Privacy Policy
1 Introduction and who we are
Mu Movie is a movie and series streaming application offering Luganda-translated entertainment. It is developed and operated by Xerot Technologies ("Xerot Technologies", "we", "us" or "our"). Xerot Technologies decides why and how your personal information is used in connection with Mu Movie and is the data controller for it.
This Privacy Policy explains what personal information we collect when you use Mu Movie, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It describes what the Mu Movie app and its servers actually do.
2 Scope of this policy
This policy applies to the Mu Movie mobile application, the Mu Movie servers the app communicates with, and the public web pages we provide for this policy and for account deletion.
It does not cover websites or services operated by other companies, including the payment pages operated by Pesapal. Those services have their own privacy policies, which apply when you use them.
You can browse the Mu Movie catalogue without an account. An account is needed to watch, to download, to keep a My List and to subscribe. Most of the information described below is only collected once you create an account.
3 Personal information we collect: summary
Information we need in order to provide the service:
- Your name, your phone number and a password, when you create an account.
- An installation identifier generated by the app, your device model and its platform (for example Android), to apply the limit on how many devices can use one account.
- Your viewing activity: titles you open, how far you have watched, titles you save to My List, and downloads you start or complete.
- Subscription and payment records when you subscribe.
Information that is optional:
- Your email address. You may leave it blank at sign-up and add, change or remove it later.
- A push notification token, which is only registered if you allow notifications on your device.
Information we do not collect: Mu Movie does not request or access your location, contacts, camera, microphone, photos, media library, calendar or SMS messages. The app does not contain advertising, does not use an advertising identifier, and does not include third-party analytics or crash-reporting tools.
4 Account and authentication information
When you register we collect your full name, your phone number, your password and, if you choose to give it, your email address. Your phone number is the identifier you sign in with and must be unique to one account. Accounts can also be created for you by a Mu Movie administrator, in which case the same details are recorded.
Your password is stored only as a one-way cryptographic hash. We do not store it in readable form and our staff cannot view it.
When you sign in, our server issues an access token that keeps you signed in. The token is saved in the app's storage on your device and our server keeps only a hash of it. A token remains valid until you log out, the device is removed from your account, or your account is deleted.
We also record your account status (active or suspended), whether the account has been given complimentary access by an administrator, and the dates your account was created and last updated. The creation date is used to work out your free trial period.
You can view and edit your name, phone number and email address, and change your password, under Profile > Edit Profile.
5 Device identifiers and security information
Each Mu Movie account can be used on a limited number of devices. To apply that limit, the app creates a random installation identifier the first time it runs and keeps it in the secure storage of your device. This identifier is generated by the app. It is not your device's hardware serial number, IMEI or advertising ID.
When you register or sign in, the app sends this installation identifier together with your device's model name (for example "Samsung SM-A155F") and its platform. We store these against your account with the time the device was last active, and show them to you under Profile > Devices, where you can remove a device.
Our servers process your IP address when your device connects, as every internet service must. We use it briefly to limit repeated failed sign-in attempts. The application does not store your IP address in your account record. Our hosting providers may record IP addresses in standard server logs.
An administrator may suspend an account. A suspended account cannot use the signed-in features of the service.
6 Viewing activity, watch history and preferences
When you are signed in, the app reports the following to our server and we store it against your account:
- that you opened a movie's page, and when;
- your playback position in a movie, from which we record the furthest point reached, the percentage watched, whether you finished it and when you last watched it;
- the titles you add to or remove from My List;
- downloads you start, and whether each one completed, failed or was cancelled, including the file size.
We use this information to resume playback where you stopped, to show Continue Watching and My List, to calculate which titles are trending, to work out which genres you appear to enjoy so we can recommend titles and send relevant notifications, and to give our administrators statistics about how each title performs. Authorised administrators can see which accounts opened, watched, saved or downloaded a title.
Recommendations and the selection of some notifications are produced automatically from this activity. They only affect which titles are suggested to you and have no legal or similarly significant effect on you.
When you search or filter the catalogue, your search text is sent to our server to return results. The application does not keep a search history for your account.
A copy of your watch progress and My List is also kept in the app's storage on your device so they load quickly and work offline.
7 Subscription, payment and transaction information
Mu Movie subscriptions are paid for through Pesapal, a third-party payment service provider. When you choose a plan, we create a payment record and ask Pesapal to open a payment page, which is shown to you in a browser window.
To open that payment page we send Pesapal: your name, your phone number, your email address if you have provided one, the country code configured for the service, the amount and currency, a description of the plan, and a payment reference that we generate.
You enter your card, mobile money or other payment credentials on Pesapal's own page. Those credentials are processed by Pesapal and the payment networks it uses. The Mu Movie app and servers are not designed to receive or store full card numbers, card security codes or mobile money PINs.
We do receive and store information about each transaction: our payment reference, Pesapal's order tracking ID, the plan purchased with its name and duration, the amount and currency, the payment status, the type of payment method reported by Pesapal (for example a mobile money network or card brand), Pesapal's confirmation code, the time of payment and, where a payment did not succeed, the reason reported.
