Privacy notice

Who is responsible

In short

cinenow works without user accounts, advertising tracking or advertising. We count visits anonymously with our own cookie-free analytics service. All we store are your settings, so that you don’t have to enter them again on your next visit.

1. Hosting and server logs

The website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (our processor). When you visit, the server processes technically necessary access data: IP address, time, the address requested, status code and browser identifier. These logs are used to keep the service secure and are overwritten continuously (usually after a few days).

Lawful basis: legitimate interests (Art. 6(1)(f) UK GDPR / GDPR) in running the service securely and reliably.

2. Audience measurement (Umami)

To see how many people use cinenow and which pages are visited, we use the open-source software Umami. It runs on our own server at Hetzner Online GmbH (see above) in Germany; no data is passed to third parties. Umami sets no cookies and stores nothing in your browser. It records the page visited, the referring page, browser, operating system, device type, screen size and the country derived from the IP address. The IP address itself is not stored; visits are only counted using an anonymous identifier that changes daily, so they cannot be traced back to you.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement to improve the service).

3. Your settings (cookie and local storage)

When you choose a location, a travel time, a mode of transport or filters, we save that choice in a cookie (“ck”, 400 days) and in your browser’s local storage. Your location is stored as a place name with coordinates — only in your browser; the server reads the cookie to show you the right start page but does not store it. If you have allowed or declined trailers, we save that choice (“cp_consent”, 1 year).

Lawful basis: strictly necessary storage for the service you have asked for (regulation 6(4) PECR; § 25(2) no. 2 TDDDG) and legitimate interests (Art. 6(1)(f) UK GDPR / GDPR). You can delete cookies and local storage in your browser at any time.

4. Location and address search

You enter your location yourself, or let your browser’s location feature determine it at the touch of a button (only once you have allowed this in your browser). Place and postcode suggestions come from our own data (GeoNames, CC BY 4.0). For street addresses, our server queries the address search of Mapbox, Inc. (740 15th Street NW, Washington DC 20005, USA) or, as a fallback, the Photon service (komoot GmbH, Germany) — only the search text, a random session identifier and an approximate reference point (the city of the page) are sent, not your IP address. If an address cannot be found there, your browser searches Nominatim directly, run by the OpenStreetMap Foundation (St John’s Innovation Centre, Cambridge, CB4 0WS, United Kingdom); the OpenStreetMap Foundation then receives your IP address and the search text (privacy policy).

For more accurate car and cycling times, our server queries the openrouteservice of HeiGIT gGmbH (Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg, Germany). Only the starting point, rounded to about 100 m, and the cinemas’ coordinates are sent, not your IP address. We keep the results (rounded starting point and travel times, with no link to you) for up to a year so that they can be shown again quickly. Bus and train times are only estimated.

Lawful basis: Art. 6(1)(b) and (f) UK GDPR / GDPR (carrying out the search you asked for).

5. Routes and travel times

Travel times to cinemas are estimated in your browser. Routes on the cinema pages are calculated by our server using the routing service of Mapbox or FOSSGIS (OSRM); only the start and destination coordinates are sent, not your IP address.

6. Maps

The small maps in the cinema view and on the cinema pages are made of map tiles that your browser loads directly from the tile servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cambridge, CB4 0WS, United Kingdom) (privacy policy). In doing so, the OpenStreetMap Foundation receives your IP address and the address of the requested tile (map section). The EU Commission has issued an adequacy decision for the United Kingdom. Map data: © OpenStreetMap contributors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing the cinema’s location and the route).

7. Film trailers (only with your consent)

Film trailers are embedded from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode (youtube-nocookie.com). They are only loaded once you agree (“Allow external content” on the trailer or in the cookie settings). YouTube then receives your IP address and technical data about your browser; a transfer to the USA is possible. Google is certified under the EU-US Data Privacy Framework and its UK Extension.

Lawful basis: your consent (Art. 6(1)(a) UK GDPR / GDPR; regulation 6 PECR; § 25(1) TDDDG). You can withdraw your consent at any time via “Cookie settings” at the bottom of the page.

8. Film posters and film information

Posters, film data and ratings come from TMDB and the OMDb API. Our server fetches them and serves them itself; your browser does not connect to these services.

9. Links to cinemas and ticketing providers

Screening times link to the cinema’s website or its ticketing provider. Only when you open such a link do you leave cinenow; the privacy policy of the respective provider then applies. “Get directions” likewise only opens the navigation app you choose (e.g. Google Maps, Apple Maps, Waze) when you tap it.

10. Contacting us by email

If you email us, we process the information you send (email address, content) to deal with your enquiry. Lawful basis: Art. 6(1)(b) or (f) UK GDPR / GDPR.

11. Reporting a problem

With “Report a problem” you can tell us about wrong or missing information on a cinema. We only store what you enter in the form (type of problem, optionally your text), the cinema or film concerned, the page and the time – no IP address and no contact details. To prevent abuse, our server briefly keeps a non-reversible short value of your IP address (at most one hour, in memory only). We delete reports once they have been dealt with and are no longer needed.

Lawful basis: Art. 6(1)(f) UK GDPR / GDPR (legitimate interest in accurate cinema listings).

12. Your rights

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3))

You also have the right to complain to a data protection supervisory authority. In the UK this is the Information Commissioner’s Office (ICO, ico.org.uk); the authority responsible for us in Germany is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

Last updated: October 2026