A film catalog can be wrong in small ways: a synopsis, a director credit, a genre label. WhatNext.'s catalog goes through audit passes, but an audit works in bulk. The person most likely to spot a wrong detail on a film is the one looking at it.
So I built a way for you to tell me. It's live now in WhatNext. 1.2.0 on iPhone, so if you don't see it, update the app.
What the Button Does
Expand a film's description in the feed, the Library, or Search and you'll find a small Report link underneath. Tap it and a sheet asks what's wrong.
The rows are the synopsis, the director, the genre, the series or franchise, and something else. The synopsis asks a follow-up, because "wrong" covers a few different failures: it's incorrect, it contains spoilers, it's in the wrong language, or it's something else. Genre lets you pick one label from a fixed list. Something else takes a short note, capped at 200 characters.
The first version was narrower: report a wrong synopsis. I widened it to a field picker after the question came up of what other metadata could be wrong.
Genre has its own quirk. A film carries around five tags in the catalog, but only the primary genre tag is shown on the card. A genre report only covers the genre you can actually see on screen, rather than asking you to judge tags you never saw.
You can flag different issues on the same film, such as reporting a spoiler in the synopsis while also adding a note under Something else, but the sheet prevents submitting duplicate reports for the same issue twice.
The Part I Cared About Most
A feedback feature can easily become a tracking feature. WhatNext. is designed so your ratings, watchlist, and taste profile stay strictly on your phone, and the report button had to respect that.
Nothing leaves your device unless you explicitly tap a reason or Send. There is no background telemetry, no usage analytics, and no startup ping. If you submit a report while offline, it queues locally on your device and sends only once you are back online.
When a report does go out, it carries only what is needed to verify the mistake: the film's permanent ID, which field is wrong and why, your optional note, the app version, your platform and language, the catalog data version you were viewing, and a short fingerprint of the text that appeared on screen. That fingerprint matters because catalog entries get updated over time, and I need to know whether you were flagging the previous wording or a recent revision. It also includes an anonymous, random install ID created only when you send your first report, which prevents repeat spam from a single device. Notes are also automatically scrubbed of email addresses and phone numbers on arrival.
On the server side, reports are received by an isolated endpoint backed by a database. Submissions are deduplicated and rate-limited, with daily caps per device, per network address, and overall, plus a short-burst limit to stop automated spam. The random install ID and network address are only stored as salted hashes in temporary daily counters, and those counters are deleted after about three days. No raw IP address or device identifier is ever stored. Individual reports are purged automatically after 12 months. The host infrastructure processes incoming network connections during delivery the way any web service does, but nothing beyond that is retained.
One crucial decision was about what to switch off. Persisted request logs on the server are disabled entirely. Standard server logs typically record incoming IP addresses, approximate locations, and network fingerprints for days or weeks. Keeping those logs active would undermine the point of hashing abuse counters, so request logging stays completely turned off.
Reports are not applied to the catalog automatically. A report is a tip, not a direct edit. A human or an audit pass verifies each claim against authoritative film sources before anything in the catalog changes.
What Actually Changed in the Privacy Policy
Until this release, WhatNext. had no server receiving user data of any kind. The answer to "can you delete my data?" was simple: there was no server-side data to delete.
Adding a voluntary reporting tool required an update to document how that feedback is handled. To be completely clear, WhatNext. still does not track you, does not require an account, and never sends your ratings, watchlist, or taste profile anywhere. Those remain 100% on your device.
What the updated privacy policy specifies is how problem reports are handled:
- Reports are strictly voluntary: nothing is transmitted unless you explicitly tap a reason or Send.
- Reports are anonymous: the random install ID is generated locally on your first report and is not linked to your name, Apple account, or device serial number. Because reports are not tied to personal identities, they cannot be queried or deleted on behalf of an individual user.
- Data retention is strictly bounded: temporary abuse counters are deleted after three days, and the reports themselves are permanently deleted after 12 months.
A Better Catalog Without the Tracking
Fixing a wrong synopsis or correcting a genre does not require an account, an IP address log, or a user profile. It definitely does not require knowing who you are or what movies you watch on Friday nights.
A film catalog should get better over time, and the people watching the movies are always going to catch the mistakes an automated audit misses. By designing the report button around short-lived hashes, disabled server logs, and zero tracking, the catalog gets cleaner without compromising the local-first architecture WhatNext. was built on.
If you ever spot something wrong in a film's record, tap Report and let me know.