Privacy Policy

01 The short version

Vyn is a player for media you already have. It does not ask you to create an account, it does not have a server that your device reports to, and it contains no analytics, advertising or tracking software of any kind.

Everything Vyn knows about you — what you have watched, where you stopped, which servers you have connected, what you put on your list — is written on your own device. If you switch on iCloud sync, some of it is also written to your private iCloud database, which Apple encrypts and which the developer of Vyn cannot read.

Vyn does make network requests, and it is worth being precise about them: it fetches film and television metadata from TMDB, it talks to the media servers, trackers and IPTV providers you connect, and nothing else. Section 7 lists every one of them and says what each receives.

02 Who is responsible

Vyn is developed and published by an individual developer, not a company. For the purposes of the UK GDPR and the EU GDPR that developer is the data controller for the limited processing described below, and can be reached at hellovynmedia@gmail.com.

In practice the controller holds almost nothing: there is no user database, no mailing list and no server-side record of who uses Vyn. The only personal data the developer ever sees is what you choose to put in an email or a feedback report.

03 What Vyn collects

Nothing is collected by the developer in the course of using Vyn. Vyn transmits no personal data to the developer on its own. There is no Vyn account, no usage telemetry, no crash reporting service and no advertising identifier. The one exception is a feedback report, which is only ever sent when you write one and press Send; section 10 says exactly what it contains.

Vyn does process data on your device in order to work — that is what the next two sections are about — and it sends requests to third-party services that you configure or that supply catalogue metadata. Those services have their own privacy policies and receive whatever a request necessarily reveals, which for any internet request includes your IP address.

Why the App Store label is not "Data Not Collected"

Apple counts data as collected when it is kept off your device, beyond what answering a request in real time needs, by the developer or by a third party the developer has a relationship with. Outside a feedback report you choose to send, Vyn keeps nothing. Some connected services do keep records, and the developer retains feedback as section 10 describes, so the label declares both:

These categories are declared as linked to you or your device and for app functionality only. None is used for advertising, analytics, the developer's marketing, or tracking, and Vyn shows no App Tracking Transparency prompt because it has nothing to ask for. Disconnect a service and Vyn stops sending to it and discards its token. Section 7 names every service and says exactly what each one receives; section 10 describes feedback.

04 What is stored on your device

All of the following lives in Vyn's own container on your device, under the protection of the operating system, and is removed when you delete the app.

On iPhone and iPad, Vyn also writes the Continue Watching shelf into a shared app group so the Home Screen and Lock Screen widgets can draw it without opening the database. On Apple TV it writes the same shelf into a shared group for the Top Shelf. Both stay on the device.

05 iCloud sync

Vyn can keep the things you created — viewing activity, lists, profiles, reactions — in step across your Apple devices using CloudKit. When it does, that data is stored in your own private iCloud database, under your Apple Account. It is governed by Apple's Privacy Policy. The developer of Vyn has no access to it and no way to request it.

Caches are deliberately excluded. Artwork, metadata, ratings, the media-server index and the pending queue of tracker updates are stored locally only — they are free to rebuild, they describe one machine on one network, and syncing them would spend your iCloud storage on nothing.

You can remove synced Vyn data at any time from Settings on your device, under your Apple Account › iCloud › Manage Account Storage.

06 Credentials and how they travel

Usernames, passwords, API keys and access tokens for the services you connect are held in the system Keychain, not in Vyn's settings file and not in its database. On Mac, Vyn uses the data-protection Keychain.

They are used for one thing: authenticating the requests you asked Vyn to make. They are never sent to the developer, never sent to a service other than the one they belong to, and never written to the diagnostic log or shown in an error message.

Signing out of a service in Vyn's settings removes its credentials from the Keychain on that device. Deleting the app removes all of them.

07 Services Vyn talks to

Every request below is made directly from your device to that service. None of it is proxied through the developer, and there is no step at which the developer could observe it. Each service is bound by its own privacy policy, linked below.

