Legal
Privacy
Shelf plays media you host on your own server. It has no accounts of its own, does not sell content, show ads, or track you across other companies’ apps or websites.
What we collect
With playback diagnostics on (Settings → Privacy), Shelf sends anonymous events to our PostHog project: product interaction, meaning playback requested, started, stalled, failed or ended, a catalog that failed to load, and app lifecycle; performance data, how long playback took to start and how long it stalled; diagnostic logs, a short record of which operation failed, the kind of failure and the error’s type or status code; crash data; and a device identifier, a random ID the analytics SDK creates on first launch. It is not your name, email, Apple ID or advertising identifier, and reinstalling the app creates a new one.
Events and diagnostic logs carry tokens and numbers, such as movie, jellyfin, a duration in milliseconds or an HTTP status code. They never include a title you watched, a server address or a password.
You can turn this off at any time: Settings → Privacy → Share Anonymous Playback Diagnostics. We do not collect location, contacts, purchases or advertising identifiers.
What stays on your devices
Your Jellyfin and TMDB credentials are stored in the Keychain, and can sync through iCloud Keychain. They are sent only to the server you typed. Favourites, history and playback progress sync through iCloud via CloudKit’s private database, which we cannot read. Downloads and local files never leave the device that holds them.
Third parties
PostHog processes the diagnostics above on our behalf, on the host configured with the project. Apple provides iCloud Keychain and CloudKit. Jellyfin and TMDB receive only what you asked Shelf to send them.