PLAVIO / LEGAL

Privacy Policy

App policy last updated: October 19, 2026. Website disclosure updated: October 21, 2026.

Plavio ("the app") is an Android media player. Many features work without an account, but the app is not wholly offline or strictly local-only: it contacts addon, metadata, integration, update and other service providers. Optional account sync and telemetry are separate features described below.

Data stored on your device

The app stores settings, installed addon details and URLs, watchlist and playback records, caches, and integration configuration on the device. Depending on what you enter or configure, app-private preferences can include API keys and service credentials. These values are not automatically sent to Plavio's operator simply by being stored, but the app may send them to the relevant provider when using that integration.

Supported integration keys and cloud-session tokens use Android Keystore-backed local storage. Automatic Android backup is disabled in this build, with backup and data-extraction exclusions also packaged. Ordinary portable snapshots exclude supported integration secrets and strip potentially credential-bearing addon URL components; protected addon configurations remain disabled after an ordinary restore until their encrypted configuration is unlocked. Downloaded media and download records are not portable snapshot content. Uninstalling removes local app data but does not itself erase server-side accounts, backups or copies someone previously exported.

Optional Plavio Cloud account and sync

You can create or sign in to an account using an email address and password. Authentication and cloud operations use a Supabase project. After sign-in the app attempts a profile restore and can automatically back up while signed in; there is no separate per-backup confirmation. The versioned ordinary snapshot includes watchlist entries, Continue Watching titles and positions, addon metadata with protected URL components removed, custom lists and membership, and portable settings. This ordinary library metadata is not end-to-end encrypted by the separate credential feature.

You can separately opt in to passphrase-protected, end-to-end encrypted sync of supported integration keys and full configured addon URLs, including credentials embedded in paths, queries or user information. The credential envelope uses authenticated encryption and is bound to the account and profile. The sync payload contains ciphertext, not the passphrase or the plaintext private configuration. A new device needs the same passphrase to unlock it after restoring the profile; losing that passphrase prevents recovery of the encrypted configuration. This protection does not hide ordinary library metadata, network connection metadata, or the credentials sent to their intended addon/integration provider when a feature is used. It does not include downloaded files, device permissions or portable cloud-login sessions.

Profile switching stages a local recovery snapshot and replaces portable library/settings data before committing the active profile. Profiles are not a device-security or parental-control boundary, and downloaded files remain device-local rather than profile-portable. Real multi-device conflicts and backend authorization still require verification. Signing out clears the local session and locally retained credential-sync passphrase; it does not erase the account or server-side backups. Deleting a profile attempts to delete its associated backup, but remote retention, backup and deletion behavior has not been independently verified and no fixed retention period is promised here.

Optional telemetry and diagnostics

Optional telemetry is off by default in the app. If you turn it on in Settings, the app enables Firebase Analytics and Firebase Crashlytics collection. These SDKs can process app/device information, usage or lifecycle events, and crash diagnostics. Exact fields, identifiers, processing and retention depend on the SDK and Firebase project configuration; they have not been independently verified here. You can turn the setting off again in Settings. Firebase's own policies also apply.

The source also contains optional install-statistics requests. When invoked while telemetry is enabled, the install ping sends a random persistent install UUID, app version and flavor to the PlavioHD statistics endpoint; the counter request contacts an Abacus counter service to increment/read an aggregate count. These requests necessarily disclose normal connection metadata such as IP address to those servers. The UUID is pseudonymous, not a promise of anonymity. The app source does not establish those providers' retention or deletion periods, so none is promised.

Uncaught crashes are also written to a short local crash file for the app's diagnostic UI; that local file is not itself an automatic upload. If you copy or send diagnostic text, review it first for information you do not want to share.

Addon, metadata and media requests

Plavio ships with some addons already configured, and can contact those providers without you manually adding them. Addon servers can receive your network address and request details. Catalog, search, metadata, subtitle and stream requests can disclose the relevant title or episode identifiers, search text, addon URL parameters and any request headers required by that addon. Providers have their own policies and are not controlled by Plavio. Addon URLs may contain embedded credentials; do not share such URLs publicly. Plavio's addon-share encoding now blocks URLs it detects as credential-like, but this heuristic cannot identify every secret.

The app may also contact services such as Cinemeta, TMDB, subtitle services/addons, IntroDB, YouTube through NewPipeExtractor, and update or download hosts, as features are used. Requests go to those services under their own policies. If you configure Trakt, Simkl, TorBox, Real-Debrid or another integration, information needed for that feature is sent to that provider. The app can store your supplied API keys or tokens locally; use each provider's controls and policies for account/data requests.

Website measurement

The previous website included Vercel Web Analytics scripts. This redesigned static website does not include analytics scripts, third-party fonts, or embedded media, and it does not set cookies or store visitor identifiers. The hosting provider still receives ordinary connection information when serving the site; its logging and retention practices depend on the provider and have not been independently verified here. Following external links or downloading the app can contact GitHub, GitLab, addon operators, or other linked providers under their own policies.

Children

Plavio is not designed for children under 13. Accounts require an email address; guardians should supervise use of accounts and third-party services. This statement does not change the privacy practices of service providers used by the app.

Changes

If this policy changes, the updated version will be posted on this page with a new "last updated" date.

Contact

Questions about this policy: open an issue at github.com/kotlinsyd/Plavio or reach out on Discord.