Always used

Only if you connect them

Vyn does not share your data with any third party for that party's own purposes. It does not sell personal information, and it does not disclose personal information for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act.

08 Trailers and YouTube

Trailers are YouTube videos. On iPhone and iPad, a trailer plays in YouTube's own official embedded player inside the app. Playing one is a visit to YouTube: Google receives your IP address, information about your device, and the fact that this video was played, and may set cookies or similar storage in that player, all under Google's Privacy Policy.

Nothing is sent to Google until you actually start a trailer. On Apple TV, Vyn hands the trailer to the YouTube app instead and does not embed a player at all.

09 Diagnostics and crash data

Vyn contains no crash-reporting or analytics SDK. It does not use Firebase, Sentry, Crashlytics, or any equivalent.

If you have switched on Share With App Developers in iOS, iPadOS, tvOS or macOS Settings, Apple may send the developer aggregated crash and energy reports through App Store Connect. Those come from Apple, are governed by Apple's privacy policy, and identify a device model and an operating system version — not you.

10 Feedback you send

Settings › Send Feedback lets you report a problem or suggest something from inside the app. Nothing is sent until you write a report and press Send, and the form shows you everything that will go with it before you do. On Apple TV the form shows a code to scan, and you write the report on this website from your phone instead.

What is never sent: logs, server addresses, account or user names, passwords, tokens, stream addresses, film titles you did not type yourself, and your viewing history.

Where it goes. Reports are received by a small service the developer runs on Cloudflare, which stores attachments in Cloudflare R2 and files the report as an issue in a private GitHub repository that only the developer can read. Cloudflare and GitHub process it as the developer's service providers and, like any web service, see the IP address the report was sent from; the report itself does not contain it.

How long it is kept. Attachments are deleted automatically after 180 days. A report is kept while the problem it describes is being worked on and is deleted within twelve months of being closed. To have a report deleted sooner, email the developer with its reference (it looks like VYN-7K2Q9X).

The report is used only to fix problems and improve Vyn. It is not used for marketing, sold, or combined with anything else.

11 Advertising and tracking

There is none. Vyn shows no advertising, contains no advertising SDK, does not use the Advertising Identifier, does not fingerprint your device, and does not track you across apps or websites. It therefore never presents an App Tracking Transparency prompt, because it has nothing to ask permission for.

12 Retention, deletion and consent

Retention. Data kept on your device is kept until you delete it or delete the app. Caches are pruned as they age or when a source is replaced. The developer retains nothing, because the developer receives nothing — except email you send, which is kept only as long as it takes to answer you and is deleted within twelve months, and feedback reports, which are kept as section 10 describes.

How to delete your data

• Everything on a device — delete Vyn. Its container, its caches and its Keychain entries go with it.
• Synced data — Settings › your Apple Account › iCloud › Manage Account Storage, then remove Vyn's data. This removes it from every device signed in to that Apple Account.
• A single connection — disconnect it in Vyn's settings. Its credentials leave the Keychain, and its cached library or catalogue data is discarded.
• Household profiles — delete a profile in Vyn's settings and its history and layout go with it.

How to withdraw consent

Every connection in Vyn is one you made deliberately, and every one can be undone in the same place. Disconnecting a tracker stops Vyn sending anything further to it and discards its token. Because a token can also be revoked at the service's own end, and because that is the only way to be certain, we recommend you also revoke Vyn's access in your Trakt, Simkl or Plex account settings.

Vyn has no account of its own to delete. Apple requires apps that offer account creation to offer account deletion in the app; Vyn creates no account, so there is nothing to delete beyond the steps above.

13 Your rights

Under the UK and EU GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Under the CCPA and similar US state laws you have rights to know, delete, correct and opt out of sale or sharing.

These rights are unusually easy to exercise here and unusually hard to route through the developer, for the same reason: the data is on your device, in your possession, and the developer holds no copy. Deleting the app is a complete erasure. If you believe the developer nonetheless holds personal data about you — most likely an email exchange or a feedback report — write to hellovynmedia@gmail.com and it will be provided or deleted within one month.

