Privacy policy

Your media stays with your provider

Avelio connects directly to the Jellyfin, Plex, Emby or Hearth servers you choose. Sign-in, library, artwork, playback and progress requests go to those providers. While a viewing profile other than the account holder’s is in use, its watch progress is not saved to your providers: it is kept on your device and, when you are signed in, in your Avelio account. Your providers still receive the requests and streams needed to play. A Hearth server that supports viewing profiles receives that profile’s identifier; a Hearth server without that support records that the title was played under your account. The Avelio account service does not host or proxy your movies or shows. Your provider and its administrator control their own accounts, libraries, watch history and privacy practices.

The Apple apps save provider access tokens in Apple Keychain and preferences on your device. Provider passwords are used to sign in and are not saved. The web player keeps provider credentials out of persistent browser storage. Artwork, library information and, where supported, downloads you request may be stored locally for browsing and offline use.

Your Avelio account

An account is optional in the Apple apps. The web player requires one for your connected libraries; its demo does not. Accounts let you sync connections, settings, Likes, Dislikes, a compact taste profile and viewing profiles between devices.

We store your chosen display name, account identifier, public passkey credentials, device and session information, and the information you choose to sync. Your private passkey and biometric information remain with your device or passkey provider.

If you add viewing profiles for your household, we also store, for the household, each profile’s name, avatar and age limit, whether it manages the household and whether it may request titles, and, if you set a household PIN, a value derived from it rather than the PIN; and, for each viewing profile other than the account holder’s, its watch progress (where it stopped and when), finished, favourite and hidden titles, Likes and Dislikes. The account holder’s own watch history stays with your providers and devices. Removing a profile deletes its watch progress, Likes and Dislikes from the account service.

Saved provider tokens, synced settings, taste profiles, Like and Dislike details, viewing profiles and their watch progress are encrypted on the account service. Account names, session information, indexes used to find Likes and Dislikes, the identifiers of viewing profiles and the hour a household or profile record was last saved are outside that application-level encryption. The service holds the encryption key so it can return your information to your authorised devices; this is not end-to-end encryption.

When one of your devices uses the account service, we note the hour as your account’s last activity: the hour only, not the exact time. Once a day we also record how many accounts were active over the previous day, week and month; those daily figures are counts and do not identify anyone. We use this information to operate and size the service. MADEP BV reviews these counts, account creation dates, storage use and the number of signed-in devices in a private, read-only operations dashboard. That dashboard cannot change your account and cannot decrypt your synced connections, taste profile, Like and Dislike details, viewing profiles or their watch progress. It does not display your Likes, Dislikes or device names, and it shows a display name only when a support request needs it. Its read access to the account database could, however, read the information kept outside encryption: your display name, the names of your signed-in devices, and the indexes that record which titles you liked or disliked.

Where email recovery is available, you may add a verified recovery address. We do not store the address: we keep only a keyed hash of it, which lets us recognise it when you enter it to recover your account. The verification message and recovery links are sent through our email service to the address you enter at that moment. Recovery also requires an offline code you keep. We store a verification value for that code, rather than the code itself, and recovery links expire after use or a limited time.

Recommendations and Ask

Avelio uses your library information, viewing activity, Likes and Dislikes to help rank recommendations on your device. For the account holder, account sync carries Likes, Dislikes and a compact taste profile, rather than your viewing history; for other viewing profiles it also carries their watch progress, as described above. To find more of what you enjoy, your device asks your own media servers for unwatched titles in up to three of your favourite genres. Hearth recommendations, requests and taste settings are handled separately by your connected Hearth server. When you Like or Dislike a title that your main Hearth server holds, that choice is also sent to that Hearth server, which uses it for its own recommendations. When that Hearth is your own (you are its administrator), it decides your recommendations, so a Like or Dislike of a title only your other servers hold is sent to it too, by the title’s public catalog ID (such as its TMDB ID) and never by the other server’s own ID. A friend’s Hearth never receives Likes or Dislikes of other servers’ titles; they are kept in your Avelio account. Likes and Dislikes that earlier versions sent to a Hearth you do not administer for other servers’ titles are moved to your Avelio account and removed from it. Resetting your likes and suggestions clears them in your account and on your main Hearth server when it is connected to the device you reset on (a Hearth that is not connected there keeps its likes), and suggestions then learn only from what you watch afterwards; Hearth keeps its own viewing history until you reset it there.

On supported Apple devices, Ask uses an on-device language model. Its questions and conversation stay in memory on your device and are not saved or synced to your Avelio account. Ask can request public information using selected title, person or topic search terms. Those lookup terms leave your device; your full question, conversation, private library, watch history and taste profile are not sent to public catalog services by Ask.

Catalogs, trailers and purchases

Browsing public titles, artwork, subtitles, people or trailers makes requests to public information services, through Avelio’s metadata service or directly from your device. These requests can include title identifiers, search terms or your selected region. The receiving service also sees the network information needed to handle the request, such as an IP address.

Playing a trailer connects to its host, which may include YouTube, and is subject to that host’s privacy practices. Connected-library playback continues to come from your media provider.

The Windows and Android apps download from GitHub, which receives your download request, including your IP address, and handles it under GitHub’s privacy practices.

Apple processes App Store purchases and payment details. Avelio uses verified purchase information to check Avelio Plus access; we do not receive your payment card details. Manage billing and subscriptions through your Apple account.

