Privacy Policy

Last updated: August 14, 2026

This Privacy Policy explains how Marothon (“Marothon,” “we,” “us”) collects, uses, shares, and retains information when you use the Marothon mobile app and this website (together, the “Service”). Marothon is a personal TV and movie tracking app. We try to collect only what we need to run the Service.

Marothon is operated by Lukas Haselwood, an individual based in Kansas, United States. For the purposes of the UK and EU General Data Protection Regulation, Lukas Haselwood is the data controller for the information described here, and can be reached at privacy@marothon.com. There is no company behind Marothon and no other party decides how your data is used.

Information we collect

We collect the following categories of information:

• Account email. When you create an account, we collect the email address you sign up with. If you sign in with Google or Apple, we receive the email address associated with that account. We use it to authenticate you, secure your account, and send essential account communications.
• Watch history and tracking data. The core of the Service. This includes the movies and shows you track, episodes you mark as watched, your Rot List and watchlists, ratings, progress, and related activity you create in the app.
• Profile information. Your username and display name, and a profile photo if you choose to add one. A photo is optional.
• Follow connections. Who you follow, who follows you, and any pending requests in either direction. We also store the visibility setting you have chosen for your account.
• Blocks. If you block someone, we store that so we can keep enforcing it.
• Reports you file or that are filed about you. The reason you selected, anything you typed in the description, and a copy of the reported profile as it appeared at the time. See Safety and moderation below.
• Push notification token. If you enable push notifications, we store an Expo push token for your device so we can deliver notifications (for example, when a new episode of a show you track is available, or when someone asks to follow you). You can turn notifications off at any time in your device or app settings.
• Preferences and settings. Your timezone, notification preferences, and the display options you choose in the app.
• Technical and log data. The ordinary details every internet service sees when your device makes a request: your IP address, the kind of device or browser making it, and when. We do not ask you for any of this and we do not store it ourselves. Our providers record it automatically as part of delivering the Service, and it is what makes it possible to keep things running and to spot abuse.

This website uses Vercel’s analytics to count page views and measure page speed. It works without cookies and does not follow you to other sites. The app itself contains no analytics and no tracking of any kind.

We do not ask for your real name, location, contacts, or payment information, and we do not sell your personal information. We do not track you across other apps or websites.

Information other people can see

Marothon’s social features are on by default. Your username, display name, and profile photo are visible to other people from the moment you create an account, and you can be found in search. If you would rather none of this applied to you, you can turn the social features off in Settings at any time, and nothing in this section is true of you any more.

Following is one-way, and you control who can follow you. Your account is set to require approval by default. Approval does not hide you. It gates what someone can see once they have found you.

Visible to anyone using Marothon who can find you, whatever your visibility setting, unless you have blocked them:

• Your username and display name.
• Your profile photo.

Visible only once you have approved someone, or to everyone if you set your account to public:

• Your watch statistics: total watch time and your show, episode, and movie counts.
• Your favorites and what you have recently watched.
• Who follows you and who you follow, and your follower and following counts.
• A side-by-side comparison of what the two of you have watched, if either of you opens it.

Setting your account to unlisted keeps you out of search, but someone who has your direct link still sees the same name and photo. If you would rather not be visible at all, turning the social features off in Settings is what does that. See below.

Your profile photo is stored on a public content delivery network. This is how the app loads images quickly, and it means the image file itself is not access- controlled: anyone who has the direct URL can open it, including someone you have not approved, someone you later block, and someone who saved the link earlier. Your other profile information is not public in this way. If that is not a trade you want to make, do not upload a photo. The app works without one.

Changing your account to private later stops new people seeing your profile, but it does not reach back: anything someone already saw, saved, or screenshotted is out of our hands. Removing a photo removes it from our systems, but copies already downloaded by someone else are not something we can delete.

