Privacy Policy

Effective date: July 21, 2026

Dashboarr ("the App") is a free, open-source mobile application that lets you manage your self-hosted media services (such as qBittorrent, Radarr, Sonarr, Seerr, Tautulli, Prowlarr, Plex and Jellyfin) from a single interface.

Data Collection

Dashboarr does not collect, store, or transmit any personal data to us or to any third party. The App has:

• No user accounts or authentication system
• No analytics or tracking
• No advertising
• No third-party data sharing
• No cloud service operated by us

Data Stored on Your Device

The App stores the following data locally on your device only:

• Service URLs and API keys: the connection details you enter for your self-hosted services. API keys, usernames and passwords are stored using your device's secure storage (Keychain on iOS, Keystore on Android).
• App preferences: your configuration, such as enabled services, dashboards, widgets and display settings.

This data is used solely to communicate directly with your own self-hosted services, on your local network or via your own remote access setup. It leaves your device in only two cases, both under your control:

• When you explicitly export a backup (see below).
• When you pair the optional self-hosted backend. Pairing uploads your service URLs, API keys, usernames and passwords to that backend so it can watch your services for notifications, and re-uploads them whenever your configuration changes. The backend runs on your own hardware. We never receive this data.

Configuration Backups

If you use the export feature, the App writes a single configuration file and hands it to your operating system's share sheet, so you choose where it goes. That file is encrypted with a passphrase you set, and the App never uploads it anywhere.

Network Permissions

The App requires network access. Requests to your media services go directly from your device to your own servers, with no data routed through any intermediary operated by us.

The App also makes a small number of requests to third parties that we do not operate:

• Poster and backdrop artwork is loaded by the App directly from TMDB's image CDN (image.tmdb.org), including from the Android home-screen widget. TMDB therefore receives your device's IP address whenever artwork loads.
• Signing in to Plex, if you use that option instead of pasting a token, contacts plex.tv.
• Update checks, described below.

These requests carry no configuration data, no credentials and no personal identifiers beyond the ordinary network metadata (such as your IP address) that any HTTP request carries.

Automatic Update Checks

On launch the App checks for over-the-air JavaScript updates through Expo's update service (u.expo.dev). Roughly once a day it also checks whether a newer published version exists, by querying the Apple App Store lookup API, the Google Play listing, or the GitHub releases API depending on how the App was installed. These checks send only the App's version, build channel and platform.

Location Permission

The App may request location permission solely to detect your current Wi-Fi network name (SSID). This is used to automatically switch between local and remote service URLs depending on whether you are on your home network.

Alongside the network name, the App may read and save the access point's hardware address (BSSID) for networks you add yourself, so that a different access point broadcasting the same network name cannot trick the App into using your local addresses. Both values are stored only in the App's local configuration on your device, and inside an encrypted backup if you export one. No GPS coordinates are ever read, stored, transmitted, or shared, and location is only ever requested while the App is in the foreground.

Camera Permission

The App requests camera access for one purpose: scanning the QR code printed by your self-hosted backend when you pair it. The camera preview is processed entirely on-device, nothing is recorded, and no image or video ever leaves your device. If you pair by typing the token manually, the permission is never requested.

Device Authentication

Before exporting a configuration backup, the App asks your device to verify you with biometrics or your passcode. This uses the operating system's authentication API. The App only receives a success or failure result and never sees your biometric data or passcode.

Optional Push Notifications

Push notifications are optional and off unless you set them up. They require you to self-host the companion Dashboarr backend on your own hardware. We do not operate a server for this.

When you enable them, notification delivery necessarily uses the standard mobile push infrastructure: the Expo push service and then Apple Push Notification service or Firebase Cloud Messaging. This means the notification title and body (for example, a movie name and the words "downloaded") and your device push token pass through those providers, exactly as they do for any app that can wake a locked phone. No other data from your configuration is sent. If you do not enable push notifications, none of this applies.

Third-Party Services

The App does not integrate with any analytics, advertising, or tracking services, and contains no analytics or crash-reporting SDK. Movie and TV metadata comes from the services you configure, which source it from providers such as TMDB and TheTVDB. Poster and backdrop artwork, however, is fetched by the App itself directly from TMDB's image CDN, as described under Network Permissions above.

Children's Privacy

The App does not collect any personal information from anyone, including children under the age of 13.

Changes to This Policy

If this privacy policy is updated, the changes will be posted on this page with an updated effective date.

Contact

If you have questions about this privacy policy, you can open an issue on the GitHub repository.