We also store your subscription itself: the plan, and the dates it starts and ends. This determines whether you can watch and download.
Refunds, where applicable, are handled through Pesapal and our support channel. Any correspondence you send us about a payment will be kept with our support records.
8 Push notifications and Firebase Cloud Messaging
Push notifications are optional. The app asks for your permission before enabling them and you can withdraw that permission at any time in your device's settings. If you do not allow notifications, no push token is registered with us.
If you allow notifications, the app obtains a registration token from Firebase Cloud Messaging, a service of Google, and sends it to our server. We store that token with your account, the device it belongs to, the device's platform and model name, and the time it was last seen. We stop sending to a device when you log out on it, and remove the record when the device is removed from your account or your account is deleted.
To deliver a notification we send the token and the notification's title, text and related data (such as the ID of the movie it refers to) to Google's Firebase service, which delivers it to your device. The Firebase software in the app also generates and uses its own installation identifiers to operate this service.
Notifications we may send include notices about your free trial and subscription, newly added titles, recommendations based on your viewing activity, reminders to continue something you started or saved, and occasional reminders if you have not used the app for a while. We keep a history of the notifications sent to your account, including whether you have read them, so that the app can show them under Notifications.
9 Offline downloads and information stored on your device
Subscribers can download titles to watch offline. Downloaded video files are saved in the app's own private storage area on your device. Mu Movie does not request access to your photos, media or shared files in order to do this.
The app also stores the following on your device:
- your access token and a copy of your basic profile (name, phone number, email address, account status) so you stay signed in;
- the installation identifier described in section 5, in the device's secure storage;
- your watch progress, your My List, the list of your downloads and the last known state of your subscription;
- whether you declined notification permission, so the app does not keep asking.
Logging out removes your access token from the device. Downloaded files and other locally stored information may remain on the device until you delete them in the app, delete your account from that device, or uninstall the app. Logging out or uninstalling the app does not delete your account or the information held on our servers.
10 Why we use your information and our lawful bases
We process personal data in accordance with the Data Protection and Privacy Act, 2019 of Uganda and its Regulations. We rely on the following bases.
Performance of our contract with you (providing the service you signed up for):
- creating and securing your account and keeping you signed in;
- applying the device limit and preventing misuse of accounts;
- streaming and downloading content, resuming playback, and keeping your My List;
- operating your free trial and subscription and processing your payments;
- sending service notices about your account, trial and subscription;
- responding to your support requests.
Your consent:
- collecting the information described in this policy when you choose to create an account;
- sending push notifications, which requires the permission you give on your device;
- using your viewing activity to recommend titles and to send recommendation and reminder notifications;
- holding your email address, if you choose to provide it.
You may withdraw consent at any time by turning off notifications in your device settings, removing your email address, or deleting your account. Withdrawal does not affect processing that took place before it.
Compliance with legal obligations:
- keeping payment and subscription records for tax, accounting and audit purposes;
- responding to lawful requests from courts, regulators or law enforcement.
We do not sell your personal information and we do not use it for third-party advertising.
11 Third-party service providers
We use the following providers to operate Mu Movie. Each receives only the information described.
- Pesapal (payment service provider): receives your name, phone number, email address if provided, and the payment amount, currency, description and reference, in order to take payment. Pesapal collects your payment credentials directly from you and handles them under its own privacy policy and regulatory obligations.
- Google Firebase Cloud Messaging (push notification delivery): receives your device's push registration token and the content of notifications we send you, and operates installation identifiers within the app, in order to deliver notifications.
- Backblaze B2 (video storage): stores the video files. When you play or download a title, your device connects directly to Backblaze using a short-lived link issued by our server, so Backblaze receives your device's IP address and standard technical request information. We do not store your account information in Backblaze.
- Expo Application Services (app updates): the app contacts Expo's update service to check for app updates. This sends technical information such as the app version, platform and an installation identifier generated by the update software. It does not include your account details.
- Google Play (app distribution): Google provides the app to you and handles installation and store-related data under its own policies.
- Our server hosting provider: stores the Mu Movie database and runs our servers.
12 How we share and disclose information
We share personal information only in these circumstances:
- with the service providers listed in section 11, to the extent needed for them to perform their service for us;
- with Pesapal, when you choose to make a payment;
- with authorised Xerot Technologies staff and administrators who need access to operate the service, support users and review content performance;
- where we are required to by law, a court order or a lawful request from a competent authority, or where it is necessary to establish, exercise or defend legal claims;
- with a successor organisation if the Mu Movie service is transferred, merged or sold, in which case this policy continues to apply to your information until you are told otherwise.
We do not sell personal information, and we do not share it with advertisers or data brokers.
13 Storage, security and international transfers
Your account, activity, subscription and payment records are stored in the Mu Movie database on our servers. Video content is stored with Backblaze. Notification delivery passes through Google's systems.