Viewing profiles come with the account holder’s Avelio Plus membership, so the account service receives Apple’s signed record of that subscription, from your device when you subscribe or open the app and from Apple’s server notifications when it renews, lapses or is refunded, and asks Apple for its status once a day. For your account it keeps the membership’s state (active, in a billing grace period, expired or refunded), when it ends, the subscription and transaction identifiers Apple uses for it, and whether it is a test or a real purchase. Each purchase you make while signed in carries an identifier derived from your account, so Apple’s notifications reach your account. These are kept until you delete your account; notification identifiers are kept for 30 days to avoid processing one twice.

Support and security

When you contact support, we receive your email address, message and any information you include. The support form sends your address, selected topic and message to our support mailbox through our email service, and keeps them in Avelio’s support records so a message is not lost if email fails. In those records your address is encrypted and deleted 90 days after you send the message; the copy in our support mailbox is support correspondence. It does not send an automatic copy to you. Please do not include passwords, access tokens or private media links.

Reporting a problem or sending feedback from an Avelio app or the web player is always your choice. Avelio asks every time and sends nothing unless you choose Send. Apart from what you type, a report contains only technical facts about the device and system version, the kind of media server, the format of the media, how it was delivered and the error, all listed under “What’s included” before you send. It is not linked to your Avelio account, and it does not include server addresses, file names, sign-in details or what you were watching, unless you type them. Your message and an email address for a reply are included only if you type them. The email address is used only to reply to you; it is stored encrypted and deleted 90 days after the report. Reports are kept to fix problems and improve Avelio.

We process connection and request information to operate the service and prevent abuse. The support form uses a temporary browser cookie, a single-use form token and limits based on hashed IP addresses and email addresses to reduce automated spam. Hosting and email services may also process operational and delivery logs.

Website storage and analytics

The account and support services use essential cookies for sign-in and request protection. The web player also uses browser storage for preferences and cached app resources.

Analytics run only on the marketing homepage at avelio.be. They are not installed on account, player, support or privacy pages or in the desktop app, and the native Apple apps do not include a developer advertising or analytics SDK.

Without asking. Every homepage visit is counted with Plausible, served from analytics.madep.digital. Plausible sets no cookies and stores nothing on your device. It receives the page address, including any query, and records the page, the referring site, links followed to other sites, and general browser, device and country information. It tells visits apart only with a code that changes every day and cannot identify you. Because it stores nothing on your device and keeps no personal information, it runs without asking.

Only if you accept. On your first visit, the homepage asks whether we may use Google Analytics cookies. Until you choose Accept, Google Analytics is not loaded and sets no cookies. If you accept, it loads straight away: Google stores its cookies (_ga and _ga_ followed by a code) to recognise return visits, and receives the homepage address, browser, device and network information. Google receives the address without its query and without the page you came from. Advertising storage, advertising personalisation, sharing advertising data and Google signals stay off. Google may process this information outside the European Economic Area.

Changing your choice. Your answer is saved in your browser for avelio.be only, and is not sent to us. It lasts six months, and Google Analytics cookies expire six months after they are set and are not extended by later visits. After that, or if we change how we use analytics, the homepage asks again. You can change your choice at any time with Cookie settings, at the bottom of the homepage or here. Rejecting, or withdrawing an earlier Accept, stops Google Analytics for the rest of your visit and removes its cookies from avelio.be. Information Google already received is kept according to our Google Analytics data-retention setting. Your browser’s privacy controls can also block analytics and remove cookies.

Cookie settings

Why information is processed and who receives it

We process account and sync information to provide the service you request. Where European data protection law applies, this is based on performing our agreement with you. Our legitimate interests in operating a reliable service, answering support requests and preventing misuse support the related security and support processing. We may also process information to meet legal obligations. Google Analytics on the homepage relies on your consent, which you can withdraw at any time in Cookie settings. Counting visits with Plausible, which identifies no one, relies on our legitimate interest in understanding how the website is used. Where we ask for consent for another activity, you can withdraw it by contacting us.

Information is received by the services needed for the features you use: our hosting, database and email providers; your connected media providers; public catalog and trailer services; Apple for purchases; and the website analytics services described above. Their processing locations and privacy practices can differ from ours. We may also disclose information when required by law.

Keeping and deleting information

Your active account and synced information are kept until you remove them or delete your account. Temporary authentication, recovery and abuse-prevention records have expiry times and are removed through the service’s cleanup processes. Email addresses given for a reply to a problem report, feedback or support message are deleted from Avelio’s records 90 days after they were sent; the reports and messages themselves are kept. Local caches and downloads remain subject to app, browser and device storage controls.

Account deletion removes the active Avelio account and associated passkeys, sessions, last-activity time, saved connections, settings, taste profiles, Likes, Dislikes, viewing profiles with their watch progress, the record of your Avelio Plus membership, and recovery records. Problem reports are not linked to an account and are not affected. Daily counts of active accounts contain no account information and are kept as service statistics. Support correspondence, operational logs and backup copies are handled separately and are not necessarily erased by account deletion. Contact us about information relating to you in those records.

You can manage or delete your account in account settings. On Apple TV, use the account-management code to open settings on another device. Deleting an Avelio account does not delete information held by your media provider and does not cancel an Apple subscription.

Your choices and rights

You can disconnect providers, manage Likes, Dislikes and saved settings, remove downloads where supported, and revoke account sessions. To ask for access, correction, deletion or a copy of your personal information, email support@avelio.be. Depending on applicable law, you may also request restriction of processing, object to processing based on legitimate interests, or withdraw consent. We may need to verify your identity before acting on a request.

You may complain to your local data protection authority. In Belgium, this is the Data Protection Authority.

We may update this policy as Avelio changes. The date above identifies the latest version.