Privacy policy

This policy explains what the Omnio TV app and the omnio.tv website collect, why, where it is kept, which other services are involved, and how you can delete it. We have tried to write it in plain words. If anything is unclear, write to us at privacy@omnio.tv.

The short version

• You can use Omnio TV without an account. Then your profiles, lists and settings stay on your device.
• If you create an account, we keep your profiles, watchlist, watch progress, add-on files, custom home rows, settings and the list of your devices online, so they follow you to every device you sign in on. From Omnio TV 0.1.50, Stremio add-on links you add are kept on your account too, encrypted.
• Debrid keys you save to your account are stored encrypted on our server and are only ever given back to you.
• When the app crashes, freezes or can't play a video, it sends a cleaned report to our own crash service, which runs on Cloudflare. The report is not linked to your account, and you can switch reports off in Settings. Versions 0.1.42 and older send crash reports to Firebase Crashlytics instead.
• A few other services handle data so the app can work. Section 6 lists each one.
• No ads. We don't sell your data. The website has no cookies, analytics or trackers.
• You can delete your account and everything saved with it at any time, in the app or on the web.

1. Who we are

The app and this website are run by Omnio TV ("we", "us"). We decide what happens with the data described here, which makes us its controller under data protection law such as the EU General Data Protection Regulation (GDPR).

Contact: privacy@omnio.tv

We will add the company's full details, including its postal address, to this section before Omnio TV is offered in an app store.

2. What we collect and why

Your account

An account is optional. If you create one, we keep:

• Your email address, to sign you in and to send the emails an account needs (confirming your address, the codes for "Forgot password" and for changing your email address, the code for "Forgot PIN?", and a note when your password or email address was changed). Codes and confirmation links work for 10 minutes.
• Your account name, if you give one.
• Your password, which our sign-in service stores only as a one-way hash. Nobody, including us, can read it.
• Sign-in records, such as when you signed in or out and from which IP address, which our sign-in service writes to its own service logs to protect accounts against misuse. When you sign in a TV with a code, the address recorded is the TV's own, the same as when you sign in on a phone. While a device stays signed in, the sign-in service also keeps that device's IP address and browser or app name with its session in our database; signing out on that device, or deleting your account, removes them.
• "Forgot PIN?" by email: instead of asking for your password, the app can email a code to your address. We keep when the last code was sent and how many tries are left, to stop misuse.

What your account keeps in sync

• Profiles: each profile's name and picture choice and, if you lock a profile with a PIN, a one-way hash of the PIN (never the digits).
• Watchlist: the films and shows each profile saved.
• Watch progress: for each profile's 30 most recent titles, which title and episode it was, how far in you got, how long it is, and when you watched it. This is what fills Continue Watching.
• Title names: with each title the app adds to a watchlist or to Continue Watching, the title's name (up to 100 characters), its year and the file name of its poster at TMDB, as the app showed them, so the account page can show the title. They are kept in a separate list on your account. Titles from your own media servers are never saved with a name or poster.
• Add-ons: the addresses of the add-on files you added. An add-on's address can include settings you chose for that add-on. From Omnio TV 0.1.50, also the Stremio add-on links you add, in the app or on the account page: each link is encrypted on our server with a key kept only there, and is sent only to your own devices. With each link we keep its website's name, a fingerprint of the link (a one-way hash, which can't be turned back into the link), and the add-on's name and whether it worked, as one of your devices reports them. We also keep the order of your add-ons. The account page shows only the website, the name and whether it worked, never the link.
• Custom home rows: the rows set up for your account's home screen.
• Settings: your app settings, such as filters, player, subtitles, languages and region, which of your debrid services are switched on or off, and which add-ons are switched off. Each one can be set for all your devices or for one device, and some can be set for each profile. For each setting, we keep when it was last changed and which of your devices changed it (empty when it was changed on the website). Which of your tracker lists you hid from Home is kept as those lists' ids. Settings hold no keys and no passwords.
• Your devices: for each device that keeps your settings in sync, a name you can change (at first its kind and model, for example "TV · SHIELD Android TV"), its kind (TV, phone or Fire TV), the app version, when it was added, the last day it was used, and a random number the app makes for it. That number is not taken from your device's hardware, and it changes if you reinstall the app or sign in with another account.
• Debrid keys you add (see section 3). Add-ons and debrid keys need an account.
• Your own media servers, only if you tick "Sync to account" for one: its address, the id the server gives itself, your user name on it and its password. The password is locked with our own key and given back only to your signed-in devices. It stays until you untick the box, remove the server, delete the profile it belongs to or delete your account.

