The short version
The UNDERSTAIRS apps collect nothing. They have no analytics, no advertising, no crash reporting and no accounts of ours. We do not run any server that your device talks to, and no information about you or your viewing reaches us unless you choose to email us a problem report (see Problem reports).
The apps are empty players. They do nothing until you point them at a media server that you run or are allowed to use, and from then on they talk directly to that server.
This policy covers UNDERSTAIRS TV for Fire TV, Android TV and Google TV, and UNDERSTAIRS for iPhone, iPad (with CarPlay and the Apple Watch app) and Android. Where an app differs, it says so.
What we collect
Nothing. The apps contain no analytics, advertising or crash-reporting code, and they send nothing to us on their own.
On Fire TV, Android TV and Google TV the app asks for two permissions, INTERNET and ACCESS_NETWORK_STATE. Neither is used to gather information about you.
On Android phones and tablets those two are joined by FOREGROUND_SERVICE with FOREGROUND_SERVICE_MEDIA_PLAYBACK (so music keeps playing when you leave the app) and FOREGROUND_SERVICE_DATA_SYNC (so a download carries on in the background), POST_NOTIFICATIONS (asked for the first time you download something, so the app can show download progress, new-episode alerts, finished downloads and finished recordings) and WAKE_LOCK (so the device does not sleep during playback). Nothing reads your contacts, location, camera, microphone or any storage outside the app’s own files.
On iPhone and iPad the app asks for local network access. It is used to find a media server, and a Chromecast device, on your own Wi-Fi. Background audio is switched on so music carries on with the screen locked. The app also asks for the microphone and speech recognition, but only when you use voice search in the car (see CarPlay and voice search).
What is stored on your device
These stay on your device, in the app’s private storage, and are never sent to us.
| The address of each server you add | So the app can reconnect without you typing it again. |
|---|---|
| Your sign-in token for each server | So you stay signed in. It is issued by your server, or by Plex, not by us. See Security for how it is kept. |
| Your preferences | Theme, audio settings, which Home rows you want, default quality, download rules and similar. |
| Cached artwork | Posters, backdrops and logos fetched from your server, so browsing is quick. |
| Downloaded titles (phone and tablet) | Films and episodes you chose to download, held in the app’s own private files so they play with no connection. They are never uploaded anywhere. Deleting them in the app, or removing the app, deletes them. |
| Downloaded albums (Apple Watch) | Albums you chose to keep on the watch for offline listening, held in the watch app’s own storage. |
| A record of the last few problems the app showed you | So you can send it to us if something goes wrong (see Problem reports). The app never sends it by itself. |
| A randomly generated device identifier | A random value made on first run, so a server can tell your devices apart and keep resume points separate. It is not taken from any hardware or advertising ID and is not linked to you. It is sent to your server and, if you sign in with Plex, to Plex, whose service requires every client to identify itself. We never see it. |
Removing an app removes all of this. Signing out clears the token for that server.
The apps also keep a short diagnostic log to help you work out playback problems. It lives in memory only, is shown only on your own screen, is never written to a file and is never uploaded.
Problem reports
The apps remember the last eight problems they showed you, for example “This video won’t play on this TV”, with the time, the title involved (cut short) and the reason your server gave. Settings, About, Problem report shows them with the app’s version, your device’s model and system version, and the kind and version of your server.
A report holds no passwords, sign-in tokens, server addresses, user names or device identifiers. The app never sends it. It reaches us only if you email it: on a TV, by scanning its QR code with your phone and sending the email that opens; on a phone, with Email it to us or Share. We use a report, and the address it came from, only to reply and to fix the problem.
Where your data goes
These are the only places your device talks to. Each one is your choice.
1. Your media server
Browsing, searching, playback, downloads and resume points are direct connections from your device to the server address you entered. Nothing is passed through any service of ours, because we do not run one. Your server’s operator’s own privacy practices apply to what that server records.
2. Plex’s services, only if you use Plex
If you choose Plex, the app uses Plex’s own sign-in: your device contacts plex.tv for a link code and, once you approve it, a token, and to list the servers on your Plex account. These requests carry the random device identifier above, because Plex requires it. We never see, ask for or handle your Plex password; the apps have no password field for Plex. This exchange is between you and Plex Inc., under Plex’s own privacy policy.
If you use the Watchlist with a Plex server, the app also reads your Plex watchlist from Plex’s watchlist service (discover.provider.plex.tv), and adds or removes a title there when you ask, using your Plex sign-in. It is the same watchlist Plex’s own apps show, kept by Plex on your Plex account. Jellyfin and Emby users never contact Plex.
3. Emby Connect, only if you choose it
If you sign in to an Emby server with Emby Connect, your device contacts Emby’s own sign-in service (connect.emby.media) for a code and, once you approve it, to list the Emby servers linked to your Emby Connect account. Your server then gives the app its own sign-in. We never see, ask for or handle your Emby Connect password. This exchange is between you and Emby, under Emby’s own privacy policy. If you type your Emby password instead, it goes only to your own server.
4. CarPlay and voice search (iPhone)
CarPlay shows your music library and Now Playing on the car screen. The list comes from your own server, through your phone. Voice search is an extra you switch on in Settings. When you use it, the app asks for the microphone and speech recognition, and what you say is turned into text by Apple’s speech recognition, which may send the audio to Apple. Apple’s privacy policy applies to that. The text is used only to search your own library. Nothing is recorded or kept by the app.
5. Chromecast and AirPlay
Casting to a Chromecast works with Emby servers. The phone hands the Chromecast the address of your server’s stream, and the Chromecast fetches it. The phone’s Cast software is Google’s, and Google’s privacy policy applies to it. AirPlay is Apple’s, and sends a film from your iPhone or iPad to an AirPlay device on your network.
6. Your Apple Watch
If you use the watch app, your iPhone passes your saved servers, with their sign-in tokens, to your own Apple Watch using Apple’s watch-to-phone link. That is between your own two devices.
Children
The apps are not directed at children, carry no advertising, and show only whatever is on the server you connect to.
Security
Sign-in tokens are kept in the app’s private storage, which other apps cannot read. Where the device allows it they are also encrypted: with the Android Keystore on Android and Fire TV devices that support it, and in the iOS Keychain, set to this device only, on iPhone and iPad. On the oldest Fire TV software (Fire OS 5), which has no usable Keystore, and in the rare case the Keystore fails, the token is stored without that extra encryption.
When your server is reachable over HTTPS, traffic to it is encrypted. The apps also allow plain HTTP, because self-hosted media servers on a home network very often have no certificate. The apps cannot tell which plain-HTTP addresses are on a home network, so this is allowed for any address you type. Use HTTPS where you can, especially for a server you reach over the internet.
On Android, the TV app excludes its sign-in token from Android’s own device backups.
Your choices
Sign out from Settings to clear a server’s token, delete downloads from the Downloaded screen, or remove the app to remove everything it stored. Unless you have emailed us, we hold no data about you, so there is nothing for you to ask us for and nothing for us to delete. If you have sent us a problem report or a question, write to support@understairs.tv and we will delete it. For anything your server has recorded, ask whoever runs that server.
Changes
If this policy changes, the new version will be posted at this address with a new date above, and material changes will also be noted in the apps’ release notes.
Contact
Questions about this policy: support@understairs.tv
UNDERSTAIRS is an independent third-party client application and is not affiliated with, sponsored by, or endorsed by Plex Inc., The Jellyfin Project or Emby LLC. All trademarks are the property of their owners.