Privacy and your data

What StreamDek is, structurally

StreamDek hosts no media and provides no catalogue. It is a front end over sources you connect — addons, M3U playlists, a Debrid service, a metadata provider. That shapes everything below: most of what StreamDek stores exists so that the same library looks the same on your phone and your TV.

What is stored on StreamDek's servers

An account holds the things that have to survive a reinstall and reach a second screen:

• Your account. Email address and a password hash. Passwords are hashed with bcrypt and are never stored or transmitted in a readable form; the same applies to profile PINs.
• Your profiles. Profile names, avatars, home-row layouts, playback preferences and per-profile settings.
• Your library state. Watchlist entries, playback progress and viewing history — this is precisely the data that makes Continue Watching work across devices.
• Your connections. The addons, playlists, Debrid providers and sync services you have added, along with their API keys and OAuth tokens. Credentials are encrypted at rest with AES-256-GCM rather than stored as plain text.
• Your devices. Paired devices, active sessions and pairing codes, so you can see what is signed in and revoke anything you do not recognise.

Diagnostic and usage data

The apps report diagnostic events so that failures can be found and fixed — including which addon was queried, whether a stream resolved, how long it took, the error category when it did not, and the platform, app version and country the report came from.

Credentials, API keys and tokens are redacted before any diagnostic event is written. This data is used to operate and debug StreamDek, and it is not sold or shared for advertising.

What never leaves your control

• Your viewing activity is never exposed to the public web. The Control Center at /app is blocked in robots.txt and carries a noindex directive, so watch history, Continue Watching, watchlists and profile pages cannot be crawled or turned up in a search result.
• StreamDek does not choose your sources. What you connect, and what those sources do, is between you and them.
• No advertising identifiers. StreamDek does not embed advertising SDKs or ad-network trackers.

Bring your own keys

Metadata comes from TMDB, with optional MDBList enrichment. You can supply your own API keys for both, in which case those requests run under your own account with those providers rather than through a shared pool.

This website

The public pages carry no third-party analytics, no advertising scripts and no tracking cookies. Where measurement is enabled it is first-party and deliberately blunt: which public page a visit landed on, which search engine sent it (the host name only, never the query), and which download link was clicked. There is no cookie, no visitor identifier and nothing that can be joined back to an account, and it honours Do Not Track and Global Privacy Control.

One font family is served from Google Fonts. Everything else — images, scripts, stylesheets — is served from StreamDek's own origin.

Your controls

• Disconnect any Debrid or sync service at any time; its stored credentials are removed with it.
• Remove individual Continue Watching entries, or clear progress for a profile.
• Revoke a paired device or an active session from the Control Center.
• Delete your account, which removes the profiles, library state and stored credentials attached to it.

Questions

If something here is unclear, or you want to know what is held for your account, raise it through the StreamDek project pages.