Legal
Privacy
Shelf plays media you already own or already subscribe to. It does not sell content, show ads, or track you across other companies’ apps or websites.
What we collect
If playback diagnostics are on (Settings → Privacy), Shelf sends anonymous events to our PostHog project:
- Product interaction — playback requested, started, stalled, failed, or ended; catalog load failed; app lifecycle (installed, opened, backgrounded).
- Crash data — uncaught crashes, so a player failure can be fixed.
- A device identifier — a random ID the analytics SDK creates on first launch. It is not your name, email, Apple ID, or advertising identifier. Reinstalling the app creates a new one.
- Other usage data attached by that SDK (for example library version).
Event properties are tokens and numbers (movie, jellyfin, a duration in milliseconds). They never include a title you watched, a server address, or a password.
You can turn this off at any time: Settings → Privacy → Share Playback Diagnostics. With no analytics token configured, or with mock data on, nothing is sent.
We do not collect location, contacts, purchases, advertising identifiers, or a user account. Shelf has no accounts of its own.
What stays on your devices
- Jellyfin, Xtream, TMDB, and GitHub credentials are stored in the Keychain (and can sync through iCloud Keychain). They are sent only to the server you typed.
- Favorites, history, and playback progress sync through iCloud via CloudKit’s private database, which we cannot read.
- Downloads and local files never leave the device that holds them.
Third parties
PostHog processes the diagnostics above on our behalf, on the host configured with the project (not a silent US fallback). Apple provides iCloud Keychain and CloudKit. Jellyfin, Xtream, TMDB, and GitHub receive only what you asked Shelf to send them.