We use this only to give you these features on every device you sign in on. We don't look through it, and we don't use it to build a profile of you.

Why we are allowed to

• Keeping your account and its data is needed to provide the service you asked for (GDPR Art. 6(1)(b)).
• Sign-in records and crash reports serve our legitimate interest in keeping the service secure and fixing faults (Art. 6(1)(f)). You can object to this; see section 11.
• When you write to us, we use your message and address to answer you.

3. Debrid keys

A debrid key lets Omnio TV use your account at your debrid service. If you save one to your Omnio account:

• The app sends it to our server over an encrypted connection.
• Our server encrypts it with AES-GCM before it is saved, so the database only ever holds the encrypted form. The encryption key is a server secret that is kept apart from the database.
• The table that holds the keys can't be read by the app or by anyone signing in. Only our key service can reach it.
• The key is decrypted only to return it to you, when you are signed in to your own account. It is never given to anyone else, and we don't use it for anything else.
• Your device holds the key only in memory while the app is running, and drops it when you sign out.

4. Crash reports

From version 0.1.43, when you leave "Send crash reports" on (Settings → About), the app sends a report to our own crash service at crash.omnio.tv when it crashes, freezes or a video fails to play, so that we can find and fix the fault. The service runs on Cloudflare, which stores the reports for us. Only we can read them, through a sign-in that only our administrator has.

A report holds what went wrong in the app's code and where, when it happened, the app version and whether it is the download or the Play version, your device's make and model, its processor type, whether it is an emulator, its Android version, short notes of the app's last steps (such as its start-up steps), and a random number that is not linked to your account. For a video that fails to play, it also holds the player screen, the stage of playback, the playback position, the kind of link (such as https) and the kind of file (such as .mkv). We use the random number only to count devices per day. The app does not put the name of what you watch in a report.

Before a report leaves your device, the app removes email addresses, IP addresses, everything after the server name in a link, the server names in links and dotted server names in quotes (except our own, and quoted names written like names in program code, such as "java.lang.String"), other server names written in lower case with a common ending (such as .com or .lan), file and folder paths on the device's storage and links to files on it, the app's own install folder in the code positions of a report, device-style id numbers, and keys and passwords. Our crash service removes all of them again before it keeps a report (all but the server names outside links and quotes, which only the app removes). Cloudflare sees your IP address when a report arrives, as any network provider does; our service doesn't keep it.

A device sends at most 10 reports a day. When you turn the switch off, the reports waiting on your device are deleted and no new ones are made; a report that was already being sent at that moment may still arrive. When you turn it on again, reports carry a new random number. After you turn the switch back on, or after you update the app, the app may report the last time it froze or crashed while the switch was off or before the update, as Android keeps a record of that for a while. Versions 0.1.42 and older send crash reports to Firebase Crashlytics, a service from Google, with the technical details of the crash, the app version, your device model and Android version, and a random identifier that Crashlytics creates for that installation. How long reports are kept is in section 9.

