Privacy Policy

1. Who is responsible

The controller under the GDPR is:

We are not required to appoint a data protection officer. For any privacy question or request, use the contact form (topic “Privacy”) or write to the address above.

2. Summary

• YAIP shows no ads and contains no analytics, advertising or tracking software. We do not sell personal data.
• Without a YAIP account, your profiles, playlists, history and favorites stay on your device. We do not receive them.
• If you sign in to YAIP Sync, we store your email address and the data you sync. Your playlist names, server addresses, usernames and passwords are end-to-end encrypted on your device with a passphrase only you know, so we cannot read them.

3. Using the apps

You can use YAIP without creating an account. The app stores the following on your device only: your profiles (name and avatar), the playlists you add (including their server address, username and password), the catalog and guide downloaded from your service, viewing progress, history, favorites, playback preferences and downloaded videos. Playlist logins are encrypted with a key held in the device's secure storage (such as the iOS Keychain or the Android Keystore) where the platform offers one. Deleting the app, or a profile or playlist in the app, removes this data from the device.

The apps contain no crash reporting, analytics or advertising SDKs. Like any app, they are downloaded from and updated by the store you use (Apple, Google, Samsung or LG), which processes data about you under its own privacy policy. If you have agreed to share crash or usage data with Apple or Google in your device settings, they may share anonymised reports with us.

4. Your TV service and TMDB

Your TV service (provider)

YAIP connects directly from your device to the service you add, to sign in, load channels, the guide, artwork and to play streams. These requests carry your IP address and the username and password you entered, as any player would. Your provider is responsible for how it handles this data under its own terms; we are not involved and do not receive it.

TMDB

When you open a movie or series, YAIP may look up additional information (description, cast, artwork, ratings) at The Movie Database (TMDB, TMDB Inc., USA). The app sends the title or the TMDB number from your provider; TMDB also receives your IP address. No account or identifier of yours is sent. See TMDB's privacy policy. Legal basis: our legitimate interest in showing complete and accurate details (Art. 6(1)(f) GDPR).

5. YAIP Sync (account)

YAIP Sync is optional. It keeps your YAIP data in step across your devices. To use it you sign in with your email address and a one-time code we email to you.

When you use Sync, we process:

• Account data: your email address, when the account was created and last signed in, and technical session data (access tokens).
• Encrypted playlists: playlist names, server addresses, usernames and passwords, encrypted on your device with AES-256-GCM using a key derived from your sync passphrase. The passphrase never leaves your device, so we cannot decrypt this data. We also store a keyed fingerprint so that the same playlist added on two devices is merged without revealing it.
• Synced activity: profile names and avatars, viewing progress, history and favorites (as references to the item in your provider's catalog), playback preferences and the active playlist.

Legal basis: providing the Sync service you asked for (Art. 6(1)(b) GDPR). The sign-in emails are sent through our email delivery provider (Resend, operated by Plus Five Five, Inc., USA). Account and synced data are stored in a database on our own server in Germany, which runs the open-source Supabase software and is hosted by Contabo GmbH, Aschauer Straße 32a, 81549 München, Germany.

You can erase all synced data at any time with Sync → Erase and start over, or delete the whole account as described on Delete your account.

6. The YAIP web app

The web app at app.yaip.duckdns.org works only with an existing YAIP account. It stores your data in your browser (IndexedDB and local storage) and erases it when you sign out.

Browsers block many TV services from being reached directly by a web page. In that case the web app sends the request through our relay server, which forwards it to your provider and passes the answer back. The relay does not store the requests, streams or your provider's login, and it is only available to signed-in users. To check that, it sets one strictly necessary session cookie after sign-in. We use no other cookies. Legal basis: providing the web app (Art. 6(1)(b) GDPR; § 25(2) no. 2 TDDDG for the cookie).

7. This website

When you visit this website, the web server processes the data your browser sends automatically: IP address, date and time, the page requested, the referring page and your browser's user agent. We use this only to deliver the website and keep it secure, and server logs are deleted after at most 14 days. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

This website uses no cookies, no analytics and no third-party content. Fonts are served from our own server. The website and the web app are hosted by Contabo GmbH, Aschauer Straße 32a, 81549 München, Germany.

8. Contact form and emails

The contact form sends your name, email address, topic and message to a function on our server, which forwards them to us by email through our email delivery provider (Resend, operated by Plus Five Five, Inc., USA). The account deletion form sends the account's email address and your note the same way; to handle it we look up whether a YAIP account with that address exists. The forms are not stored in a database. Your IP address is used briefly to limit how many forms can be sent in a short time, and is not stored.

We use these details to answer you and handle your request, and keep the conversation for as long as needed for that (Art. 6(1)(b) or (f) GDPR).

9. Service providers and transfers

We use these service providers (processors) under data processing agreements:

Apple, Google, Samsung and LG act as independent controllers for their stores. Where a provider is located outside the EU/EEA, or may access data from there, transfers are based on an adequacy decision (for example the EU–US Data Privacy Framework for certified companies) or the EU Standard Contractual Clauses (Art. 44 et seq. GDPR).

10. How long we keep data

• Account and synced data: until you erase it or delete your account.
• Server logs: at most 14 days.
• Contact and deletion requests and our replies: up to 2 years after the conversation ends.

11. Your rights

You have the right to:

• access the personal data we hold about you and receive a copy (Art. 15 GDPR);
• have incorrect data corrected (Art. 16) and data erased (Art. 17);
• restrict processing (Art. 18) and receive your data in a portable format (Art. 20);
• object at any time to processing based on our legitimate interests (Art. 21 GDPR);
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR);
• lodge a complaint with a data protection supervisory authority, in particular the one where you live or the one responsible for us (Art. 77 GDPR).

To exercise these rights, use the contact form (topic “Privacy”) and give the email address linked to your account, or write to the address above.

12. Children

YAIP is not directed at children. A YAIP account may only be created by people aged 16 or older, or with the consent of a parent or guardian.

13. Security

All connections to our servers use HTTPS. Access to synced data is limited to your own account by database rules. Playlist logins are end-to-end encrypted. Your provider's own connection may use HTTP if you allow it in the app, in which case it is not encrypted between your device and your provider.

14. Changes to this policy

We update this policy when the apps or the law change. The date at the top shows the latest version. If a change significantly affects how we use data you have already given us, we will tell you in the app or by email.