Privacy policy
BufferedTV collects nothing.
BufferedTV is an unofficial PeerTube client for Apple TV. This is exactly what it keeps, what it sends, and to whom.
Last updated 24 September 2026
The short version
This app collects nothing. There is no analytics, no tracking, no advertising, no crash reporting and no third-party SDKs of any kind. Nothing is sent to the developer, because there is no server belonging to the developer to send it to.
Everything the app does, it does directly between your Apple TV and the PeerTube instances you choose to use.
What stays on your device
| Data | Where it is kept | Why |
|---|---|---|
| Your sign-in token for an instance | Apple TV keychain | So you stay signed in |
| Which instance you last used, and instances you have used before | App preferences on the device | So the app reopens where you left off |
| Your playback and content settings | App preferences on the device | To remember your choices |
| Accounts and servers you have blocked | App preferences on the device | So blocked content stays hidden, even when you are not signed in |
| Your LibreTranslate API key, if you set one | Apple TV keychain | So subtitle translation keeps working without retyping it |
Deleting the app removes all of it.
The blocklist is kept on the device deliberately, so that blocking works whether or not you have an account. If you are signed in, it is also synchronised with your instance; see below.
Your instance password is used once, to obtain a sign-in token from that instance, and is never stored.
What is sent, and to whom
The app talks to four kinds of server, and to nothing else.
1. The PeerTube instance you choose
When you sign in, your username and password are sent to that instance, and only that instance, to get a token. After that, the app sends your token with requests to list videos, load a video, and, if you are signed in, to fetch your subscriptions, playlists and history.
If Sync viewing progress is switched on (Settings ▸ Playback), the app tells your instance how far through a video you are, so that resume works across your devices. Switch it off and no progress is reported.
Liking, subscribing, and saving to a playlist are sent to your instance only when you choose to do them.
Comments. A comment or reply you write is sent to your instance under your account, and it is public: your instance shares it with the instance the video came from, like any PeerTube comment. The app keeps no copy.
Blocking. While signed in, blocking an account or a server is also sent to your instance, so the block applies on your other devices too. Signed out, the block is kept only on this Apple TV. Unblocking is sent the same way.
Reporting. If you report a video or a comment, the report goes to your own instance’s moderators, who pass it on to the instance it came from. It contains the video or comment, the category you picked and a short note saying the report came from an Apple TV. PeerTube attaches your account to it, because moderators need to know who reported something in order to act on it, which is why reporting needs you to be signed in and blocking does not.
2. Instances that host what you watch
PeerTube is a federated network, so a video you find may live on a different server from the one you signed in to. Thumbnails and video streams are fetched directly from whichever instance hosts them. Those servers necessarily see your IP address and the usual details any web request carries, exactly as they would if you visited them in a browser.
3. sepiasearch.org, when you search the network
Searching with the scope set to “Whole network” sends your search text to SepiaSearch, PeerTube’s public search index, run by Framasoft. Set the scope to your own instance and your searches go only there.
4. A LibreTranslate server, only if you set one up
Subtitle translation is off until you turn it on and enter the address of a server yourself, in Settings ▸ Subtitles. When it is on, the subtitle text of a video you are watching is sent to that server so it can be translated. Nothing else goes with it: not your account, not the video, not which instance it came from.
Which server that is, is entirely your choice. LibreTranslate is free software you can run on your own machine, in which case the text never leaves your network. If you point the app at someone else’s server, that server sees the subtitle text and your IP address, and its own privacy policy applies.
Leave the setting off and the app never contacts a translation service at all.
Each of these services has its own privacy policy, which the app has no control over.
What the app does not do
- It does not collect, transmit or sell personal data.
- It does not contain analytics, telemetry, advertising or tracking of any kind.
- It does not use third-party SDKs.
- It does not track you across apps or websites, and requests no tracking permission.
- It has no developer-operated backend. There is nowhere for your data to go.
Children
The app browses a federated network of user-generated video. It is not designed for children. Sensitive content is hidden by default and showing it is an explicit opt-in, but the app cannot vouch for what any given instance hosts.
Your control
- Sign out at any time in Settings ▸ Account, which revokes the token with your instance and deletes it from the device.
- Change instance additionally forgets that instance entirely.
- Clear your watch history from Library, which removes it on your instance.
- Review and undo blocks in Settings ▸ Blocked.
- Turn off Sync viewing progress to stop reporting playback position.
- Turn off Translate subtitles in Settings ▸ Subtitles to stop sending subtitle text anywhere. Clearing the API key field deletes it from the keychain.
- Deleting the app removes everything it has stored.
Contact
Questions about this policy: ric@squarecows.com
Source code: code.squarecows.com/ric/peertube-tvos
Help and support: open an issue