Privacy Policy

Who we are

mavio.dev is run by an individual, the developer of Mavio ("we"). This policy explains what mavio.dev's website and services collect and why. Write to support@mavio.dev with any question about it.

Mavio's servers are software you run yourself. What a server stores — your libraries, your watch history, the media itself — stays on that server and is not sent to us; this policy covers only what mavio.dev handles.

What we collect

• Your account: e-mail address, user name, display name, a hash of your password, your passkeys' public keys, your two-factor secret, a hash of your PIN, and the profiles of your Home's managed accounts.
• Sessions: for each signed-in browser or device, when it signed in, its IP address and its user agent, and the public keys of devices' sessions.
• Your servers: each server's identity public key, name and version, the IDs, names and kinds of its libraries, the addresses your clients reach it at, and the access you grant others to it.
• Your relationships: your friends, your Home and its members, and invitations.
• Mavio Pass: when your Pass runs until, and your subscription's state, plan and period. Payments are taken by Stripe; we receive a customer ID and the subscription's state, never your card's details.
• Requests: your IP address, used to limit how often passwords, codes and e-mail can be tried, for a minute at a time.

How we use it

• To sign you in, to your servers and on your devices, and to keep your account secure.
• To tell your servers who may reach them and when access changes, an account is suspended or deleted.
• To issue certificates and names for your servers, and to relay connections to them when they cannot be reached directly.
• To send you e-mail about your account, such as verifying your address or resetting your password. We send no marketing e-mail.
• To sell and renew Mavio Pass.

We do not sell your data, show advertising or use analytics or tracking cookies. The only cookie is the one that keeps you signed in.

The relay

When a connection goes through mavio.dev's relay, it stays encrypted end to end between your device and your server. The relay sees which server is reached, the IP addresses at both ends and how much data passes, and keeps none of it after the connection ends; it cannot see what is watched.

Who processes it for us

• Cloudflare runs mavio.dev's website, database connections, e-mail and DNS.
• Stripe takes payments for Mavio Pass, under its own privacy policy.
• Let's Encrypt and Google Trust Services issue your servers' certificates, which list their names publicly in Certificate Transparency logs.
• Virtual machines we rent run the relays and the name servers of s.mavio.fyi.

These providers may process data in countries other than yours.

Keeping and deleting it

We keep your data while your account exists. Deleting your account on its page deletes it, with your sessions, friendships, Home membership and access records, and tells your servers to remove you; a Pass subscription ends with it. Records that Stripe keeps for tax and accounting stay with Stripe.

You can see and change most of your data on your account's pages. To get a copy of it or to have it corrected or deleted, write to support@mavio.dev.

Children

mavio.dev is not meant for children to sign up on their own. A Home's administrator may create managed accounts for their family; they have no e-mail address or password, and the administrator is responsible for them.

Changes

When this policy changes, the date at its top changes too, and we tell account holders of significant changes by e-mail before they apply.