Your privacy at Cinve.

In brief

• You do not need an account or have to provide personal data to check public movie listings, showtimes, and prices.
• If you connect your cinema account, your password is used once to sign in and is not stored. We only store the session the cinema gives you, encrypted.
• We do not sell data or show ads, and this website does not load analytics or resources from other sites.
• You can disconnect your account at any time, and expired data is deleted automatically.

Queries without an account

Your assistant can look up cities, locations, movies, showtimes, and public prices or concessions without connecting an account. To answer, Cinve reads the cinema website from its own server and may reuse those public responses, which are the same for everyone, for a few minutes.

Cinve does not have its own user accounts or store the content of your queries. Your assistant’s privacy policy governs what you ask it and what it does with the responses.

If you connect your cinema account

Some Cinex and Cines Unidos queries (prices and seats) require your cinema account; it is optional for Supercines. You enter your email and password only on Cinve’s authorization page or through a private link, never in chat.

• Your password is sent once over HTTPS to the cinema you chose so it can sign you in. Cinve does not store it.
• The cinema session (the cookies or token the cinema provides when you sign in) is stored encrypted with AES-256-GCM and tied to your assistant connection and that cinema. It expires when the cinema session expires: after at most one day for Cinex and Supercines, or when the token expires for Cines Unidos.
• Your email is not stored as such. It is only transformed into an irreversible digest and used to limit sign-in attempts.
• Cinve uses your session only to read what your account lets you see (prices, concessions, and seat maps). It does not buy tickets, reserve seats, or change your account.

Your assistant connection

Your assistant connects to Cinve with OAuth. For that, we store:

• the name and redirect addresses the assistant application declares when it registers;
• the authorization you approve, valid for up to 30 days;
• access tokens (one hour) and refresh tokens, stored only as SHA-256 digests, never in plain text.

Each authorization is a separate connection: other applications cannot see your cinema accounts.

Abuse prevention

To keep anyone from using Cinve to test passwords on cinema websites, attempts are counted by network (your IP address or IPv6 prefix) and by cinema account. These keys are stored only as HMAC-SHA256 values with a secret key, so they cannot be reversed into an address or email. They expire after at most one day, except for the marker that recognizes the owner of an account that has already connected, which lasts 30 days.

Each server also keeps one-minute request counters per network in memory. These are not stored in the database.

Cookies

This website uses only two first-party cookies, both HttpOnly and limited to the authorization page:

• cinve_approval_…: protects your approval from forged requests. It lasts 10 minutes.
• cinve_device: is created after a successful sign-in, with a new value each time, so an account owner is not blocked by other people’s attempts. It lasts 30 days.

There are no advertising, analytics, or third-party cookies.

Who data is shared with

• The cinemas. Cinve queries the websites of Cinex, Cines Unidos, Cinepic, Supercines, and Gran Cine. If you connect an account, your credentials and then your session are sent only to that account’s cinema. Each cinema’s terms and privacy policy govern how it uses them.
• Hosting. The service runs on Vercel and stores its data in a PostgreSQL database. Vercel may log technical details about each request, such as the IP address, path, and time, under its own policies.

We do not sell, rent, or share data with anyone else, and we do not use it for advertising or profiling.

How long data is kept

• Private connection links: 10 minutes.
• Pending approvals: 10 minutes. Authorization codes: 5 minutes.
• Cinema sessions: until the cinema session expires.
• Authorizations and their tokens: up to 30 days.
• Rate-limit keys: one day, or 30 days for the account-owner marker.
• Application records with no active authorizations: deleted after 90 days of inactivity.

A daily task deletes expired data, and validity is checked on every access, so expired data is never used while waiting to be removed.

How to disconnect and delete your data

• Ask your assistant to disconnect your cinema account: the disconnect_account tool deletes that session and any pending link.
• If you remove Cinve from your assistant and it revokes access, the connection and all its cinema sessions are deleted.
• If you do nothing, everything expires on the schedules above.

Disconnecting from Cinve does not sign you out of the cinema website. To do that, sign out there or change your password.

If you use Cinve on your computer

In local mode (stdio), Cinve runs on your computer and does not use the hosted service. It stores cinema sessions, not passwords, in ~/.config/cinev (or $XDG_CONFIG_HOME/cinev) with private permissions. Remove them with npm run logout.

Changes and contact

If the data the service stores changes, we will update this page and its date; the change history is on GitHub. For questions about this policy or your data, open an issue, without including passwords or personal data. If you find a security issue, report it privately.

Cinve is an independent project. For purchases, refunds, or data in your cinema account, contact the cinema directly.