5. What stays on your device

Some things never leave your device and never reach us:

• Your sign-ins to Trakt and Simkl (and to WeTrakr and MDBList, once the app offers them; it doesn't yet), and whether a sign-in is used for all profiles. The sign-ins are stored encrypted on the device.
• Your sign-ins to your own media servers that you don't sync to your account, and your Plex sign-in. They are stored encrypted on the device.
• Stremio add-on links on an Omnio TV older than 0.1.50, or added there before you update it: they are stored encrypted on that device only. When you sign out, the app asks whether to remove them from the device or keep them for when you sign in there again. If your sign-in simply expires, they are kept. From 0.1.50 the app keeps them on your account (section 2) and a copy, encrypted, on the device.
• Choices that belong to one device: whether it sends crash reports and gets beta updates, that you accepted the add-on notice there, which profile is watching, the wait after wrong PIN tries, and whether you answered the "Connect a debrid service" screen.
• What the app keeps to work quickly, such as recent progress for Continue Watching and the link you last played for a title, so you can pick up where you left off.
• Without an account: your profiles, watchlist, progress and settings stay on the device too.

To remove them, sign out of each service in the app, clear the app's data in Android settings, or uninstall the app.

6. Who else handles your data

Each service below sees your IP address and what the app asks it for, and has its own privacy policy.

• Supabase (our database and sign-in service, in its West EU region in Ireland): your account and what it keeps in sync, only on our behalf.
• Resend (our email service): your email address and the emails it sends you from no-reply@omnio.tv.
• Firebase Crashlytics (Google): crash reports from app versions 0.1.42 and older (section 4).
• Vercel: hosts this website and lists.omnio.tv, where the app gets the lists on its home screen.
• Cloudflare (our domain's network and a backup route to our sign-in and sync service). Only when your network blocks our backend's own address, the app and our web pages send your sign-in, sync, debrid keys and account requests through Cloudflare on api.omnio.tv. The account page also always asks our title service on api.omnio.tv for the names of titles (section 7). The connection to Cloudflare and from Cloudflare to our backend is encrypted; Cloudflare decrypts the requests at its edge to pass them on, and keeps no copy of their contents for us. It sees your IP address, as any network provider does. Cloudflare also runs our crash-report service and stores its reports for us (section 4).
• TMDB (The Movie Database): the titles you open and what you search for, to show titles, descriptions and artwork. On the account page, your browser loads posters straight from TMDB, so TMDB sees your IP address and which posters are shown. Our title service asks TMDB only for titles by their TMDB numbers (section 7).
• Cinemeta, IntroDB and a public status page (v3-cinemeta.strem.io, api.introdb.app, status.stremio-status.com): which title or debrid service the app asks about, for episode lists, intro skip times and service problems.
• OpenSubtitles (directly or through opensubtitles-v3.strem.io): the title, episode and language of the subtitles you look for.
• YouTube (Google): the app uses YouTube API Services to play trailers inside the app, through YouTube's embedded player. When a trailer plays, YouTube receives what its player normally receives, such as your IP address, details about your device, which trailer it is, and cookies or similar data that the player keeps on your device. If a trailer opens in the YouTube app or your browser instead, YouTube receives the same. YouTube uses this under Google's Privacy Policy and the YouTube Terms of Service; by using trailers in the app you agree to those terms (see our terms of use). To avoid this, don't press Trailer. Trailer previews that start on their own are off unless you switch them on; if you do, YouTube receives the same as soon as a preview loads. Clearing the app's data removes what the player kept on your device.
• Your add-ons: the title you are looking for and the settings in the add-on's address.
• Your debrid service: your debrid key and the links you choose to play.
• Trakt and Simkl, only once you link one: what you watch and how far you got, and your lists and history are read back. WeTrakr and MDBList are not available in the app yet; the same will apply to them when they are.
• Plex, only if you choose to link a Plex account in the app: to link, the app asks plex.tv for a code, which you enter at plex.tv/link, and then gets your Plex sign-in. After that, it asks plex.tv for your account's name and its list of Plex servers (yours and ones shared with you). It asks those servers for their libraries and searches the film and show ones by the names of the title you look for. When you play the title, the app may play a copy from one of those servers: the one you pick under Sources, or the one the app picks for you, as copies on your own media servers, Plex included, are usually tried first. Before playing a copy, the app asks its server whether this device may play it, also for a copy it then doesn't play. The app reaches your servers at the addresses plex.tv lists for them, which may be Plex's own plex.direct addresses. While a copy plays, the app tells its server where you are in it, so the server keeps your place, and marks it watched on the server when you stop at 90 % or later. With its requests, the app tells plex.tv and the servers its name (Omnio TV) and version, your device's model and Android version, and a random number the app makes for this install, which is not taken from your device's hardware. Your Plex sign-in stays on the device (section 5) and never reaches us. Plex handles what reaches plex.tv under Plex's privacy policy. The requests to a server go to that server: your own, or, for a server shared with you, its owner's, which then has what you play on it and how far you got. Linking Plex is not available in the app yet; the same will apply when it is.

