Privacy policy

Applies to the Tellyfin Android TV app and to the tellyfin.app website. Last updated 24 September 2026.

1. Who is responsible

The controller for the processing described here, within the meaning of Article 4(7) GDPR, is:

Tellyfin is an independent open source project. It is not affiliated with, endorsed by or connected to the Jellyfin project.

2. How Tellyfin is put together

Tellyfin is a client. It has no backend of its own, no user accounts, no cloud sync and no server that stores anything about you. You point it at a Jellyfin server that you or someone you trust operates, and it plays live TV from that server.

That shape matters for this policy: for almost everything you do in the app, the only party receiving data is the Jellyfin server you chose. The two exceptions, both described below, are the crash reporting in some builds and a version check against tellyfin.app when the app starts.

3. Data stored on your device

The following is written to the app's private storage area on your TV device and is readable only by Tellyfin. None of it is transmitted to me, and none of it is transmitted to any third party.

What	Why
Your Jellyfin server address	So the app knows where to connect on the next start
Your Jellyfin access token and user name	To stay signed in without asking for a password each time
Your favourite channels	To sort them to the top and offer the Favourites tab
The last channel you watched	To resume where you left off
Your maximum streaming bandwidth setting	To apply the same cap on the next start
Cached channel logos	So the guide does not refetch every image on every launch

Signing out inside the app clears the stored session. Uninstalling the app removes all of it. The app also disables Android's automatic cloud backup (allowBackup="false"), so this data is not copied into your Google account backup.

4. Data sent to your Jellyfin server

When you use the app it makes requests to the Jellyfin server you configured, in the same way any other Jellyfin client does. That includes your sign-in, requests for the channel list and guide data, the stream itself, and playback progress reports roughly every ten seconds so the server knows a session is active.

Your server therefore sees, at minimum, your IP address, your Jellyfin user name, which channels you open and when. What is recorded and for how long is decided by whoever runs that server, not by me. If someone else operates it, ask them for their privacy information. If you operate it yourself, you are the controller for it.

Two implementation details worth knowing: the access token is sent in an HTTP Authorization header rather than in a URL, so it does not end up in proxy or web server access logs. The authorisation header is attached only to requests going to your configured server host and never to any other host.

5. Crash reporting

Tellyfin is published in two builds. They are built from the same source and signed with the same key, and they differ in exactly one respect.

• The standard build, which is what is published on Google Play and offered as the recommended download here, includes the Sentry crash reporting SDK.
• The build without crash reporting, available from the downloads section and from GitHub, does not have the Sentry SDK as a dependency at all. Its code is not present in the APK, so there is nothing that could send a report, with or without a setting.

What a crash report contains

In the standard build, an unhandled error or a failed sign-in attempt that looks like a bug produces a report containing:

• the exception type, its message and the stack trace
• the app version and whether it is a debug or release build
• the Android version, device manufacturer, model, architecture, screen details, locale, time zone, available memory and whether the device is an emulator
• a short trail of recent in-app steps, for example that the app read its preferences and then called the login endpoint
• a random installation identifier generated by the SDK on first launch, which lets two reports from the same installation be recognised as related. It is not derived from your device, your account or any advertising identifier, and it is regenerated if you reinstall the app.

One caveat, stated plainly: an error message or a step in that trail can contain the address of your Jellyfin server if the address appears in the underlying error, which is common for network failures. Your password and your Jellyfin access token are never part of a report.

Who processes it

Crash reports are transmitted to Sentry, operated by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, which acts as a processor on my behalf under a data processing agreement. The project is hosted in Sentry's United States region. Transfers to the USA are made on the basis of the European Commission's Standard Contractual Clauses.

The SDK is left at its default setting for personal data, which means it does not attach your IP address to the report and Sentry does not store it with the event. Reports are retained for 90 days and then deleted automatically.

Legal basis and how to avoid it

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is being able to find and fix defects in software that runs on hardware I do not have and cannot reproduce problems on. The data is limited to what a stack trace needs, it is not used to build a profile, and it is never used to make any decision about you.

