Privacy

Effective 31 October 2026

Potato has no accounts, no ads and no tracking. Your library, what you watch and your passwords stay on your device. Three things go to the internet, and only for the reasons below.

What stays on your device

The names of your files and folders, and the shows and films they matched.
What you've watched, and where you stopped.
Passwords for your shares, kept in the system Keychain.
Downloads, artwork and settings.
Performance logs, until you choose to upload them.

None of this is copied to iCloud or to us. Delete the app and it's gone.

What leaves your device

What	Sent to	When	Kept for
Show and film names, and years	Our server, which asks TMDB	When Potato matches a title, you search for one, or you open a season	Up to 100 days, not linked to you
Requests for artwork	TMDB's image servers	When posters appear	As TMDB's policy says
Performance logs, with titles removed	Our server	Only when you press Upload logs	30 days

Looking up titles

To find a poster and synopsis, Potato reads a name and year from each file name. Charade (1963).mkv becomes “charade”, 1963. It sends that name and year to our server, which asks The Movie Database (TMDB) and keeps the answer so the next person asking gets it faster. Episode names are fetched the same way, by TMDB's number for the show. Our server stores questions and answers, never who asked. Potato never sends the full file name, its folder or your share's address.

Your IP address

Our server runs on Cloudflare. Like any server, it sees the internet address a request comes from. It uses that address only to stop one address making too many requests, and doesn't store it. Our records note only whether a request worked and whether the answer was already saved.

Artwork

Posters and stills come straight from TMDB's image servers, which see your internet address as any website would. TMDB's privacy policy applies to them.

Your own keys

If you add your own TMDB or OMDb key in Settings › Posters & info, Potato asks that service directly instead of our server, and its privacy policy applies.

Performance logs

Potato keeps a log on the device to help find problems: how long playback takes to start, how long scans take, how quickly each share answers, and memory, processor and heat. Logs are kept for 14 days. Nothing is sent unless you press Upload logs in Settings › Performance logs (on Apple TV, Settings › Debug).

Before uploading, Potato removes every title and file name and keeps only the file type, such as mkv. Our server then removes anything that looks like an email address, internet address, file path, password or token. Each upload carries a random number, not your name, Apple ID or device, and our server keeps only a scrambled form of it. We read logs to fix bugs and delete them after 30 days.

Your local network

Potato asks to use your local network so it can reach your shares and, on Apple TV, find computers to add. That traffic stays on your network, or on your own VPN if a share has an address there.

Share over HTTP

If you turn on Settings › Share over HTTP on a Mac, that Mac serves your library to web browsers on your network. While it's on, anyone with the six-digit passcode can browse, play and download your videos. The passcode stays in the Mac's Keychain. Nothing passes through our server. Sharing stops when you turn it off or quit Potato.

What we don't do

No accounts or sign-in.
No advertising, analytics or tracking tools.
No selling or sharing of data with anyone.
No collecting your name, email address, contacts, location or Apple ID.

Children

Potato collects no personal information from anyone, including children under 13.

Deleting your data

Deleting the app removes everything it kept on your device. Uploaded logs carry no name or account, so we can't tell which are yours. They are deleted after 30 days. Saved title answers aren't linked to anyone.

Changes

If this policy changes, we'll update this page and the date at the top.

Questions

Email support@popcorn-potato.app.