Privacy Policy

Cinaura is a privacy-first personal serverless media library app for Android TV. It is built so that your library belongs entirely to you. There are no user accounts, no ads, no algorithmic tracking, and we never sell your data.

On Cinaura Free, your media library, your viewing history, your user profiles, and the credentials for the storage and debrid sources you connect are stored locally on your device. Your media files are never uploaded to us, and we never receive a copy of them.

Cinaura PRO includes cross-device sync, which stores an encrypted copy of part of that information on Cinaura's servers so that your devices remain consistent. What is stored, how it is protected, and the limits of that protection are described under cross-device sync below.

This policy explains the limited data that the Cinaura Android app and the Cinaura website (cinaura.tv) do process, why, and the choices you have. It applies to both the app and the website.

Cinaura is the data controller for the limited personal data described in this policy. If you have any questions or want to exercise your privacy rights, contact us at privacy@cinaura.tv.

No account required. You do not create an account or provide your name, email, or phone number to use the app.

Source credentials and tokens. When you connect a source (such as Dropbox, OneDrive, Google Drive, a debrid service, or a network share), the associated access tokens, API keys, or login details are stored locally on your device and used only to access the content you have chosen. They are not transmitted to or stored on Cinaura's own servers, except for the brief, transient pairing handoff described in the website section below.

Cross-device sync. Cross-device sync is part of Cinaura PRO. When purchasing a license, a copy of your library is encrypted on your device, then transmitted and stored on Cinaura's servers so that your devices remain consistent. That copy comprises the titles in your library, watch state and progress, profiles, collections, and app settings, stored encrypted and with titles and profiles identified only by opaque tags. A compromise of the sync store on its own cannot reveal your personal data, library or what you watch. Media files are never uploaded.

Diagnostics and analytics. The app uses Google Firebase Crashlytics and Firebase Analytics to keep the app stable and understand how features are used in aggregate. This may include crash reports and stack traces, a device model and operating-system version, a randomly generated app instance identifier, and anonymous interaction events. This data is not used to identify you personally and is not linked to your media library.

Metadata lookups. To enrich your library with posters, descriptions, and similar information, the app sends titles and related identifiers to The Movie Database (TMDb). To support the skip-intro feature it may send a show identifier (IMDb ID) to introDB. If you choose to enable Trakt integration, watch activity you generate is sent to Trakt at your request.

Device permissions. The app requests network access and, where you use local storage as a source, access to media files on the device. These permissions are used solely to scan and play the content you point the app at.

The website at cinaura.tv acts as a pairing bridge so that the TV app can complete sign-in flows for the sources you connect.

Pairing and tokens. When you authenticate a source on the website, the resulting tokens or keys are held only temporarily in server memory, are tied to a short-lived pairing session that expires after about 10 minutes, and are deleted as soon as the TV app retrieves them. We do not use these tokens to access your content ourselves.

Contact form. If you message us through the contact form, we receive the email address and message you provide so we can reply. The form also has an optional order ID field. If you fill it in, we check the value against our own licence records to confirm the message comes from a PRO customer, and the result is included in the email we receive. We do not create an account or a profile from it.

IP addresses. Our website and APIs count requests by IP address so that we can apply rate limits and refuse abuse. The counters are short-lived, hold a request count rather than a history of what you did, and are not used to build a profile of you or combined with anything else. Without them our public endpoints could be used to send mail or exhaust our services on someone else's behalf.

Purchases and licences. If you buy Cinaura PRO, Google Play processes the payment and we never receive your payment details. Google gives us a record of the purchase, and we store a licence record containing the Google Play order identifier, a purchase token, the product bought, the entitlement status, and the relevant dates. We also record which devices have activated the licence, to apply device limits. We hold no name, postal address or payment instrument, and PRO does not require a Cinaura account or an email address.

• To provide and operate the app and the pairing service.
• To keep the app stable, fix crashes, and improve features.
• To understand, in aggregate, how the product is used.
• To respond to your support requests and messages.

We do not use your data for advertising, we do not sell or rent personal information, and we do not build advertising profiles.

We do not sell your personal information. We share limited data only with the service providers that make the product work:

• Google Firebase (Crashlytics and Analytics) — crash and usage diagnostics for the app.
• Vercel — hosting for the website.
• Supabase — the database holding licence records and the sync store. Synced library data is encrypted on your device before it is sent.
• Upstash — short-lived request counters used for the rate limits described above.
• Resend — delivers the email sent by the contact form.
• Google Play — sells Cinaura PRO and tells us that a purchase was made, so we can enable it. Google never passes us your payment details.
• The Movie Database (TMDb) and introDB — media metadata and intro timestamps.
• The sources you connect (e.g. Dropbox, Microsoft OneDrive, Google Drive, Real-Debrid, TorBox, AllDebrid, Premiumize) and Trakt, if you enable it — used only at your direction to access content or sync activity.

Each of these providers handles data under their own privacy policies. We may also disclose information if required by law.

Pairing tokens on the website are deleted after the TV app retrieves them, or when the pairing session expires (about 10 minutes). Rate-limit counters expire on their own within hours. Contact-form messages are kept in our mailbox for as long as we need them to handle your request. Synced data is kept for as long as sync is in use for your household, so that a device returning after months away still finds its setup. Licence records are kept for as long as the licence exists, because they are what proves you bought PRO, and afterwards for as long as we need them for accounting and fraud purposes. Diagnostic and analytics data is retained by our providers for their standard retention periods. Data stored on your device — your library, profiles, and source credentials — remains until you delete it, disconnect the source, or uninstall the app.

We use reasonable technical measures to protect data, including encrypted transport (HTTPS) for network communication and short-lived, in-memory handling of pairing tokens. No method of transmission or storage is completely secure, but we work to minimise the data we hold in the first place.

Cinaura is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

Depending on where you live, you may have rights over your personal data. We honour these rights regardless of your location.

If you are in the EU, EEA, or UK (GDPR): you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. Our legal basis for the limited processing described here is our legitimate interest in operating, securing and improving the product; for the contact form, taking steps at your request; and for licence records, performance of the contract you enter into when you buy Cinaura PRO.

If you are in California (CCPA/CPRA): you have the right to know what personal information we collect, to request its deletion, and to non-discrimination for exercising your rights. We do not sell or share your personal information as those terms are defined under California law.

To exercise any of these rights, email us at privacy@cinaura.tv. You may also uninstall the app at any time, which removes the data stored on your device.

Our service providers may process data in countries other than your own, including the United States and the European Union. Where required, these transfers rely on appropriate safeguards such as standard contractual clauses.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be reflected on this page.

For any privacy question or request, email privacy@cinaura.tv or use our contact form.