Safety and moderation

Profile photos are reviewed automatically before anyone else sees them. When you upload or import a photo, we send the image to Amazon Rekognition, an automated image moderation service, which checks it for nudity, violence, hate symbols, and similar categories. Until it passes, the image is held in private storage and is not shown to anyone. A photo that fails is deleted rather than published, and no person at Marothon reviews it unless it is later reported.

Reports. When you report someone, we store the reason you chose, anything you wrote, and a copy of that person’s username, display name, and photo as they appeared at the time. We keep that copy because it is the evidence, and the live profile may have changed by the time anyone reviews it. Reporting someone also blocks them immediately.

If you delete your account, reports you filed are not deleted. Your identity is removed from them, so what remains is an anonymous complaint with no link back to you. This is a deliberate exception to the deletion described below: letting a report disappear when its reporter leaves would let someone erase the record of harm to other people. Records of moderation decisions we have taken are kept for the same reason.

We use the information in this section only to keep people safe and to enforce our Terms and Community Guidelines. See Safety and support for how reporting works.

How we use your information

• To create and secure your account and sign you in.
• To provide the core features of the Service, which means saving your watch history, Rot List, and progress so you can pick up where you left off.
• To provide the social features, which means showing your profile to people you have approved, and delivering follow requests and follower notifications.
• To send push notifications you have opted into.
• To review profile photos, act on reports, and enforce our Terms and Community Guidelines.
• To maintain, debug, and improve the Service, and to protect against abuse, fraud, and security issues.
• To comply with legal obligations.

Our legal bases (UK and EU)

If you are in the United Kingdom or the European Union, the law requires us to say which legal basis we rely on for each thing we do with your information.

• Performance of a contract. Your account, your watch history and tracking data, your profile, and the social features you turn on. This is the Service you asked for; we cannot provide it without processing this data.
• Consent. Push notifications, and adding a profile photo. Both are optional, and you can withdraw either at any time, by turning notifications off in Settings or removing your photo, without affecting anything else.
• Legitimate interests. Keeping the Service secure and working, the technical and log data that comes with running it, the cookieless page-view counts on this website, and, most significantly, reviewing profile photos, acting on reports, and enforcing our Terms. Our interest here is protecting our users from harm and abuse, which we consider not to be outweighed by the privacy interest of the person being reported. This is the basis on which reports and moderation records are kept after an account is deleted.
• Legal obligation. Where we have to keep or disclose something to comply with the law.

Third-party services

We rely on a small number of third-party providers to operate the Service. We share only the information needed for each provider to perform its function.

• Supabase: our backend and database provider. Supabase stores your account, watch history, profile photo, and related data on our behalf. See the Supabase Privacy Policy.
• Amazon Web Services: automated image moderation. When you upload or import a profile photo, the image is sent to Amazon Rekognition to be checked before it is published. Only the image is sent; your account, email, and watch history are not. See the AWS Privacy Notice.
• Expo: push notifications and app updates. If you enable notifications, Expo processes your push token and the text of the notification to deliver it to your device, which for a follow notification includes the display name of the person who followed you. Expo also delivers updates to the app itself, so your device contacts them when it checks for one. See the Expo Privacy Policy.
• Vercel: hosting for this website and for the web version of the app, and the cookieless analytics on this website. See the Vercel Privacy Policy.
• Google and Apple: if you choose to sign in with Google or with Apple, that provider handles the sign-in and tells us the email address associated with your account.
• The Movie Database (TMDB): the source of our catalog metadata (titles, posters, episode lists, and similar). We query TMDB for catalog information to display in the app. This product uses the TMDB API but is not endorsed or certified by TMDB. See the TMDB Privacy Policy.

We may also disclose information if required to do so by law, or to protect the rights, safety, and property of Marothon and its users.

Where your data is processed

Marothon is operated from the United States, and our providers store and process data on servers in the United States. If you use the Service from the United Kingdom, the European Economic Area, or anywhere else with its own data-transfer rules, your information is transferred out of that region to be processed.