We apply measures intended to protect your information, including: encrypted connections (HTTPS/TLS) between the published app and our servers and providers; storing passwords and access tokens only in hashed form; limiting repeated sign-in and password attempts; limiting the number of devices per account; keeping video storage private and reachable only through expiring links; and restricting the administration panel to authenticated staff accounts.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please choose a strong password, keep it confidential, and remove devices you no longer use from your account. If we become aware of a personal data breach we will notify the Personal Data Protection Office and affected users as required by law.
Some of our providers process information outside Uganda. Google and Expo operate internationally, including in the United States; our Backblaze storage is located in the United States; and Pesapal operates in several African countries. Where personal data is processed outside Uganda, we rely on the conditions permitted by the Data Protection and Privacy Act, 2019, including your consent given by using the service after being informed by this policy, and we take reasonable steps to use providers that protect personal data adequately.
14 How long we keep information
- Account, device, viewing activity, My List, download and notification records are kept for as long as your account exists. We do not currently delete them automatically on a schedule; they are deleted when you delete your account.
- Access tokens are kept until you log out, the device is removed, or the account is deleted.
- Push notification tokens are deactivated when you log out or when Firebase reports them as no longer valid, and deleted when the device is removed or the account is deleted.
- Payment and subscription records are kept after account deletion for as long as tax, accounting and audit law requires. After deletion they are no longer linked to your name, phone number or email address in our database.
- Server and application logs, which can contain internal account and payment reference numbers, are kept for a limited period for security and troubleshooting.
- Backups, if any, are overwritten on their normal cycle.
15 Deleting your account
You can delete your Mu Movie account at any time. Logging out or uninstalling the app does not delete your account.
- In the app: open Profile > Delete Account, enter your password and confirm.
- On the web: open the Mu Movie account-deletion page (linked from the web version of this policy and from our Google Play listing), enter your phone number and password and confirm. You do not need the app installed.
- If you cannot sign in, contact us using the details in section 20 and we will verify that the account is yours before deleting it.
Deletion takes effect immediately and cannot be undone. When an account is deleted we permanently delete: your name, phone number, email address and password; all access tokens, which signs every device out; your registered devices and push notification tokens; your notification history and notification settings; your My List; your watch progress and viewing activity; and your download records. Your phone number becomes available to register again.
We keep: the records of payments you made and the subscription they paid for (plan, amount, currency, status, payment method type, dates and payment references), because we are required to keep financial records. These records stay attached to an internal account number that no longer carries your name, phone number or email address. Pesapal keeps its own records of your payments under its own policy. Entries already written to server logs or backups are not edited and expire as described in section 14.
Deleting your account ends your access, including any remaining subscription time, which cannot be restored. Downloads on the device you delete from are removed; copies on other devices can no longer be authorised and are removed when you uninstall the app from them.
16 Your privacy rights
Subject to the Data Protection and Privacy Act, 2019, you have the right to:
- be informed about how your personal data is collected and used, which is the purpose of this policy;
- access the personal data we hold about you and obtain a copy;
- have inaccurate, incomplete or out-of-date personal data corrected, which you can largely do yourself under Profile > Edit Profile;
- have your personal data deleted, which you can do yourself as described in section 15;
- object to, or ask us to stop or restrict, processing that is causing or is likely to cause you unwarranted damage or distress;
- prevent the use of your personal data for direct marketing;
- withdraw consent you have given, including by turning off push notifications in your device settings;
- not be subject to a decision with legal or similarly significant effect based solely on automated processing; Mu Movie makes no such decisions;
- complain to us, and to the Personal Data Protection Office of Uganda, if you believe your personal data has been misused.
To exercise a right that you cannot exercise in the app, contact us using the details in section 20. We will need to verify that the request comes from the account holder, and we will respond within the period required by law.
17 Children's privacy
Mu Movie accounts are intended for adults aged 18 and over. The app is not directed at children, and we do not knowingly collect personal data from a child without the consent of a parent or guardian. The app does not currently verify age at registration.
If you are a parent or guardian and believe a child has created an account or given us personal data, contact us using the details in section 20 and we will delete the account and its data.
18 Cookies and similar technologies
The Mu Movie app does not use cookies and contains no advertising or tracking technologies. It uses storage on your device, as described in section 9, to keep you signed in and to make the app work offline.
Our web pages for this policy and for account deletion set only the essential cookies needed to keep the page secure, such as a session cookie and a cookie that protects forms against forgery. They are not used to track you. Pesapal's payment pages may use cookies under Pesapal's own policy.
19 Changes to this policy
We may update this policy when the service or the law changes. The current version, with its version number and effective date, is always available in the app under Profile > Legal & Support > Privacy Policy and on our public policy page. If we make a significant change to how we use your personal data we will tell you in the app or by notification before the change takes effect.
20 Contact us and complaints
For questions about this policy, to exercise your rights, or to make a privacy complaint, contact Xerot Technologies:
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Office of Uganda, the independent office established under the Data Protection and Privacy Act, 2019.