If you are in the UK or the EEA and are unhappy with the response, you may complain to your national supervisory authority.

International transfers. The developer transfers nothing except a feedback report you send, which Cloudflare and GitHub may process in the United States. When you use a third-party service through Vyn, your request goes to wherever that service is hosted, which for TMDB and the trackers is generally the United States. That is a transfer you make directly, on that service's own terms.

14 Children

Vyn is not directed to children and is not in the Kids category. The developer receives no data from anyone except feedback somebody chooses to send, and nothing else leaves the device unless an account is connected.

Parental controls

Vyn has optional parental controls for households that share it. They do nothing until you choose a four-digit parental PIN. The PIN opens the Parental Controls settings and works on every profile. You can then set, for each profile:

• A rating limit — All Ages, 7+, 13+, 16+ or No Limit. Films and series above the limit are left out of that profile's lists, and playing one needs the PIN. That lets the title play for the rest of the sitting.
• Unrated titles — held back by default on a limited profile, and allowed only if you turn them on.
• Live TV — on or off. TV channels have no rating, so a rating limit can't cover them; turning Live TV off is the only control for channels.
• Require PIN — the profile can't be opened without the PIN.

You can also lock categories of a connected IPTV service. Locked categories are hidden on every profile until the PIN is entered, and are hidden again after two hours, when Vyn leaves the screen, or when the profile changes. Vyn may suggest categories whose names usually mean adult content, but it locks nothing until you choose.

What is stored. Vyn does not store the PIN itself. It keeps a salted, one-way hash of the PIN, each profile's settings and the list of locked categories in its own database on your device. With iCloud sync on, these are also kept in your private iCloud database (section 5), so the same PIN and settings apply on each of your devices. None of it is sent to the developer or to any service you connect. After five wrong PINs, Vyn pauses before the next try, and each further mistake makes the pause longer. On iPhone, iPad and Mac, a forgotten PIN can be replaced after the device's owner confirms who they are with the device passcode, Face ID, Touch ID or the Mac's login password. On Apple TV, it is replaced from one of those devices through iCloud.

What they cannot do

• They do not verify age. Vyn doesn't know who is holding the remote, and anyone who knows the PIN can change or remove every restriction.
• They rely on published ratings. Ratings come from TMDB: the US rating where there is one, otherwise the strictest rating any country gives. A missing or wrong rating there means a wrong decision here. Home videos and IPTV films that TMDB can't match have no rating.
• They do not control the content of your sources. Vyn doesn't inspect or filter what your Plex, Jellyfin or Emby servers or your IPTV subscription contain, and it doesn't change what those services show in their own apps. A category lock hides categories by what the provider calls them. If the provider adds a category or renames one, it isn't locked until you lock it.
• They work only inside Vyn. They don't restrict other apps, websites or the device. For device-wide limits, use Apple's Screen Time.
• A limited profile is only as safe as the others. A child can switch to any profile that doesn't require the PIN. Vyn's settings warn about this.

Parental controls help a household choose what each profile sees. They are not a guarantee, and deciding what a child can use is still the responsibility of a parent or guardian.

15 This website

getvyn.xyz is a static site. It sets no cookies, runs no analytics, embeds nothing from a third party and loads no external fonts. Its one form is the feedback page an Apple TV sends you to, which sends what you write there to the service described in section 10 and nowhere else.

The site is hosted by Netlify, which — like any web host — processes the request logs needed to serve and protect it, including IP addresses, for a limited period. See Netlify's privacy notice.

16 Changes

If this policy changes, the date at the top of the page changes with it, and the current version always lives at this address. A change that materially widens what Vyn does with your data will be announced in the app's release notes as well, rather than made quietly.

17 Contact

Questions about privacy, requests about your data, or anything else about Vyn:

See also the Terms of Use, the Copyright & Content Policy, and the Support page.