Some of these, such as Google, Resend, Vercel, Cloudflare and Plex, may process data outside the European Economic Area, for example in the United States; those transfers rely on the safeguards in each provider's data protection terms, such as the European Commission's standard contractual clauses.

7. This website

omnio.tv uses no cookies, no analytics, no ads and no trackers. Its pages load nothing from other websites, except the posters on the account page, which come from TMDB (see below). Our host, Vercel, sees your IP address and the pages you request, as every web host does.

The delete account page and the TV sign-in page talk only to our sign-in service: Supabase, or, only when your network blocks it, the same service through our backup route on Cloudflare (api.omnio.tv). Your sign-in there is kept only in the page's memory and is gone when you leave or close the page. Nothing is saved in your browser.

On the account page you can change your account name, email address and password, reset a forgotten password with a code we email you, and sign out there or on all your devices. You can also add, rename and delete profiles and set their pictures and PINs, add, remove, reorder and switch off add-ons (a Stremio link is sent once and never shown again, only its website and name), set the Kids profile's age group, save, replace and remove debrid keys, give a synced media server a new password or remove it, remove titles from a profile's watchlist and Continue Watching, rename and remove devices, and change your settings for all devices or for one device. Debrid keys, server passwords and Stremio add-on links can only be saved there; the page never shows them. For your account, the page talks only to Supabase, our database and sign-in service, or, only when your network blocks it, the same service through our backup route on Cloudflare (api.omnio.tv). Your sign-in there is kept only in the page's memory. It ends when you reload, leave or close the page, and after 30 minutes without activity. Nothing is saved in your browser.

The account page shows the titles on your watchlists and in Continue Watching by name and poster. For a title saved without a name or poster, it asks our title service on Cloudflare (api.omnio.tv) to look it up. The title service answers only signed-in users, and only for titles on their own account. It asks TMDB with our own TMDB key and sends TMDB only the title's TMDB number, never your account, your email address or your IP address. It keeps the public name, year and poster it gets back for up to a week, with nothing about who asked, and doesn't save them to your account. To limit how many lookups one account can make, the title service counts them under your account's id for about a minute, in its own memory and in Cloudflare's rate limiter. The id can stay in that memory until the title service's next lookup, or until Cloudflare closes that copy of the service. It doesn't save or log the id anywhere else.

Posters on the account page are loaded by your browser straight from TMDB's image server (image.tmdb.org), not through us. So TMDB sees your IP address, your browser and which posters are shown, which tells it which titles are on your lists. It doesn't learn your account or your email address.

8. No ads, no selling

Omnio TV shows no ads. We don't sell or rent your data, we don't use it for advertising, and we don't share it with anyone except the services named in this policy, which act on our behalf or which you choose to connect, or when the law requires us to.