If you would rather that no diagnostic data leaves your device, install the build without crash reporting. You can also object at any time under Article 21 GDPR using the address in section 1.

6. The update check

On launch the app requests https://tellyfin.app/update.php, which returns the latest version number and a GitHub download link as JSON. No information about you or your device is sent with the request beyond what any HTTP request necessarily carries, which is your IP address and the standard request headers. That request is logged by the web server as described in section 11.

In the build distributed through an app store, the in-app updater is compiled out and does not run, because updating outside the store's own mechanism is against store policy. The sideload build asks before it downloads anything and installs nothing on its own.

7. Android permissions

Permission	What it is for
INTERNET	Reaching your Jellyfin server and streaming from it
ACCESS_NETWORK_STATE	Noticing that the network dropped, so a stream error can be retried instead of shown
REQUEST_INSTALL_PACKAGES	Only used by the sideload build, to offer to install an update you have confirmed. It is not exercised in the app store build.

Tellyfin does not request location, camera, microphone, contacts, storage or any other sensitive permission.

8. Google Play and the Amazon Appstore

If you install Tellyfin from Google Play, Google processes the installation itself as an independent controller under its own privacy policy. Depending on the settings on your device and in your Google account, Google may also collect its own crash and performance data, and it provides me with aggregated, non-identifying statistics such as install counts, device model breakdowns and crash rates through the Play Console. I cannot identify an individual user from any of that.

The corresponding entry in the Play Data safety section declares crash logs and diagnostics as collected, not shared with third parties for their own purposes, not used for advertising or tracking, and transmitted over an encrypted connection.

The same applies to the Amazon Appstore: Amazon processes the installation as an independent controller under its own privacy notice, and gives me aggregated statistics. The Amazon Appstore release is public, so there is no tester list and I do not learn who installed it. The Google Play release is still a closed test, and Google shows me the email address or Google account of each tester who joins it. I use that only to run the test and to answer support mail, I do not add it to any mailing list, and it is removed when the test ends or when you ask me to remove it.

9. What is never collected

• No advertising, no ad SDK, no advertising identifier
• No product analytics, no usage tracking, no session recording, no heatmaps
• No record on my side of which channels or programmes you watch
• No contacts, location, camera, microphone or files
• No sale of data, and no sharing for anyone else's marketing purposes
• No cookies or comparable identifiers in the app

10. Children

Tellyfin is a general purpose media client and is not directed at children. It is not knowingly used to collect data from anyone under 16. Note that the app itself does not filter content: what can be watched is whatever your Jellyfin server offers, and any parental control belongs on that server.

11. The tellyfin.app website

This site runs on a server I rent and administer myself, in a data centre in Falkenstein, Germany. The infrastructure is provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, acting as a processor under a data processing agreement. The site sets no cookies, runs no analytics, and loads no fonts, scripts or images from any third party, so visiting it does not disclose anything to anyone else.

The web server writes a standard access log containing the requesting IP address, the date and time, the requested path, the HTTP status, the amount of data transferred, and the referrer and user agent sent by your browser. This is needed to operate the site securely and to investigate faults and abuse, on the basis of Article 6(1)(f) GDPR. The logs are rotated daily and kept for seven days, after which they are deleted.

One small piece of script runs locally in your browser and reads its time zone, for a single purpose: Amazon runs a separate storefront per country, so the link to the Amazon Appstore has to point at yours rather than the American one. The time zone is not sent anywhere. All that leaves your browser is the storefront it resolved to, as part of the link you click, and that appears in the access log above like any other requested path. No cookie or identifier is set for this.

The download buttons link to release files hosted on GitHub. Following one of those links takes you to GitHub, at which point GitHub's own privacy policy applies to that request.

12. Your rights

Under the GDPR you have the right to request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.

Write to privacy@tellyfin.app. For a crash report in particular, please quote the reference shown in the app when the error appeared, because without it there is usually no way to link a stored report back to you.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement (Article 77 GDPR). The authority responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

13. Changes to this policy

This policy will be updated when the app changes in a way that affects it, for example if a new third party service is added or an existing one is removed. The date at the top always reflects the current version, and the history of this page is visible in the project's public repository.