use friend connections, ticket sharing, or forwarding
Google Analytics for Firebase and Firebase Crashlytics, in releases configured for usage analytics and diagnostics as described below

Connecting Gmail alone does not upload your messages or ticket collection to the Nights server. Once you sign in for friend connections, the parsed details of your upcoming tickets (title, theatre, showtime, auditorium, seats, format and order number, never the entry code) upload to the Nights server after each Gmail sync so friends can see them; turning off Share my nights with friends stops this. Forwarding emails to your Nights address sends those emails to the forwarding service for processing. Nights does not sell personal information, display advertising, track you across other companies’ apps or websites, or use Gmail data for generalized artificial-intelligence model training.

Signing in with Apple for friend connections creates a Nights account. The server stores an Apple account identifier, an optional display name, session records (including a push notification device token when you allow notifications), a forwarding alias, invitations, friendships and blocks, and a short-lived notification outbox: one row per friend and event naming the ticket, the event type and the devices still to be notified, kept for seven days at most. Render processes network connection information, and service logs record request paths and technical status information. Invitation secrets are sent in request bodies rather than API URLs; the public invitation page can display the inviter’s name but cannot connect accounts by itself.

Opening a valid invitation after sign-in connects both accounts. Friends see each other’s upcoming screenings: title, theatre, showtime, auditorium, seats and the name you chose. They never see your entry code, order number or email. You can hide any ticket from friends, and Share my nights with friends turns the whole feature off in both directions. The server stores your display name and these ticket details; entry codes are uploaded only when the server itself parsed a forwarded email. Ticket credentials and retained failed-forwarding message copies are encrypted at rest by the application. Do not assume all account metadata is encrypted by that same mechanism.

Friend connections and account data remain until removed or the account is deleted. Invitation links expire after seven days; expiration disables redemption but does not imply immediate deletion of the stored invitation record. Forwarding and sharing records are retained to provide those features, with additional expiry rules for recipient access and failed-email processing.

How we protect your data

We use the following safeguards for sensitive information, including Gmail authorization credentials, ticket records, and entry codes:

Encrypted Gmail connections. Gmail API requests and AMC entry-code image downloads use HTTPS, which encrypts information in transit using TLS. Google sign-in takes place through Google’s authorization flow; Nights does not ask for or store your Google password.
Protected sign-in credentials. Google Sign-In manages the saved Google authorization session in the iOS Keychain. Sessions for optional Nights server features are also stored in the Keychain, with a device-only setting that makes those credentials unavailable before the first device unlock after a restart and prevents their migration to another device. The server stores a hash of its session token rather than the usable token itself.
Protected local storage. Nights stores its ticket database and cached entry-code images in the app’s private storage area, isolated by the iOS app sandbox. Nights configures iOS Data Protection for these files so they remain unavailable until the first device unlock after a restart. They can remain accessible to the app after subsequent screen locks so the app can operate in the background. Device security and backups also depend on your passcode and Apple settings.
Server access controls. When optional server features are used, requests for private ticket records require an authenticated session and are restricted to the account that owns them. Shared outing access is checked against the sharing permissions for the signed-in recipient. Hiding a ticket, turning sharing off, or removing a friend prevents subsequent authorized retrieval; a friend’s app clears its cached copy within 15 minutes. It cannot remove screenshots, copies a friend has already made, or the text of a notification already delivered to their phone (a friend’s name, the film, time, auditorium and seats).
Encryption of server-held entry credentials. The Nights server encrypts stored entry-code tokens and retained failed-forwarding message bodies using authenticated encryption (ChaCha20-Poly1305). This is encryption of those specific fields, not a claim that every database field is encrypted or that sharing is end-to-end encrypted.
Limited diagnostic content. Our explicit analytics events and handled-error reports exclude Gmail message content, ticket details, entry codes, and authorization tokens, as detailed in the diagnostics section below.

You can revoke Gmail access and erase local data using the controls below. Optional server accounts have a separate deletion control. No method of storage or transmission can guarantee absolute security.

Exporting a ticket image through the iOS share sheet is separate from server-backed outing sharing. The image can contain seats and an entry code. The app or person you choose receives the image and can retain a copy.

Usage analytics and diagnostics

Releases configured for telemetry send limited usage events to Google Analytics for Firebase and diagnostic reports to Firebase Crashlytics. Builds without telemetry configuration do not configure Firebase. Development builds and automated tests do not enable this telemetry.

Our explicit usage events describe app activity, sign-in and reconnect outcomes, import completion, ticket-detail views, entry-code display, opening the ticket-sharing sheet, and the success, failure, and duration of app operations. Displaying an entry code does not tell us whether a venue accepted it. Analytics also collects basic lifecycle and engagement events. Crashlytics helps identify crashes and handled failures, using technical stack traces, device/app information, and recent diagnostic breadcrumbs.

An app-generated random installation identifier connects our usage events and diagnostics. Firebase also creates its own app-instance and installation identifiers. We do not attach your name, email address, Google account identifier, or advertising identifier. Identifiers can persist with app preferences and device backups; counts of installations are not exact counts of people.

Our explicit events and handled-error reports exclude mailbox contents, movie titles, showtimes, seats, order identifiers, entry codes, access tokens, raw request URLs and original error descriptions. We disable automatic screen reporting, advertising consent and vendor-identifier collection, and use the Analytics library without advertising identity support. We do not enable session recordings, screenshots, network tracing or Firebase Performance Monitoring. Crashlytics creates native crash reports independently of our handled-error filter; the exact release’s diagnostic payloads are reviewed before enabling collection. Like other network services, Google receives the connection’s IP address and processes SDK metadata; our custom events do not include an IP-address property.

Before enabling a release, Nights configures Analytics event/user retention to two months with reset-on-new-activity disabled. Crashlytics retains crash data for 90 days before beginning deletion from its systems; aggregate Analytics reports may remain longer. See Firebase’s data handling documentation and Analytics retention documentation. Deleting Nights Data erases the local ticket collection and sync state, but does not automatically delete telemetry already sent. Contact support for questions about telemetry or deletion of previously sent reports.

Storage and retention

Imported ticket information and cached entry-code images remain on your iPhone until you delete Nights data or remove the app, subject to the backup and device-management behavior you have configured with Apple. Disconnecting Gmail stops future access but intentionally preserves your existing collection.

Disconnecting and deleting

Use Settings → Disconnect Gmail to ask Google to revoke Nights’ authorization while retaining imported tickets.

Use Settings → Delete Nights Data to erase tickets, cached entry-code images, repair items, Gmail message identifiers, and synchronization state stored by Nights. Deleting Nights data also signs you out of Nights on this device; your Nights account on the server is unchanged. Local deletion works without a network connection. If Google cannot be reached, Nights signs out locally and tells you how to revoke the remaining authorization from your Google Account connections.

Local wallet deletion and Gmail disconnection do not delete your Nights server account. In the forwarding settings, Delete forwarding account removes the server account, connections, and shared records; this requires a network connection. Despite its label, this is also the account used for friendships. Tickets already saved on your phone remain until deleted locally. Contact support if you cannot access the account-deletion control.

These actions do not delete your Google Account, Gmail messages, AMC Account, or AMC purchase history.

Google API Limited Use

The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Children

Nights is not directed to children under 13, and the developer does not knowingly collect children’s personal information through a developer-controlled service.

Changes to this policy

Material changes will be published on this page with a new effective date. The policy applicable to an installed build will remain publicly available.

Contact

Questions or privacy requests can be sent to support@getnights.app.