We rely on the data-processing terms each of those providers offers to cover those transfers. Depending on the provider that means Standard Contractual Clauses, the UK International Data Transfer Addendum, or certification under the EU-US Data Privacy Framework, alongside the technical measures described under Security. You can ask us which applies to a particular provider at privacy@marothon.com.

Data retention

We keep your account information and tracking data for as long as your account is active. When you delete your account, we delete your personal data, including your email, watch history and tracking data, follow connections, push token, preferences, and profile photo, from our systems within 30 days, except where we are required to retain certain information to comply with legal obligations or resolve disputes. Backups are purged on a rolling basis.

Some records are kept on a different schedule:

• Reports and moderation records: kept for as long as we need them to keep people safe and to enforce our Terms, with no fixed end date. Reports you filed survive your account deletion with your identity removed, as described above.
• Automated photo review records: the outcome of each check (whether a photo passed, and which category it failed on) is kept for 180 days and then deleted automatically. The image itself is not kept when it fails.
• Blocks: kept until you unblock the person, because they are what we enforce against. A block survives that person deleting their account.
• Technical and log data: held by the providers that record it, under their own retention schedules. We do not copy it into our database or keep a copy of our own, so deleting your account does not reach it.

We would rather be accurate than tidy here: we do not put a fixed expiry on safety records, because a repeat pattern is often the only way to recognise a bad actor.

How to access or delete your data

You are in control of your data. You can:

• Delete your account and data in the app. Open Settings and choose to delete your account. This removes your account and associated personal data as described above.
• Turn the social features off in Settings. Nobody can find you or ask to follow you, and your profile stops being visible to anyone new. People who already follow you keep seeing your name and photo, which is what lets them unfollow you, but nothing else. To end those connections too, remove all of your followers, which is a separate action in the same place.
• Remove your profile photo at any time, which deletes it from our storage.
• Request access or deletion by email. Contact us at privacy@marothon.com and we will help you access, export, or delete your personal information.
• Turn off notifications at any time in your device or app settings, which stops use of your push token.

Your rights (UK and EU)

If you are in the United Kingdom or the European Union, you have the rights below. They are free to exercise, and we will respond within one month. Email privacy@marothon.com for any of them. Several are also one tap in the app, as described above.

• Access: a copy of the personal data we hold about you.
• Rectification: correction of anything inaccurate. Your display name, username and photo are editable in the app.
• Erasure: deletion of your data. Deleting your account in Settings does this. The exception is reports and moderation records, which are covered under Safety and moderation and kept on the legitimate-interests basis above.
• Restriction: ask us to stop processing your data while a dispute about it is resolved.
• Portability: your data in a machine-readable format, or sent directly to another service where that is technically feasible.
• Objection: object to processing we carry out on the legitimate-interests basis, including our safety and moderation work. We will stop unless we have compelling grounds that override your interests.
• Withdraw consent: for anything we do on the consent basis (push notifications, your profile photo), at any time, without affecting what came before.

You can also complain to a regulator. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk). In the European Union it is the data protection authority for the country you live in. We would rather you came to us first, but you are not required to.

Children’s privacy

Marothon is not directed to children. You must be at least 13 to use the Service, and at least 16 if you are in the European Union, unless the country you live in has set a lower age of consent for online services, in which case that age applies, and it is never below 13. Our Terms say the same.

We do not knowingly collect personal information from anyone below the age that applies to them. We do not ask for a date of birth, so we cannot verify this. If you believe a child has an account, contact us at privacy@marothon.com and we will delete it.

Security

We use industry-standard measures to protect your information, including encryption in transit and access controls on our backend. No method of transmission or storage is completely secure, but we work to protect your data and limit access to it. The one deliberate exception is described under Information other people can see: profile photos are served from a public CDN and are not access-controlled.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of the Service after changes take effect means you accept the updated policy.

Contact us

If you have questions about this Privacy Policy or your data, email us at privacy@marothon.com. The data controller is Lukas Haselwood, Kansas, United States.