9. How long we keep it

• Your account and what it keeps in sync: for as long as you have the account. When you delete it, it is removed from our database at once.
• Settings and devices: until you change or remove them, or delete your account. When you remove a device, its own settings are deleted at once. Removing a device does not sign it out: if it is still in use, it shows up again as a new device. When you delete a profile, its settings are deleted at once. When you reset a setting, we keep only a note that it was reset, and when. A count of your settings changes in the current hour, kept to stop misuse, stays until you delete your account.
• Title names: until the title is on none of your profiles' watchlists or Continue Watching, then removed within a day, and at once when you delete your account.
• Backups: copies may stay in our database provider's backups for a limited period set by the provider, until they are overwritten.
• Crash reports: 90 days, then they are deleted automatically by a daily clean-up; Cloudflare's database restore history can hold deleted reports for up to 7 more days. Reports that versions 0.1.42 and older sent to Firebase Crashlytics: for a limited period set by Google, then Crashlytics deletes them.
• Sign-in records (when you signed in, signed out or stayed signed in, and from which IP address): our sign-in service, Supabase, keeps these in its own service logs for a short period that Supabase sets. Our daily clean-up and account deletion don't reach these logs; the records expire on their own.
• Which sign-ins a TV got with a code (when, for which account, and whether the TV received the sign-in or it was cancelled; no IP address): 90 days, then they are deleted automatically by a daily clean-up, and at once with your account.
• Signed-in devices: each device's IP address and browser or app name, kept with its session for as long as that device stays signed in. Signing out on that device, or deleting your account, removes them.
• Misuse protection (counts of "Forgot PIN?" emails and of TV sign-in codes, and codes that have expired; IP addresses only as a scrambled form, never the address itself): deleted a day after they stop counting, and with your account.
• Website and list requests: our host, Vercel, keeps its request logs for a limited period set by Vercel.
• When the backup route is used, our sign-in records show Cloudflare's address instead of yours. Cloudflare keeps request counts for us, and, when its abuse brake, or our crash service's filter, stops a request (on any of our web addresses), a security record of that request (your IP address, the time, and the web address called, with no request contents); Cloudflare keeps these for 31 days. It keeps no other request logs for us.
• Emails you send us: as long as needed to answer you and to show that we did.

10. Deleting your account

You can delete your account and everything saved with it whenever you like:

• In the app (version 0.1.2 and later): Settings → Your account → Delete account.
• On the web: go to omnio.tv/delete-account, sign in, and delete.
• By email: write to privacy@omnio.tv from your account's email address.

For your safety, you need to have signed in within the last 10 minutes to delete. Deleting removes your account, your profiles, watchlists, watch progress, saved title names, add-ons, custom home rows, synced settings, your list of devices, saved debrid keys, synced media servers, "Forgot PIN?" records, the record of which sign-ins a TV got with a code, and your devices' sessions, at once and for good. It can't be undone. Deleting doesn't reach the sign-in records in our sign-in service's logs, which include your email address and also note the deletion itself; they expire on their own after the short period in section 9.

It doesn't close your accounts at your debrid service, trackers or add-ons; close those with each service. Your Stremio add-on links on our server go with your account. When you delete in the app, it also removes the account's Stremio add-on links from that device. To clear what is saved on any other device, clear the app's data or uninstall it. Crash reports aren't linked to your account and are deleted after 90 days.

11. Your rights

You have the right to:

• get a copy of the data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• limit how we use it, or object to how we use it;
• get the data you gave us in a common, machine-readable format;
• withdraw any consent you gave, at any time.

Write to privacy@omnio.tv and we will answer within one month. We may ask you to confirm that the account is yours first. You can also complain to the data protection authority in the country where you live or work.

12. How we protect it

• The app and this website only use encrypted connections (HTTPS).
• Our database checks every request, so an account can reach only its own data.
• Debrid keys and Stremio add-on links are encrypted on our server, and tracker sign-ins are encrypted on your device.
• Error messages and crash reports are cleaned of keys, tokens and other personal details before they are sent, and crash reports are cleaned again before our crash service keeps them.

13. Children

You must be at least 16 years old to create an Omnio TV account. A Kids profile is a profile inside an account, set up by the account holder. We don't knowingly collect data from anyone under 16. If you believe someone under 16 has created an account, write to us and we will delete it.

14. Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change matters for how we use your data, we will also tell you before it takes effect, for example in the app or by email.

Effective date: 6 November 2026.